diff --git a/tools/build/build44 b/tools/build/build44
deleted file mode 100755
index 1a3c59d31..000000000
--- a/tools/build/build44
+++ /dev/null
@@ -1,787 +0,0 @@
-#!/bin/sh
-#
-# Shorewall Release Processing -- (C) 2003,2004,2005 -- Tom Eastep (teastep@shorewall.net)
-#                              -- (C) 2005,2006 -- Cristian Rodriguez (webmaster@shorewall.net)
-# Version : $Id: buildshorewall 9189 2008-12-29 19:55:18Z teastep $
-#
-#     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
-#
-#	This program is free software; you can redistribute it and/or modify
-#	it under the terms of Version 2 of the GNU General Public License
-#	as published by the Free Software Foundation.
-#
-#	This program is distributed in the hope that it will be useful,
-#	but WITHOUT ANY WARRANTY; without even the implied warranty of
-#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-#	GNU General Public License for more details.
-#
-#	You should have received a copy of the GNU General Public License
-#	along with this program; if not, write to the Free Software
-#	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# I install this script in /usr/local/bin/makeshorewall.
-#
-# Usage:
-#
-#   makeshorewall [ -trhxclpsS ] <version> [ <previous version> ]
-#
-#      -t      Build tarball
-#      -r      Build RPM
-#      -c      Build Common
-#      -l      Build Lite
-#      -L      Build 6 Lite
-#      -6      Build 6
-#      -h      Build HTML documentation
-#      -x      Build XML documentation
-#
-# If no options are given, all options are assumed.
-#
-# If <previous version> is given, patch files reflecting the differences
-# between that version and the current version ( <version> ) are generated.
-# The directory ./shorewall-<previous version> must exist and contain the
-# version against which the patch is generated.
-################################################################################
-#                          C O N F I G U R A T I O N
-################################################################################
-#
-# XSL Stylesheet to use for XML->HTML conversion
-#
-STYLESHEET=/usr/share/xml/docbook/stylesheet/nwalsh/current/xhtml/docbook.xsl
-#
-# Directory where the build log will be placed. The log has the name
-# shorewall_build_<version>.log
-#
-LOGDIR=$PWD
-#
-# Your RPM build directory
-#
-RPMDIR=~/rpm/
-#
-# Directory where you want the release to be built -- must be fully-qualified
-#
-DIR=$PWD
-#
-# location and options for GnuPG
-#
-GPG="/usr/bin/gpg -ab --batch --comment 'To verify this, you can download our public key at https://lists.shorewall.net/shorewall.gpg.key'"
-#
-# SVN Repository
-#
-SVN=https://shorewall.svn.sourceforge.net/svnroot/shorewall
-#
-# GIT Repository
-#
-GIT=~/shorewall/trunk/
-################################################################################
-#                               V A R I A B L E S
-################################################################################
-VERSION=
-BASEVERSION=
-OLDVERSION=
-SHOREWALLDIR=
-SHOREWALLLITEDIR=
-SOURCEDIR=
-SVNBRANCH=
-LITESVNBRANCH=
-XMLPROJ=
-RPMNAME=
-LITERPMNAME=
-TARBALL=
-LITETARBALL=
-LOGFILE=
-HTMLDIR=
-BUILDTARBALL=
-BUILDRPM=
-BUILDXML=
-BUILDHTML=
-SAMPLESTAG=
-MANPAGETAG=
-MANPAGE6TAG=
-LITEMANPAGETAG=
-LITE6MANPAGETAG=
-PERLDIR=
-PERLBRANCH=
-PERLRPMNAME=
-PERLTARBALL=
-BUILDCOMMON=
-BUILDPERL=
-BUILDLITE=
-PATCHRELEASE=
-PATCHNUM=
-BASEURL=http://www.shorewall.net
-
-SVN6BRANCH=
-SAMPLES6TAG=
-LITE6SVNBRANCH=
-SHOREWALL6DIR=
-LITE6DIR=
-BUILD6=
-BUILD6LITE=
-RPM6NAME=
-LITE6RPMNAME=
-TARBALL6=
-LITE6TARBALL=
-
-################################################################################
-#                               F U N C T I O N S
-################################################################################
-progress_message()
-{
-    echo         >>    $LOGFILE
-    echo "$@" | tee -a $LOGFILE
-    echo         >>    $LOGFILE
-}
-
-report()
-{
-    echo "$@" | tee -a $LOGFILE
-}
-
-do_or_die()
-{
-    eval $@ || { progress_message "Step \"$*\" FAILED" ; exit 2; }
-}
-
-fatal_error() {
-    progress_message "$*"
-    exit 2
-}
-
-list_search() # $1 = element to search for , $2-$n = list
-{
-    local e
-    e=$1
-
-    while [ $# -gt 1 ]; do
-	shift
-	[ "x$e" = "x$1" ] && return 0
-    done
-
-    return 1
-}
-
-#
-# It's easy to mis-type the GPG passphrase; this function allows us additional chances to get it right
-#
-do_rpmbuild() {
-    while ! rpmbuild --target noarch-linux $@ >> $LOGFILE 2>&1; do
-	echo    "rpmbuild $@ failed" >&2
-	echo -n "Retry? Y/n " >&2
-	read response
-	case $response in
-	    Y*|y*)
-		;;
-	    *)
-		[ -n "$response" ] && return 1
-		;;
-	esac
-    done
-
-    return 0
-}
-
-do_buildanrpm() {
-    progress_message "Building ${1}..."
-
-    cd /tmp
-    rm -rf ${2}-${BASEVERSION}
-    do_or_die "cp -a $DIR/${3} ${2}-${BASEVERSION}"
-    do_or_die "tar -zcf $RPMDIR/SOURCES/${2}-${BASEVERSION}.tgz ${2}-${BASEVERSION}"
-    cd $DIR
-    do_or_die "cp ${3}/${2}.spec $RPMDIR/SPECS/"
-    do_or_die "do_rpmbuild -ba $RPMDIR/SPECS/${2}.spec"
-    do_or_die cp -a $RPMDIR/RPMS/noarch/${1} .
-}
-
-usage()
-{
-    echo "usage: $(basename $0) [ -trhxcl6L] <version> [ <old-version> ]"
-    exit 2
-}
-
-do_export()
-{
-    progress_message "Exporting $1 from Git..." && do_or_die "git --git-dir=$GIT/.git archive --format=tar HEAD $1 | tar -xf - >> $LOGFILE 2>&1"
-    [ $1 = $2 ] || do_or_die "mv -f $1 $2 >> $LOGFILE 2>&1"
-}
-
-do_manpages()
-{
-    do_export ${1} manpages
-    cd manpages
-
-    for f in *.xml; do
-	case $f in
-	    *template.xml)
-		;;
-	    *)
-		progress_message "Generating Man Page from $f..."
-		do_or_die "xmlto --skip-validation --xsltopts "--stringparam" --xsltopts "man.base.url.for.relative.links" --xsltopts $BASEURL/manpages${3}/ man $f >> $LOGFILE 2>&1"
-		case $f in
-		    *.conf.*|shorewall.xml|shorewall6.xml|shorewall-lite.xml|shorewall6-lite.xml)
-                        ;;
-		    *)
-			g=${f#shorewall${2}-}
-			h=$(ls ${g%.xml}.[58])
-			f=shorewall${2}-$h
-			mv $h $f
-			;;
-		esac
-	    
-		eval perl -p -w -i -e "'s|/manpages${3}/manpages${3}?|/manpages${3}|'" $f
-		;;
-	esac
-    done
-
-    rm -f *.xml
-    rm -f *.bak
-}
-
-################################################################################
-#                E X E C U T I O N   S T A R T S   H E R E
-################################################################################
-
-set -e
-set -u
-
-
-done=
-
-[ $# -eq 0 ] && usage
-
-case $1 in
-    -*)
-	;;
-    *)
-	BUILDTARBALL=Yes
-	BUILDRPM=Yes
-	BUILDHTML=Yes
-	BUILDXML=Yes
-	BUILDRPM=Yes
-	BUILDCOMMON=Yes
-	BUILDLITE=Yes
-	BUILD6=Yes
-	BUILD6LITE=Yes
-
-	done=Yes
-	;;
-esac
-
-while [ -z "$done" ]; do
-    [ $# -eq 0 ] && break
-
-    option=$1
-    case $option in
-	-*)
-	    shift
-	    option=${option#-}
-
-	    [ -z "$option" ] && done=Yes && break
-
-	    while [ -n "$option" ]; do
-		case $option in
-		    t*)
-			BUILDTARBALL=Yes
-			option=${option#t}
-			;;
-		    r*)
-			BUILDTARBALL=Yes
-			BUILDRPM=Yes
-			option=${option#r}
-			;;
-		    h*)
-			BUILDHTML=Yes
-			option=${option#h}
-			;;
-		    x*)
-			BUILDXML=Yes
-			option=${option#x}
-			;;
-		    c*)
-			BUILDCOMMON=Yes
-			option=${option#c}
-			;;
-		    6*)
-			BUILD6=Yes
-			option=${option#6}
-			;;
-		    l*)
-			BUILDLITE=Yes
-			option=${option#l}
-			;;
-		    L*)
-			BUILD6LITE=Yes
-			option=${option#L}
-			;;
-	    	    *)
-			usage
-			;;
-		esac
-	    done
-	    ;;
-	*)
-	    done=Yes
-	    ;;
-    esac
-done
-
-echo "Arguments are $*"
-
-case $# in
-    1)
-	;;
-    2)
-	OLDVERSION=$2
-	;;
-    *)
-	usage
-	;;
-esac
-
-VERSION=$1
-BASEVERSION=$1
-
-LOGFILE=$LOGDIR/shorewall_build_${VERSION}.log
-touch $LOGFILE
-progress_message "Build of Shorewall $VERSION on $(date)"
-
-case $VERSION in
-     4.4.*)
-	XMLPROJ="docs-4.3"
-
-	SVNBRANCH="Shorewall"
-	SVN6BRANCH="Shorewall6"
-	LITESVNBRANCH="Shorewall-lite"
-	LITE6SVNBRANCH="Shorewall6-lite"
-	DOCTAG="docs"
-	SAMPLESTAG="Samples"
-	SAMPLES6TAG="Samples6"
-	MANPAGETAG=manpages
-	MANPAGE6TAG=manpages6
-	LITEMANPAGETAG=manpages-lite
-	LITE6MANPAGETAG=manpages6-lite
-	;;
-   *)
-	echo "Unsupported Version: $VERSION"
-	exit 2
-	;;
-esac
-
-[ -d $DIR ] || { echo "Directory $DIR does not exist or is unaccessible" ; exit 2 ; }
-
-progress_message "Distribution directory is $DIR"
-
-cd $DIR
-
-[ -n "$BUILDCOMMON" ] && SHOREWALLDIR=shorewall-${VERSION} || SHOREWALLDIR=shorewall
-SHOREWALL6DIR=shorewall6-${VERSION}
-SHOREWALLLITEDIR=shorewall-lite-${VERSION}
-LITE6DIR=shorewall6-lite-${VERSION}
-TARBALL=shorewall-${VERSION}.tgz
-TARBALL6=shorewall6-${VERSION}.tgz
-LITETARBALL=shorewall-lite-${VERSION}.tgz
-LITE6TARBALL=shorewall6-lite-${VERSION}.tgz
-
-case $VERSION in
-    *Beta*|*RC*)
-    	BASEVERSION=${VERSION%-*}
-	RPMNAME=shorewall-${BASEVERSION}-0${VERSION#*-}.noarch.rpm
-	RPM6NAME=shorewall6-${BASEVERSION}-0${VERSION#*-}.noarch.rpm
-	LITERPMNAME=shorewall-lite-${BASEVERSION}-0${VERSION#*-}.noarch.rpm
-	LITE6RPMNAME=shorewall6-lite-${BASEVERSION}-0${VERSION#*-}.noarch.rpm
-	;;
-     *)
-	#
-	# Normal Release
-	#
-	RPMNAME=shorewall-${VERSION}-0base.noarch.rpm
-	RPM6NAME=shorewall6-${VERSION}-0base.noarch.rpm
-	LITERPMNAME=shorewall-lite-${VERSION}-0base.noarch.rpm
-	LITE6RPMNAME=shorewall6-lite-${VERSION}-0base.noarch.rpm
-	;;
-esac
-
-HTMLDIR=shorewall-docs-html-$VERSION
-
-if [ -n "${BUILDTARBALL}${BUILDRPM}" ]; then
-    report "Shorewall directory is $DIR/$SHOREWALLDIR"
-    report "Shorewall6 directory is $DIR/$SHOREWALL6DIR"
-    report "Shorewall Lite directory is $DIR/$SHOREWALLLITEDIR"
-    report "Shorewall6 Lite directory is $DIR/$LITE6DIR"
-    report "SVN tag is $SVNBRANCH"
-    report "Samples tag is $SAMPLESTAG"
-    report "Samples6 tag is $SAMPLES6TAG"
-    report "SVN6 tag is $SVN6BRANCH"
-    report "Lite SVN tag is $LITESVNBRANCH"
-    report "Lite6 SVN tag is $LITE6SVNBRANCH"
-	
-    if [ -n "$BUILDTARBALL" ]; then
-	report "TARBALL is $TARBALL"
-	report "TARBALL6 is $TARBALL6"
-	report "LITETARBALL is $LITETARBALL"
-	report "LITE6TARBALL is $LITE6TARBALL"
-    fi
-
-    if [ -n "$BUILDRPM" ]; then
-	report "RPM is $RPMNAME"
-	[ -n "$RPM6NAME" ] && report "RPM6 is $RPM6NAME"
-	report "LITERPM is $LITERPMNAME"
-	[ -n "LITE6RPMNAME" ] && report "LITE6RPM is $LITE6RPMNAME"
-    fi
-fi
-
-[ -n "$BUILDHTML" ] && report "HTML Directory is $HTMLDIR"
-
-[ -n "$RPM6NAME" ]     || BUILD6=
-[ -n "$LITE6RPMNAME" ] || BUILD6LITE=
-
-if [ -n "${BUILDTARBALL}${BUILDRPM}" ]; then
-
-    rm -rf $SHOREWALLDIR
-
-    [ -n "$BUILD6" ]      && rm -rf $SHOREWALL6DIR
-    [ -n "$BUILDLITE" ]   && rm -rf $SHOREWALLLITEDIR
-    [ -n "$BUILD6LITE" ]  && rm -rf $LITE6DIR
-
-    do_export $SVNBRANCH $SHOREWALLDIR
-
-    [ -n "$BUILD6" ]      && do_export $SVN6BRANCH $SHOREWALL6DIR
- 
-    [ -n "$BUILDLITE" ]   && do_export $LITESVNBRANCH  $SHOREWALLLITEDIR
-
-    [ -n "$BUILD6LITE" ]  && do_export $LITE6SVNBRANCH  $LITE6DIR
-    	
-    if [ -n "$BUILDLITE" ]; then
-	do_or_die "cp $SHOREWALLDIR/modules $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-	do_or_die "cp $SHOREWALLDIR/lib.base $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-	if [ -f $SHOREWALLDIR/lib.cli ]; then
-	    do_or_die "cp $SHOREWALLDIR/lib.cli $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-	fi
-	if [ -f $SHOREWALLDIR/wait4ifup ]; then
-	    do_or_die "cp $SHOREWALLDIR/wait4ifup $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-	fi
-    fi
-
-    if [ -n "$BUILD6LITE" ]; then
-	do_or_die "cp $SHOREWALL6DIR/modules   $LITE6DIR >> $LOGFILE 2>&1"
-	do_or_die "cp $SHOREWALL6DIR/lib.base  $LITE6DIR >> $LOGFILE 2>&1"
-	do_or_die "cp $SHOREWALL6DIR/lib.cli   $LITE6DIR >> $LOGFILE 2>&1"
-	do_or_die "cp $SHOREWALL6DIR/wait4ifup $LITE6DIR >> $LOGFILE 2>&1"
-    fi
-
-    [ -n "$BUILD6" ]      && do_or_die "cp $SHOREWALLDIR/changelog.txt  $SHOREWALLDIR/releasenotes.txt $SHOREWALL6DIR >> $LOGFILE 2>&1"
-    [ -n "$BUILDLITE" ]   && do_or_die "cp $SHOREWALLDIR/changelog.txt  $SHOREWALLDIR/releasenotes.txt $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-    [ -n "$BUILD6LITE" ]  && do_or_die "cp $SHOREWALLDIR/changelog.txt  $SHOREWALLDIR/releasenotes.txt $LITE6DIR >> $LOGFILE 2>&1"
-
-    if [ -n "$BUILDCOMMON" ]; then
-	fgrep VERSION=$VERSION $SHOREWALLDIR/install.sh > /dev/null 2>&1     || fatal_error "install.sh has wrong version"
-	fgrep VERSION=$VERSION $SHOREWALLDIR/uninstall.sh > /dev/null 2>&1   || fatal_error "uninstall.sh has wrong version"
-	if [ -d $SHOREWALLDIR/Perl ]; then
-	    [ $(eval perl -e "'use lib \"$SHOREWALLDIR/Perl\"; use Shorewall::Config qw(:internal); print \"\$globals{VERSION}\n\"'") = $VERSION ] || \
-		fatal_error "Perl Config.pm has wrong version"
-	else
-	    [ $(eval perl -e "'use lib \"$SHOREWALLDIR\"; use Shorewall::Config qw(:internal); print \"\$globals{VERSION}\n\"'") = $VERSION ] || \
-		fatal_error "Perl Config.pm has wrong version"
-	fi
-    fi
-
-    if [ -n "$BUILD6" ]; then
-	fgrep VERSION=$VERSION $SHOREWALL6DIR/install.sh > /dev/null 2>&1     || fatal_error "6 install.sh has wrong version"
-	fgrep VERSION=$VERSION $SHOREWALL6DIR/uninstall.sh > /dev/null 2>&1   || fatal_error "6 uninstall.sh has wrong version"
-    fi
-
-    if [ -n "$BUILDLITE" ]; then
-	fgrep VERSION=$VERSION $SHOREWALLLITEDIR/install.sh > /dev/null 2>&1     || fatal_error "Lite install.sh has wrong version"
-	fgrep VERSION=$VERSION $SHOREWALLLITEDIR/uninstall.sh > /dev/null 2>&1   || fatal_error "Lite uninstall.sh has wrong version"
-    fi
-
-    if [ -n "$BUILD6LITE" ]; then
-	fgrep VERSION=$VERSION $LITE6DIR/install.sh > /dev/null 2>&1     || fatal_error "Lite 6 install.sh has wrong version"
-	fgrep VERSION=$VERSION $LITE6DIR/uninstall.sh > /dev/null 2>&1   || fatal_error "Lite 6 uninstall.sh has wrong version"
-    fi
-
-    if [ -n "$BUILDCOMMON" ]; then
-	cd $SHOREWALLDIR
-	do_export $SAMPLESTAG Samples
-	do_manpages $MANPAGETAG '' ''
-	cd $DIR
-    fi
-
-    if [ -n "$BUILD6" ]; then
-	cd $SHOREWALL6DIR
-	do_export $SAMPLES6TAG Samples6
-	do_manpages $MANPAGE6TAG 6 6
-	cd $DIR
-    fi
-
-    if [ -n "$BUILDLITE" ]; then
-	cd $SHOREWALLLITEDIR
-	do_manpages $LITEMANPAGETAG -lite ''
-	cd $DIR 
-    fi	
-
-    if [ -n "$BUILD6LITE" ]; then
-	cd $LITE6DIR
-	do_manpages $LITE6MANPAGETAG 6-lite 6
-	cd $DIR 
-    fi	
-
-    [ -n "$BUILDCOMMON" ] && do_or_die "rm -rf $SHOREWALLDIR/debian"
-    [ -n "$BUILD6" ]      && do_or_die "rm -rf $SHOREWALL6DIR/debian"
-    [ -n "$BUILDLITE" ]   && do_or_die "rm -rf $SHOREWALLLITEDIR/debian"
-    [ -n "$BUILD6LITE" ]  && do_or_die "rm -rf $LITE6DIR/debian"
-
-    if [ -n "$BUILDTARBALL" ]; then
-	if [ -n "$BUILDCOMMON" ]; then	
-	    progress_message "Creating $DIR/$TARBALL..."
-	    rm -f $SHOREWALLDIR/*.diff
-	    do_or_die "tar -zcvf $TARBALL $SHOREWALLDIR >> $LOGFILE 2>&1"
-	    do_or_die "tar -jcvf shorewall-${VERSION}.tar.bz2 $SHOREWALLDIR >> $LOGFILE 2>&1"
-	fi
-
-	if [ -n "$BUILD6" ]; then	
-	    progress_message "Creating $DIR/$TARBALL6..."
-	    rm -f $SHOREWALL6DIR/*.diff
-	    do_or_die "tar -zcvf $TARBALL6 $SHOREWALL6DIR >> $LOGFILE 2>&1"
-	    do_or_die "tar -jcvf shorewall6-${VERSION}.tar.bz2 $SHOREWALL6DIR >> $LOGFILE 2>&1"
-	fi
-
-	if [ -n "$BUILDLITE" ]; then	
-	    progress_message "Creating $DIR/$LITETARBALL..."
-	    rm -f $SHOREWALLLITEDIR/*.diff
-	    do_or_die "tar -zcvf $LITETARBALL $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-	    do_or_die "tar -jcvf shorewall-lite-${VERSION}.tar.bz2 $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-	fi
-    	
-	if [ -n "$BUILD6LITE" ]; then	
-	    progress_message "Creating $DIR/$LITE6TARBALL..."
-	    rm -f $LITE6DIR/*.diff
-	    do_or_die "tar -zcvf $LITE6TARBALL $LITE6DIR >> $LOGFILE 2>&1"
-	    do_or_die "tar -jcvf shorewall6-lite-${VERSION}.tar.bz2 $LITE6DIR >> $LOGFILE 2>&1"
-	fi    	
-    fi
-
-    if [ -n "$BUILDRPM" ]; then
-	[ -n "$BUILDCOMMON" ] && do_buildanrpm $RPMNAME      shorewall       $SHOREWALLDIR
-	[ -n "$BUILD6" ]      && do_buildanrpm $RPM6NAME     shorewall6	     $SHOREWALL6DIR
-	[ -n "$BUILDLITE" ]   && do_buildanrpm $LITERPMNAME  shorewall-lite  $SHOREWALLLITEDIR
-	[ -n "$BUILD6LITE" ]  && do_buildanrpm $LITE6RPMNAME shorewall6-lite $LITE6DIR
-    fi
-fi
-
-if [ -n "${BUILDXML}${BUILDHTML}" ]; then
-    rm -rf $XMLPROJ
-    rm -rf shorewall-docs-xml-$VERSION
-
-    do_export $DOCTAG $XMLPROJ
-    do_or_die mv $XMLPROJ shorewall-docs-xml-$VERSION
-
-    rm -f shorewall-docs-xml-$VERSION/images/*.vsd
-    rm -f shorewall-docs-xml-$VERSION/images/~*
-    rm -f shorewall-docs-xml-$VERSION/images/*.JPG
-    rm -f shorewall-docs-xml-$VERSION/images/publish
-    rm -f shorewall-docs-xml-$VERSION/images/Thumbs.db
-
-    cd shorewall-docs-xml-$VERSION
-
-    do_export $MANPAGETAG manpages
-    mv manpages manpages.save
-
-    do_export $MANPAGE6TAG manpages
-    do_or_die mv manpages manpages6.save/
-
-    do_export $LITEMANPAGETAG manpages
-    do_or_die mv manpages/* manpages.save/
-
-    do_export $LITE6MANPAGETAG manpages
-    do_or_die mv manpages/* manpages6.save/
-
-    do_or_die rm -rf manpages
-    do_or_die rm -rf manpages6
-
-    do_or_die mv manpages.save  manpages
-    do_or_die mv manpages6.save manpages6
-
-    cd $DIR
-
-    if [ -n "$BUILDXML" ]; then
-	progress_message "Creating $DIR/shorewall-docs-xml-$VERSION tarballs"
-        tar -zcvf shorewall-docs-xml-$VERSION.tgz shorewall-docs-xml-$VERSION >> $LOGFILE 2>&1
-        tar -jcvf shorewall-docs-xml-$VERSION.tar.bz2 shorewall-docs-xml-$VERSION >> $LOGFILE 2>&1 || true
-    fi
-
-    if [ -n "$BUILDHTML" ]; then
-	progress_message "Building $HTMLDIR ..."
-
-	rm -rf $HTMLDIR
-
-	do_or_die mkdir $HTMLDIR
-	do_or_die mkdir $HTMLDIR/images
-	#
-	# The original HTML documents were created using MS FrontPage and used
-	# the .htm suffix. The remainder use the .html suffix.
-	#
-	HTMFILES="
-	    6to4.htm
-	    blacklisting_support.htm
-	    configuration_file_basics.htm
-	    CorpNetwork.htm
-	    dhcp.htm
-	    Documentation.htm
-	    errata.htm
-	    fallback.htm
-	    FAQ.htm
-	    GnuCopyright.htm
-	    Install.htm
-	    IPIP.htm
-	    IPSEC.htm
-	    kernel.htm
-	    myfiles.htm
-	    NAT.htm
-	    ports.htm
-	    PPTP.htm
-	    ProxyARP.htm
-	    quotes.htm
-	    samba.htm
-	    shorewall_extension_scripts.htm
-	    shorewall_features.htm
-	    shorewall_mirrors.htm
-	    shorewall_prerequisites.htm
-	    shorewall_quickstart_guide.htm
-	    shorewall_setup_guide_fr.htm
-	    shorewall_setup_guide.htm
-	    Shorewall_sfindex_frame.htm
-	    standalone.htm
-	    starting_and_stopping_shorewall.htm
-	    support.htm
-	    three-interface.htm
-	    traffic_shaping.htm
-	    troubleshoot.htm
-	    two-interface.htm
-	    upgrade_issues.htm
-	    VPN.htm
-	    whitelisting_under_shorewall.htm"
-
-	NOTOC="
-            Documentation_Index.xml
-            ECN.xml
-            fallback.xml
-            GettingStarted.xml
-            IPP2P.xml
-            ping.xml
-            ProxyARP.xml
-            Shorewall_Doesnt.xml
-            shorewall_features.xml
-            shorewall_prerequisites.xml
-            SimpleBridge.xml"
-
-	for file in shorewall-docs-xml-$VERSION/*.xml; do
-	    a=$(basename $file)
-	    b=${a%.*}
-	    list_search $b.htm $HTMFILES && b=$b.htm || b=$b.html
-	    f="shorewall-docs-html-$VERSION/$b"
-	    list_search $1 $NOTOC && GENTOC="--stringparam generate.toc ''" || GENTOC=
-
-	    case $file in
-		*_ru.xml)
-		    LANGUAGE="--stringparam l10n.gentext.default.language ru"
-		    ;;
-		*_fr.xml)
-		    LANGUAGE="--stringparam l10n.gentext.default.language fr"
-		    ;;
-		*)
-		    LANGUAGE=
-		    ;;
-	    esac
-
-	    report "Converting $DIR/$file from XML to HTML ($DIR/$f) ..."
-
-	    do_or_die xsltproc --output $f --stringparam html.stylesheet html.css --stringparam ulink.target _self $GENTOC -param toc.section.depth 3 $STYLESHEET $file
-	done
-
-	for f in shorewall-docs-xml-$VERSION/manpages/*.xml shorewall-docs-xml-$VERSION/manpages6/*.xml; do
-	    case $f in
-		*template.xml)
-		    ;;
-		*)
-		    progress_message "Generating HTML from $f..."
-		    do_or_die xsltproc --output ${f%.xml}.html --stringparam html.stylesheet html.css --stringparam ulink.target _self -param toc.section.depth 3 $STYLESHEET $f
-		    ;;
-	    esac
-	done
-
-	progress_message "Copying manpages to $DIR/$HTMLDIR/images ..."
-
-	do_or_die mkdir $HTMLDIR/manpages
-	do_or_die cp -a shorewall-docs-xml-$VERSION/manpages/*.html $HTMLDIR/manpages/
-	do_or_die rm -f shorewall-docs-xml-$VERSION/manpages/*.html
-
-	do_or_die mkdir $HTMLDIR/manpages6
-	do_or_die cp -a shorewall-docs-xml-$VERSION/manpages6/*.html $HTMLDIR/manpages6/
-	do_or_die rm -f shorewall-docs-xml-$VERSION/manpages6/*.html
-
-	progress_message "Copying images to $DIR/$HTMLDIR/images ..."
-
-	do_or_die cp -a shorewall-docs-xml-$VERSION/images/*.png $HTMLDIR/images
-	do_or_die cp -a shorewall-docs-xml-$VERSION/images/*.gif $HTMLDIR/images
-	do_or_die cp -a shorewall-docs-xml-$VERSION/images/*.jpg $HTMLDIR/images
-	do_or_die cp -a shorewall-docs-xml-$VERSION/*.css $HTMLDIR
-
-	do_or_die ln -s Documentation_Index.html shorewall-docs-html-$VERSION/index.html
-
-	progress_message "Creating $DIR/shorewall-docs-html-$VERSION tarballs ..."
-
-	do_or_die "tar -zcvf shorewall-docs-html-$VERSION.tgz shorewall-docs-html-$VERSION >> $LOGFILE 2>&1"
-	do_or_die "tar -jcvf shorewall-docs-html-$VERSION.tar.bz2 shorewall-docs-html-$VERSION >> $LOGFILE 2>&1"
-    fi
-fi
-
-progress_message "Creating md5sums and sha1sums"
-
-rm -f $VERSION.md5sums $VERSION.sha1sums
-
-#
-# The following rather awkward algorithm gets around the problem of builds that don't
-# include the RPM
-#
-case $VERSION in
-    *Beta*|*RC*)
-	if [ -n "$BUILDCOMMON" ]; then		
-	    do_or_die "md5sum shorewall-${BASEVERSION}-0${VERSION#*-}.noarch.rpm >> $VERSION.md5sums"
-	    do_or_die "sha1sum shorewall-${BASEVERSION}-0${VERSION#*-}.noarch.rpm >> $VERSION.sha1sums"
-	fi
-
-	if [ -n "$BUILDLITE" ]; then		
-	    do_or_die "md5sum shorewall-lite-${BASEVERSION}-0${VERSION#*-}.noarch.rpm >> $VERSION.md5sums"
-	    do_or_die "sha1sum shorewall-lite-${BASEVERSION}-0${VERSION#*-}.noarch.rpm >> $VERSION.sha1sums"
-	fi
-	;;
-    *.*.*.*)
-	[ -f $RPMNAME ]      && do_or_die "md5sum $RPMNAME >> $VERSION.md5sums"
-	[ -f $RPM6NAME ]     && do_or_die "md5sum $RPM6NAME >> $VERSION.md5sums"
-	[ -f $LITERPMNAME ]  && do_or_die "md5sum $LITERPMNAME >> $VERSION.md5sums"
-	[ -f $LITE6RPMNAME ] && do_or_die "md5sum $LITE6RPMNAME >> $VERSION.md5sums"
-	;;
-esac
-
-for file in *; do
-    case $file in
-	*$VERSION[-.]*tgz|*$VERSION[-.]*rpm|*$VERSION[-.]*bz2)
-	    do_or_die "md5sum $file >> $VERSION.md5sums"
-	    do_or_die "sha1sum $file >> $VERSION.sha1sums"
-	    ;;
-    esac
-done
-
-if [ -n "$OLDVERSION" ]; then
-    
-    progress_message "Creating patch-$VERSION ..."
-
-    [ -d shorewall-$VERSION ]        && diff -Naur -X $(dirname $0)/exclude.txt shorewall-$OLDVERSION shorewall-$VERSION > patch-$VERSION || true
-    [ -d shorewall6-$VERSION ]       && diff -Naur -X $(dirname $0)/exclude.txt shorewall6-$OLDVERSION       shorewall6-$VERSION       > patch-6-$VERSION      || true
-    [ -d shorewall-lite-$VERSION ]   && diff -Naur -X $(dirname $0)/exclude.txt shorewall-lite-$OLDVERSION shorewall-lite-$VERSION     > patch-lite-$VERSION   || true
-    [ -d shorewall6-lite-$VERSION ]  && diff -Naur -X $(dirname $0)/exclude.txt shorewall6-lite-$OLDVERSION shorewall6-lite-$VERSION   > patch-6-lite-$VERSION || true
-    
-fi
-
-progress_message "Shorewall $VERSION Build complete - $(date)"
diff --git a/tools/build/buildshorewall b/tools/build/buildshorewall
deleted file mode 100755
index a5f050ee3..000000000
--- a/tools/build/buildshorewall
+++ /dev/null
@@ -1,1134 +0,0 @@
-#!/bin/sh
-#
-# Shorewall Release Processing -- (C) 2003,2004,2005 -- Tom Eastep (teastep@shorewall.net)
-#                              -- (C) 2005,2006 -- Cristian Rodriguez (webmaster@shorewall.net)
-# Version : $Id$
-#
-#     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
-#
-#	This program is free software; you can redistribute it and/or modify
-#	it under the terms of Version 2 of the GNU General Public License
-#	as published by the Free Software Foundation.
-#
-#	This program is distributed in the hope that it will be useful,
-#	but WITHOUT ANY WARRANTY; without even the implied warranty of
-#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-#	GNU General Public License for more details.
-#
-#	You should have received a copy of the GNU General Public License
-#	along with this program; if not, write to the Free Software
-#	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# I install this script in /usr/local/bin/makeshorewall.
-#
-# Usage:
-#
-#   makeshorewall [ -trhxclpsS ] <version> [ <previous version> ]
-#
-#      -t      Build tarball
-#      -r      Build RPM
-#      -c      Build Common
-#      -l      Build Lite
-#      -L      Build 6 Lite
-#      -6      Build 6
-#      -p      Build Perl
-#      -s      Build Shell
-#      -h      Build HTML documentation
-#      -x      Build XML documentation
-#      -S      Sign with GPG
-#
-# If no options are given, all options are assumed.
-#
-# If <previous version> is given, patch files reflecting the differences
-# between that version and the current version ( <version> ) are generated
-# generated. The directory ./shorewall-<previous version> must exist and
-# contain the version against which the patch is generated.
-################################################################################
-#                          C O N F I G U R A T I O N
-################################################################################
-#
-# XSL Stylesheet to use for XML->HTML conversion
-#
-STYLESHEET=/usr/share/xml/docbook/stylesheet/nwalsh/current/xhtml/docbook.xsl
-#
-# Directory where the build log will be placed. The log has the name
-# shorewall_build_<version>.log
-#
-LOGDIR=$PWD
-#
-# Your RPM build directory
-#
-RPMDIR=~/rpm/
-#
-# Directory where you want the release to be built -- must be fully-qualified
-#
-DIR=$PWD
-#
-# location and options for GnuPG
-#
-GPG="/usr/bin/gpg -ab --batch --comment 'To verify this, you can download our public key at https://lists.shorewall.net/shorewall.gpg.key'"
-#
-# SVN Repository
-#
-SVN=https://shorewall.svn.sourceforge.net/svnroot/shorewall
-################################################################################
-#                               V A R I A B L E S
-################################################################################
-VERSION=
-BASEVERSION=
-OLDVERSION=
-SHOREWALLDIR=
-SHOREWALLLITEDIR=
-SHELLDIR=
-SOURCEDIR=
-SVNBRANCH=
-LITESVNBRANCH=
-SHELLBRANCH=
-XMLPROJ=
-RPMNAME=
-LITERPMNAME=
-TARBALL=
-LITETARBALL=
-LOGFILE=
-HTMLDIR=
-BUILDTARBALL=
-BUILDRPM=
-BUILDXML=
-BUILDHTML=
-SAMPLESTAG=
-SIGN=
-MANPAGETAG=
-MANPAGE6TAG=
-LITEMANPAGETAG=
-LITE6MANPAGETAG=
-PERLDIR=
-SHELLDIR=
-PERLBRANCH=
-PERLRPMNAME=
-PERLTARBALL=
-SHELLBRANCH=
-SHELLRPMNAME=
-SHELLTARBALL=
-BUILDCOMMON=
-BUILDPERL=
-BUILDSHELL=
-BUILDLITE=
-PATCHRELEASE=
-PATCHNUM=
-BASEURL=http://www.shorewall.net
-
-SVN6BRANCH=
-SAMPLES6TAG=
-LITE6SVNBRANCH=
-SHOREWALL6DIR=
-LITE6DIR=
-BUILD6=
-BUILD6LITE=
-RPM6NAME=
-LITE6RPMNAME=
-TARBALL6=
-LITE6TARBALL=
-################################################################################
-#                               F U N C T I O N S
-################################################################################
-progress_message()
-{
-    echo         >>    $LOGFILE
-    echo "$@" | tee -a $LOGFILE
-    echo         >>    $LOGFILE
-}
-
-report()
-{
-    echo "$@" | tee -a $LOGFILE
-}
-
-do_or_die()
-{
-    eval $@ || { progress_message "Step \"$*\" FAILED" ; exit 2; }
-}
-
-fatal_error() {
-    progress_message "$*"
-    exit 2
-}
-
-list_search() # $1 = element to search for , $2-$n = list
-{
-    local e
-    e=$1
-
-    while [ $# -gt 1 ]; do
-	shift
-	[ "x$e" = "x$1" ] && return 0
-    done
-
-    return 1
-}
-
-#
-# It's easy to mis-type the GPG passphrase; this function allows us additional chances to get it right
-#
-do_rpmbuild() {
-    while ! rpmbuild $@ >> $LOGFILE 2>&1; do
-	echo    "rpmbuild $@ failed" >&2
-	echo -n "Retry? Y/n " >&2
-	read response
-	case $response in
-	    Y*|y*)
-		;;
-	    *)
-		[ -n "$response" ] && return 1
-		;;
-	esac
-    done
-
-    return 0
-}
-
-usage()
-{
-    echo "usage: $(basename $0) [ -trhxlcpsS] <version> [ <old-version> ]"
-    exit 2
-}
-################################################################################
-#                E X E C U T I O N   S T A R T S   H E R E
-################################################################################
-
-set -e
-set -u
-
-
-done=
-
-[ $# -eq 0 ] && usage
-
-case $1 in
-    -*)
-	;;
-    *)
-	BUILDTARBALL=Yes
-	BUILDRPM=Yes
-	BUILDHTML=Yes
-	BUILDXML=Yes
-	BUILDRPM=Yes
-	BUILDCOMMON=Yes
-	BUILDPERL=Yes
-	BUILDSHELL=Yes
-	BUILDLITE=Yes
-
-	case $1 in
-	    4.0.*)
-		;;
-	    *)
-		BUILD6=Yes
-		BUILD6LITE=Yes
-		;;
-	esac
-
-	done=Yes
-	SIGN=Yes
-	;;
-esac
-
-while [ -z "$done" ]; do
-    [ $# -eq 0 ] && break
-
-    option=$1
-    case $option in
-	-*)
-	    shift
-	    option=${option#-}
-
-	    [ -z "$option" ] && done=Yes && break
-
-	    while [ -n "$option" ]; do
-		case $option in
-		    t*)
-			BUILDTARBALL=Yes
-			option=${option#t}
-			;;
-		    r*)
-			BUILDTARBALL=Yes
-			BUILDRPM=Yes
-			option=${option#r}
-			;;
-		    h*)
-			BUILDHTML=Yes
-			option=${option#h}
-			;;
-		    x*)
-			BUILDXML=Yes
-			option=${option#x}
-			;;
-		    c*)
-			BUILDCOMMON=Yes
-			option=${option#c}
-			;;
-		    6*)
-			BUILD6=Yes
-			option=${option#6}
-			;;
-		    p*)
-			BUILDPERL=Yes
-			option=${option#p}
-			;;
-		    s*)
-			BUILDSHELL=Yes
-			option=${option#s}
-			;;
-		    l*)
-			BUILDLITE=Yes
-			option=${option#l}
-			;;
-		    L*)
-			BUILD6LITE=Yes
-			option=${option#L}
-			;;
-		    S*)
-			SIGN=Yes
-			option=${option#S}
-			;;
-	    	    *)
-			usage
-			;;
-		esac
-	    done
-	    ;;
-	*)
-	    done=Yes
-	    ;;
-    esac
-done
-
-echo "Arguments are $*"
-
-case $# in
-    1)
-	;;
-    2)
-	OLDVERSION=$2
-	;;
-    *)
-	usage
-	;;
-esac
-
-VERSION=$1
-BASEVERSION=$1
-
-LOGFILE=$LOGDIR/shorewall_build_${VERSION}.log
-touch $LOGFILE
-progress_message "Build of Shorewall $VERSION on $(date)"
-
-case $VERSION in
-     4.2.*.*)
-	PATCHRELEASE=Yes
-	PATCHNUM=${VERSION##*.}
-	BASEVERSION=${VERSION%.*}
-	SVNBRANCH="tags/${BASEVERSION}/Shorewall-common-${PATCHNUM}"
-	SVN6BRANCH="tags/${BASEVERSION}/Shorewall6-${PATCHNUM}"
-	LITESVNBRANCH="/tags/${BASEVERSION}/Shorewall-lite-${PATCHNUM}"
-	LITE6SVNBRANCH="/tags/${BASEVERSION}/Shorewall6-lite-${PATCHNUM}"
-	PERLBRANCH="tags/${BASEVERSION}/Shorewall-perl-${PATCHNUM}"
-	SHELLBRANCH="tags/${BASEVERSION}/Shorewall-shell-${PATCHNUM}"
-	DOCTAG="branches/4.2/docs"
-	XMLPROJ="docs-4.2"
-	SAMPLESTAG="tags/${BASEVERSION}/Samples"
-	SAMPLES6TAG="tags/${BASEVERSION}/Samples6"
-	MANPAGETAG="tags/${BASEVERSION}/manpages"
-	MANPAGE6TAG="tags/${BASEVERSION}/manpages6"
-	LITEMANPAGETAG="tags/${BASEVERSION}/manpages-lite"
-	LITE6MANPAGETAG="tags/${BASEVERSION}/manpages6-lite"
-	;;
-     4.2.*)
-	SVNBRANCH="branches/4.2/Shorewall-common"
-	SVN6BRANCH="branches/4.2//Shorewall6"
-	LITESVNBRANCH="branches/4.2/Shorewall-lite"
-	LITE6SVNBRANCH="branches/4.2/Shorewall6-lite"
-	PERLBRANCH="branches/4.2/Shorewall-perl"
-	SHELLBRANCH="branches/4.2/Shorewall-shell"
-	DOCTAG="branches/4.2/docs"
-	XMLPROJ="docs-4.2"
-	SAMPLESTAG="branches/4.2/Samples"
-	SAMPLES6TAG="branches/4.2/Samples6"
-	MANPAGETAG=branches/4.2/manpages
-	MANPAGE6TAG=branches/4.2/manpages6
-	LITEMANPAGETAG=branches/4.2/manpages-lite
-	LITE6MANPAGETAG=branches/4.2/manpages6-lite
-	;;
-     4.0.*.*)
-	PATCHRELEASE=Yes
-	PATCHNUM=${VERSION##*.}
-	BASEVERSION=${VERSION%.*}
-	SVNBRANCH="tags/${BASEVERSION}/Shorewall-common-${PATCHNUM}"
-	LITESVNBRANCH="/tags/${BASEVERSION}/Shorewall-lite-${PATCHNUM}"
-	PERLBRANCH="tags/${BASEVERSION}/Shorewall-perl-${PATCHNUM}"
-	SHELLBRANCH="tags/${BASEVERSION}/Shorewall-shell-${PATCHNUM}"
-	DOCTAG="trunk/docs"
-	XMLPROJ="docs-4.0"
-	SAMPLESTAG="tags/${BASEVERSION}/Samples"
-	MANPAGETAG="tags/${BASEVERSION}/manpages"
-	LITEMANPAGETAG="tags/${BASEVERSION}/manpages-lite"
-	BASEURL=http://www.shorewall.net/4.0
-	;;
-     4.0.*)
-	SVNBRANCH="branches/4.0/Shorewall-common"
-	LITESVNBRANCH="branches/4.0/Shorewall-lite"
-	PERLBRANCH="branches/4.0/Shorewall-perl"
-	SHELLBRANCH="branches/4.0/Shorewall-shell"
-	DOCTAG="trunk/docs"
-	XMLPROJ="docs-4.0"
-	SAMPLESTAG="branches/4.0/Samples"
-	MANPAGETAG=branches/4.0/manpages
-	LITEMANPAGETAG=branches/4.0/manpages-lite
-	BASEURL=http://www.shorewall.net/4.0
-	;;
-   *)
-	echo "Unsupported Version: $VERSION"
-	exit 2
-	;;
-esac
-
-[ -d $DIR ] || { echo "Directory $DIR does not exist or is unaccessible" ; exit 2 ; }
-
-progress_message "Distribution directory is $DIR"
-
-cd $DIR
-
-[ -n "$BUILDCOMMON" ] && SHOREWALLDIR=shorewall-common-${VERSION} || SHOREWALLDIR=shorewall-common
-SHOREWALL6DIR=shorewall6-${VERSION}
-SHOREWALLLITEDIR=shorewall-lite-${VERSION}
-LITE6DIR=shorewall6-lite-${VERSION}
-TARBALL=shorewall-common-${VERSION}.tgz
-TARBALL6=shorewall6-${VERSION}.tgz
-LITETARBALL=shorewall-lite-${VERSION}.tgz
-LITE6TARBALL=shorewall6-lite-${VERSION}.tgz
-SHELLTARBALL=shorewall-shell-${VERSION}.tgz
-SHELLDIR=shorewall-shell-${VERSION}
-PERLTARBALL=shorewall-perl-${VERSION}.tgz
-PERLDIR=shorewall-perl-${VERSION}
-
-case $VERSION in
-    *Beta*|*RC*|*Pre*)
-	#
-	# Beta or Release Candidate
-	#
-	BASEVERSION=${VERSION%-*}
-	RPMNAME=shorewall-common-${BASEVERSION}-0${VERSION#*-}.noarch.rpm
-	RPM6NAME=shorewall6-${BASEVERSION}-0${VERSION#*-}.noarch.rpm
-	LITERPMNAME=shorewall-lite-${BASEVERSION}-0${VERSION#*-}.noarch.rpm
-	LITE6RPMNAME=shorewall6-lite-${BASEVERSION}-0${VERSION#*-}.noarch.rpm
-	PERLRPMNAME=shorewall-perl-${BASEVERSION}-0${VERSION#*-}.noarch.rpm
-	SHELLRPMNAME=shorewall-shell-${BASEVERSION}-0${VERSION#*-}.noarch.rpm
-	;;
-    *.*.*.*)
-        #
-        # Patch Release
-        #
-        RPMNAME=shorewall-common-${BASEVERSION}-${PATCHNUM}.noarch.rpm
-        RPM6NAME=shorewall6-${BASEVERSION}-${PATCHNUM}.noarch.rpm
-        LITERPMNAME=shorewall-lite-${BASEVERSION}-${PATCHNUM}.noarch.rpm
-        LITE6RPMNAME=shorewall6-lite-${BASEVERSION}-${PATCHNUM}.noarch.rpm
-        PERLRPMNAME=shorewall-perl-${BASEVERSION}-${PATCHNUM}.noarch.rpm
-        SHELLRPMNAME=shorewall-shell-${BASEVERSION}-${PATCHNUM}.noarch.rpm
-        ;;
-     *)
-	#
-	# Normal Release
-	#
-	RPMNAME=shorewall-common-${VERSION}-0base.noarch.rpm
-	RPM6NAME=shorewall6-${VERSION}-0base.noarch.rpm
-	LITERPMNAME=shorewall-lite-${VERSION}-0base.noarch.rpm
-	LITE6RPMNAME=shorewall6-lite-${VERSION}-0base.noarch.rpm
-	PERLRPMNAME=shorewall-perl-${VERSION}-0base.noarch.rpm
-	SHELLRPMNAME=shorewall-shell-${VERSION}-0base.noarch.rpm
-	;;
-esac
-
-HTMLDIR=shorewall-docs-html-$VERSION
-
-if [ -n "${BUILDTARBALL}${BUILDRPM}" ]; then
-    report "Shorewall directory is $DIR/$SHOREWALLDIR"
-    report "Shorewall6 directory is $DIR/$SHOREWALL6DIR"
-    report "Shorewall Lite directory is $DIR/$SHOREWALLLITEDIR"
-    report "Shorewall6 Lite directory is $DIR/$LITE6DIR"
-    report "Shorewall Shell directory is $DIR/$SHELLDIR"
-    report "Shorewall Perl directory is $DIR/$PERLDIR"
-    report "SVN tag is $SVNBRANCH"
-    report "Samples tag is $SAMPLESTAG"
-    report "Samples6 tag is $SAMPLES6TAG"
-    report "SVN6 tag is $SVN6BRANCH"
-    report "Lite SVN tag is $LITESVNBRANCH"
-    report "Lite6 SVN tag is $LITE6SVNBRANCH"
-    report "Shell SVN tag is $SHELLBRANCH"
-    report "Perl SVN tag is $PERLBRANCH"
-    if [ -n "$BUILDTARBALL" ]; then
-	report "TARBALL is $TARBALL"
-	report "TARBALL6 is $TARBALL6"
-	report "LITETARBALL is $LITETARBALL"
-	report "LITE6TARBALL is $LITE6TARBALL"
-	report "SHELLTARBALL is $SHELLTARBALL"
-	report "PERLTARBALL is $PERLTARBALL"
-    fi
-
-    if [ -n "$BUILDRPM" ]; then
-	report "RPM is $RPMNAME"
-	[ -n "$RPM6NAME" ] && report "RPM6 is $RPM6NAME"
-	report "LITERPM is $LITERPMNAME"
-	[ -n "LITE6RPMNAME" ] && report "LITE6RPM is $LITE6RPMNAME"
-	report "SHELLRPM is $SHELLRPMNAME"
-	report "PERLRPM is $PERLRPMNAME"
-    fi
-fi
-
-[ -n "$BUILDHTML" ] && report "HTML Directory is $HTMLDIR"
-
-[ -n "$RPM6NAME" ]     || BUILD6=
-[ -n "$LITE6RPMNAME" ] || BUILD6LITE=
-
-if [ -n "${BUILDTARBALL}${BUILDRPM}" ]; then
-
-    rm -rf $SHOREWALLDIR
-
-    [ -n "$BUILD6" ]      && rm -rf $SHOREWALL6DIR
-    [ -n "$BUILDLITE" ]   && rm -rf $SHOREWALLLITEDIR
-    [ -n "$BUILD6LITE" ]  && rm -rf $LITE6DIR
-    [ -n "$BUILDPERL" ]   && rm -rf $PERLDIR
-    [ -n "$BUILDSHELL" ]  && rm -rf $SHELLDIR
-
-    progress_message "Exporting $SVNBRANCH from SVN..."     && do_or_die "svn export --non-interactive --force ${SVN}/$SVNBRANCH  $SHOREWALLDIR >> $LOGFILE 2>&1"
-
-    [ -n "$BUILD6" ]      && progress_message "Exporting $SVN6BRANCH from SVN..."     && do_or_die "svn export --non-interactive --force ${SVN}/$SVN6BRANCH $SHOREWALL6DIR >> $LOGFILE 2>&1"
- 
-    [ -n "$BUILDLITE" ]   && progress_message "Exporting $LITESVNBRANCH from SVN..."  && do_or_die "svn export --non-interactive --force ${SVN}/$LITESVNBRANCH  $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-
-    [ -n "$BUILD6LITE" ]  && progress_message "Exporting $LITE6SVNBRANCH from SVN..."  && do_or_die "svn export --non-interactive --force ${SVN}/$LITE6SVNBRANCH  $LITE6DIR >> $LOGFILE 2>&1"
-    	
-    [ -n "$BUILDPERL" ]   && progress_message "Exporting $PERLBRANCH from SVN..."     && do_or_die "svn export --non-interactive --force ${SVN}/$PERLBRANCH  $PERLDIR >> $LOGFILE 2>&1"
-
-    [ -n "$BUILDSHELL" ]  && progress_message "Exporting $SHELLBRANCH from SVN..."    && do_or_die "svn export --non-interactive --force ${SVN}/$SHELLBRANCH  $SHELLDIR >> $LOGFILE 2>&1"
-
-    
-    if [ -n "$BUILDLITE" ]; then
-	do_or_die "cp $SHOREWALLDIR/modules $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-	do_or_die "cp $SHOREWALLDIR/lib.base $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-	if [ -f $SHOREWALLDIR/lib.cli ]; then
-	    do_or_die "cp $SHOREWALLDIR/lib.cli $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-	fi
-	if [ -f $SHOREWALLDIR/wait4ifup ]; then
-	    do_or_die "cp $SHOREWALLDIR/wait4ifup $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-	fi
-    fi
-
-    if [ -n "$BUILD6LITE" ]; then
-	do_or_die "cp $SHOREWALL6DIR/modules   $LITE6DIR >> $LOGFILE 2>&1"
-	do_or_die "cp $SHOREWALL6DIR/lib.base  $LITE6DIR >> $LOGFILE 2>&1"
-	do_or_die "cp $SHOREWALL6DIR/lib.cli   $LITE6DIR >> $LOGFILE 2>&1"
-	do_or_die "cp $SHOREWALL6DIR/wait4ifup $LITE6DIR >> $LOGFILE 2>&1"
-    fi
-
-    [ -n "$BUILD6" ]      && do_or_die "cp $SHOREWALLDIR/changelog.txt  $SHOREWALLDIR/releasenotes.txt $SHOREWALL6DIR >> $LOGFILE 2>&1"
-    [ -n "$BUILDLITE" ]   && do_or_die "cp $SHOREWALLDIR/changelog.txt  $SHOREWALLDIR/releasenotes.txt $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-    [ -n "$BUILD6LITE" ]  && do_or_die "cp $SHOREWALLDIR/changelog.txt  $SHOREWALLDIR/releasenotes.txt $LITE6DIR >> $LOGFILE 2>&1"
-    [ -n "$BUILDPERL" ]   && do_or_die "cp $SHOREWALLDIR/changelog.txt  $SHOREWALLDIR/releasenotes.txt $PERLDIR >> $LOGFILE 2>&1"
-    [ -n "$BUILDSHELL" ]  && do_or_die "cp $SHOREWALLDIR/changelog.txt  $SHOREWALLDIR/releasenotes.txt $SHELLDIR >> $LOGFILE 2>&1"
-
-    if [ -n "$BUILDCOMMON" ]; then
-	fgrep VERSION=$VERSION $SHOREWALLDIR/install.sh > /dev/null 2>&1     || fatal_error "install.sh has wrong version"
-	fgrep VERSION=$VERSION $SHOREWALLDIR/uninstall.sh > /dev/null 2>&1   || fatal_error "uninstall.sh has wrong version"
-	fgrep VERSION=$VERSION $SHOREWALLDIR/fallback.sh > /dev/null 2>&1    || fatal_error "fallback.sh has wrong version"
-    fi
-
-    if [ -n "$BUILD6" ]; then
-	fgrep VERSION=$VERSION $SHOREWALL6DIR/install.sh > /dev/null 2>&1     || fatal_error "6 install.sh has wrong version"
-	fgrep VERSION=$VERSION $SHOREWALL6DIR/uninstall.sh > /dev/null 2>&1   || fatal_error "6 uninstall.sh has wrong version"
-	fgrep VERSION=$VERSION $SHOREWALL6DIR/fallback.sh > /dev/null 2>&1    || fatal_error "6 fallback.sh has wrong version"
-    fi
-
-    if [ -n "$BUILDLITE" ]; then
-	fgrep VERSION=$VERSION $SHOREWALLLITEDIR/install.sh > /dev/null 2>&1     || fatal_error "Lite install.sh has wrong version"
-	fgrep VERSION=$VERSION $SHOREWALLLITEDIR/uninstall.sh > /dev/null 2>&1   || fatal_error "Lite uninstall.sh has wrong version"
-	fgrep VERSION=$VERSION $SHOREWALLLITEDIR/fallback.sh > /dev/null 2>&1    || fatal_error "Lite fallback.sh has wrong version"
-    fi
-
-    if [ -n "$BUILD6LITE" ]; then
-	fgrep VERSION=$VERSION $LITE6DIR/install.sh > /dev/null 2>&1     || fatal_error "Lite 6 install.sh has wrong version"
-	fgrep VERSION=$VERSION $LITE6DIR/uninstall.sh > /dev/null 2>&1   || fatal_error "Lite 6 uninstall.sh has wrong version"
-	fgrep VERSION=$VERSION $LITE6DIR/fallback.sh > /dev/null 2>&1    || fatal_error "Lite 6 fallback.sh has wrong version"
-    fi
-
-    if [ -n "$BUILDSHELL" ]; then
-	fgrep VERSION=$VERSION $SHELLDIR/install.sh > /dev/null 2>&1 || fatal_error "Shell install.sh has wrong version"
-    fi
-
-    if [ -n "$BUILDPERL" ]; then    
-	fgrep VERSION=$VERSION $PERLDIR/install.sh > /dev/null 2>&1   || fatal_error "Perl install.sh has wrong version"
-	[ $(eval perl -e "'use lib \"$PERLDIR\"; use Shorewall::Config qw(:internal); print \"\$globals{VERSION}\n\"'") = $VERSION ] || \
-	    fatal_error "Perl Config.pm has wrong version"
-    fi
-
-    if [ -n "$BUILDCOMMON" ]; then
-	cd $SHOREWALLDIR
-	do_or_die "svn export --non-interactive --force ${SVN}/$SAMPLESTAG Samples >> $LOGFILE 2>&1"
-	progress_message "Exporting $MANPAGETAG from SVN..."
-	do_or_die "svn export --non-interactive --force ${SVN}/$MANPAGETAG manpages >> $LOGFILE 2>&1"
-	cd manpages
-	for f in *.xml; do
-	    if [ $f != shorewall-template.xml ]; then
-		progress_message "Generating Man Page from $f..."
-		do_or_die "xmlto --skip-validation --xsltopts "--stringparam" --xsltopts "man.base.url.for.relative.links" --xsltopts $BASEURL/manpages/ man $f >> $LOGFILE 2>&1"
-		case $f in
-		    *.conf.*|shorewall.xml)
-			;;
-		    *)
-			g=${f#shorewall-}
-			h=$(ls ${g%.xml}.[58])
-			f=shorewall-$h
-			mv $h $f
-			;;
-		esac
-
-		perl -p -w -i -e 's|/(4\.0/)?manpages/\.\.||' $f
-	    fi
-	done
-	rm *.xml
-	cd $DIR
-    fi
-
-    if [ -n "$BUILD6" ]; then
-	cd $SHOREWALL6DIR
-	do_or_die "svn export --non-interactive --force ${SVN}/$SAMPLES6TAG Samples6 >> $LOGFILE 2>&1"
-	progress_message "Exporting $MANPAGE6TAG from SVN..."
-	do_or_die "svn export --non-interactive --force ${SVN}/$MANPAGE6TAG manpages >> $LOGFILE 2>&1"
-	cd manpages
-	for f in *.xml; do
-	    if [ $f != shorewall6-template.xml ]; then
-		progress_message "Generating Man Page from $f..."
-		do_or_die "xmlto --skip-validation --xsltopts "--stringparam" --xsltopts "man.base.url.for.relative.links" --xsltopts $BASEURL/manpages6/ man $f >> $LOGFILE 2>&1"
-		case $f in
-		    *.conf.*|shorewall6.xml)
-			;;
-		    *)
-			g=${f#shorewall6-}
-			h=$(ls ${g%.xml}.[58])
-			f=shorewall6-$h
-			mv $h $f
-			;;
-		esac
-
-		perl -p -w -i -e 's|/manpages6/\.\.||' $f
-	    fi
-	done
-	rm *.xml
-	cd $DIR
-    fi
-
-    if [ -n "$BUILDLITE" ]; then
-	cd $SHOREWALLLITEDIR
-	progress_message "Exporting $LITEMANPAGETAG from SVN..."
-	do_or_die "svn export --non-interactive --force ${SVN}/$LITEMANPAGETAG manpages >> $LOGFILE 2>&1"
-	cd manpages
-	for f in *.xml; do
-	    if [ $f != shorewall-template.xml ]; then
-		progress_message "Generating Man Page from $f..."
-		do_or_die "xmlto --skip-validation --xsltopts "--stringparam" --xsltopts "man.base.url.for.relative.links" --xsltopts $BASEURL/manpages/ man $f >> $LOGFILE 2>&1"
-		case $f in
-		    *.conf.*|shorewall-lite.xml)
-			;;
-		    *)
-			g=${f#shorewall-lite-}
-			h=$(ls ${g%.xml}.[58])
-			f=shorewall-lite-$h
-			mv $h $f
-			;;
-		esac
-
-		perl -p -w -i -e 's|/(4\.0/)?manpages/\.\.||' $f
-	    fi
-	done
-	rm *.xml
-	cd $DIR 
-    fi	
-
-    if [ -n "$BUILD6LITE" ]; then
-	cd $LITE6DIR
-	progress_message "Exporting $LITE6MANPAGETAG from SVN..."
-	do_or_die "svn export --non-interactive --force ${SVN}/$LITE6MANPAGETAG manpages >> $LOGFILE 2>&1"
-	cd manpages
-	for f in *.xml; do
-	    if [ $f != shorewall6-template.xml ]; then
-		progress_message "Generating Man Page from $f..."
-		do_or_die "xmlto --skip-validation --xsltopts "--stringparam" --xsltopts "man.base.url.for.relative.links" --xsltopts $BASEURL/manpages6/ man $f >> $LOGFILE 2>&1"
-		case $f in
-		    *.conf.*|shorewall6-lite.xml)
-			;;
-		    *)
-			g=${f#shorewall6-lite-}
-			h=$(ls ${g%.xml}.[58])
-			f=shorewall6-lite-$h
-			mv $h $f
-			;;
-		esac
-
-		perl -p -w -i -e 's|/manpages6/\.\.||' $f
-	    fi
-	done
-	rm *.xml
-	cd $DIR 
-    fi	
-
-    [ -n "$BUILDCOMMON" ] && do_or_die "rm -rf $SHOREWALLDIR/debian"
-    [ -n "$BUILD6" ]      && do_or_die "rm -rf $SHOREWALL6DIR/debian"
-    [ -n "$BUILDLITE" ]   && do_or_die "rm -rf $SHOREWALLLITEDIR/debian"
-    [ -n "$BUILD6LITE" ]  && do_or_die "rm -rf $LITE6DIR/debian"
-    [ -n "$BUILDPERL" ]   && do_or_die "rm -rf $PERLDIR/debian"
-    [ -n "$BUILDSHELL" ]  && do_or_die "rm -rf $SHELLDIR/debian"
-
-    if [ -n "$BUILDTARBALL" ]; then
-	if [ -n "$BUILDCOMMON" ]; then	
-	    progress_message "Creating $DIR/$TARBALL..."
-	    rm -f $SHOREWALLDIR/*.diff
-	    do_or_die "tar -zcvf $TARBALL $SHOREWALLDIR >> $LOGFILE 2>&1"
-	    do_or_die "tar -jcvf shorewall-common-${VERSION}.tar.bz2 $SHOREWALLDIR >> $LOGFILE 2>&1"
-	    if [ -n "$SIGN" ]; then
-		for shoresuffix in tgz tar.bz2; do
-		    shoreball=shorewall-common-${VERSION}.${shoresuffix}
-		    report "GPG signing $DIR/$shoreball"
-		    rm -f ${shoreball}.asc
-		    do_or_die "$GPG $shoreball"
-		done
-	    fi
-	fi
-
-	if [ -n "$BUILD6" ]; then	
-	    progress_message "Creating $DIR/$TARBALL6..."
-	    rm -f $SHOREWALL6DIR/*.diff
-	    do_or_die "tar -zcvf $TARBALL6 $SHOREWALL6DIR >> $LOGFILE 2>&1"
-	    do_or_die "tar -jcvf shorewall6-${VERSION}.tar.bz2 $SHOREWALL6DIR >> $LOGFILE 2>&1"
-	    if [ -n "$SIGN" ]; then
-		for shoresuffix in tgz tar.bz2; do
-		    shoreball=shorewall6-${VERSION}.${shoresuffix}
-		    report "GPG signing $DIR/$shoreball"
-		    rm -f ${shoreball}.asc
-		    do_or_die "$GPG $shoreball"
-		done
-	    fi
-	fi
-
-	if [ -n "$BUILDLITE" ]; then	
-	    progress_message "Creating $DIR/$LITETARBALL..."
-	    rm -f $SHOREWALLLITEDIR/*.diff
-	    do_or_die "tar -zcvf $LITETARBALL $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-	    do_or_die "tar -jcvf shorewall-lite-${VERSION}.tar.bz2 $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-	    if [ -n "$SIGN" ]; then
-		for shoresuffix in tgz tar.bz2; do
-		    shoreball=shorewall-lite-${VERSION}.${shoresuffix}
-		    report "GPG signing $DIR/$shoreball"
-		    rm -f ${shoreball}.asc
-		    do_or_die "$GPG $shoreball"
-		done
-	    fi
-	fi
-    	
-	if [ -n "$BUILD6LITE" ]; then	
-	    progress_message "Creating $DIR/$LITE6TARBALL..."
-	    rm -f $LITE6DIR/*.diff
-	    do_or_die "tar -zcvf $LITE6TARBALL $LITE6DIR >> $LOGFILE 2>&1"
-	    do_or_die "tar -jcvf shorewall6-lite-${VERSION}.tar.bz2 $LITE6DIR >> $LOGFILE 2>&1"
-	    if [ -n "$SIGN" ]; then
-		for shoresuffix in tgz tar.bz2; do
-		    shoreball=shorewall6-lite-${VERSION}.${shoresuffix}
-		    report "GPG signing $DIR/$shoreball"
-		    rm -f ${shoreball}.asc
-		    do_or_die "$GPG $shoreball"
-		done
-	    fi
-	fi
-    	
-	if [ -n "$BUILDPERL" ]; then	
-	    progress_message "Creating $DIR/$PERLTARBALL..."
-	    rm -f $PERLDIR/*.diff
-	    do_or_die "tar -zcvf $PERLTARBALL $PERLDIR >> $LOGFILE 2>&1"
-	    do_or_die "tar -jcvf shorewall-perl-${VERSION}.tar.bz2 $PERLDIR >> $LOGFILE 2>&1"
-	    
-	    if [ -n "$SIGN" ]; then
-		for shoresuffix in tgz tar.bz2; do
-		    shoreball=shorewall-perl-${VERSION}.${shoresuffix}
-		    report "GPG signing $DIR/$shoreball"
-		    rm -f ${shoreball}.asc
-		    do_or_die "$GPG $shoreball"
-		done
-	    fi
-	fi
-
-	if [ -n "$BUILDSHELL" ]; then	
-	    progress_message "Creating $DIR/$SHELLTARBALL..."
-	    rm -f $SHELLDIR/*.diff
-	    do_or_die "tar -zcvf $SHELLTARBALL $SHELLDIR >> $LOGFILE 2>&1"
-	    do_or_die "tar -jcvf shorewall-shell-${VERSION}.tar.bz2 $SHELLDIR >> $LOGFILE 2>&1"
-	
-	    if [ -n "$SIGN" ]; then
-		for shoresuffix in tgz tar.bz2; do
-		    shoreball=shorewall-shell-${VERSION}.${shoresuffix}
-		    report "GPG signing $DIR/$shoreball"
-		    rm -f ${shoreball}.asc
-		    do_or_die "$GPG $shoreball"
-		done
-	    fi
-	fi
-    fi
-
-    if [ -n "$BUILDRPM" ]; then
-	test -n "$SIGN" && SIGN="--sign"
-	
-	if [ -n "$BUILDCOMMON" ]; then	
-	    progress_message "Building $RPMNAME..."
-
-	    cd /tmp
-	    rm -rf shorewall-common-${BASEVERSION}
-	    do_or_die "cp -a $DIR/$SHOREWALLDIR shorewall-common-${BASEVERSION}"
-	    do_or_die "tar -zcf $RPMDIR/SOURCES/shorewall-common-${BASEVERSION}.tgz shorewall-common-${BASEVERSION}"
-	    cd $DIR
-	    do_or_die "cp $SHOREWALLDIR/shorewall-common.spec $RPMDIR/SPECS/"
-	    do_or_die "do_rpmbuild -ba $SIGN $RPMDIR/SPECS/shorewall-common.spec"
-	    do_or_die cp -a $RPMDIR/RPMS/noarch/$RPMNAME .
-	fi
-
-	if [ -n "$BUILD6" ]; then	
-	    progress_message "Building $RPM6NAME..."
-
-	    cd /tmp
-	    rm -rf shorewall6-${BASEVERSION}
-	    do_or_die "cp -a $DIR/$SHOREWALL6DIR shorewall6-${BASEVERSION}"
-	    do_or_die "tar -zcf $RPMDIR/SOURCES/shorewall6-${BASEVERSION}.tgz shorewall6-${BASEVERSION}"
-	    cd $DIR
-	    do_or_die "cp $SHOREWALL6DIR/shorewall6.spec $RPMDIR/SPECS/"
-	    do_or_die "do_rpmbuild -ba $SIGN $RPMDIR/SPECS/shorewall6.spec"
-	    do_or_die cp -a $RPMDIR/RPMS/noarch/$RPM6NAME .
-	fi
-
-	if [ -n "$BUILDLITE" ]; then	
-	    progress_message "Building $LITERPMNAME..."
-
-	    cd /tmp
-	    rm -rf shorewall-lite-${BASEVERSION}
-	    do_or_die "cp -a $DIR/$SHOREWALLLITEDIR shorewall-lite-${BASEVERSION}" 
-	    do_or_die "tar -zcf $RPMDIR/SOURCES/shorewall-lite-${BASEVERSION}.tgz shorewall-lite-${BASEVERSION}"
-	    cd $DIR
-	    do_or_die "cp $SHOREWALLLITEDIR/shorewall-lite.spec $RPMDIR/SPECS/"
-	    do_or_die "do_rpmbuild -ba $SIGN $RPMDIR/SPECS/shorewall-lite.spec"
-	    do_or_die cp -a $RPMDIR/RPMS/noarch/$LITERPMNAME .
-	fi
-
-	if [ -n "$BUILD6LITE" ]; then	
-	    progress_message "Building $LITE6RPMNAME..."
-
-	    cd /tmp
-	    rm -rf shorewall6-lite-${BASEVERSION}
-	    do_or_die "cp -a $DIR/$LITE6DIR shorewall6-lite-${BASEVERSION}" 
-	    do_or_die "tar -zcf $RPMDIR/SOURCES/shorewall6-lite-${BASEVERSION}.tgz shorewall6-lite-${BASEVERSION}"
-	    cd $DIR
-	    do_or_die "cp $LITE6DIR/shorewall6-lite.spec $RPMDIR/SPECS/"
-	    do_or_die "do_rpmbuild -ba $SIGN $RPMDIR/SPECS/shorewall6-lite.spec"
-	    do_or_die cp -a $RPMDIR/RPMS/noarch/$LITE6RPMNAME .
-	fi
-
-	if [ -n "$BUILDPERL" ]; then	
-	    progress_message "Building $PERLRPMNAME..."
-
-	    cd /tmp
-	    rm -rf shorewall-perl-${BASEVERSION}
-	    do_or_die "cp -a $DIR/$PERLDIR shorewall-perl-${BASEVERSION}"
-	    do_or_die "tar -zcf $RPMDIR/SOURCES/shorewall-perl-${BASEVERSION}.tgz shorewall-perl-${BASEVERSION}"
-	    cd $DIR
-	    do_or_die "cp $PERLDIR/shorewall-perl.spec $RPMDIR/SPECS/"
-	    do_or_die "do_rpmbuild -ba $SIGN $RPMDIR/SPECS/shorewall-perl.spec"
-	    do_or_die cp -a $RPMDIR/RPMS/noarch/$PERLRPMNAME  .
-	fi
-
-	if [ -n "$BUILDSHELL" ]; then	
-	    progress_message "Building $SHELLRPMNAME..."
-
-	    cd /tmp
-	    rm -rf shorewall-shell-${BASEVERSION}
-	    do_or_die "cp -a $DIR/$SHELLDIR shorewall-shell-${BASEVERSION}"
-	    do_or_die "tar -zcf $RPMDIR/SOURCES/shorewall-shell-${BASEVERSION}.tgz shorewall-shell-${BASEVERSION}"
-	    cd $DIR
-	    do_or_die "cp $SHELLDIR/shorewall-shell.spec $RPMDIR/SPECS/"
-	    do_or_die "do_rpmbuild -ba $SIGN $RPMDIR/SPECS/shorewall-shell.spec"
-	    do_or_die cp -a $RPMDIR/RPMS/noarch/$SHELLRPMNAME  .
-	fi
-    fi
-fi
-
-if [ -n "${BUILDXML}${BUILDHTML}" ]; then
-    progress_message "Exporting $XMLPROJ from SVN..."
-
-    rm -rf $XMLPROJ
-    rm -rf shorewall-docs-xml-$VERSION
-
-    do_or_die "svn export --non-interactive --force ${SVN}/$DOCTAG $XMLPROJ >> $LOGFILE 2>&1"
-    do_or_die mv $XMLPROJ shorewall-docs-xml-$VERSION
-
-    rm -f shorewall-docs-xml-$VERSION/images/*.vsd
-    rm -f shorewall-docs-xml-$VERSION/images/~*
-    rm -f shorewall-docs-xml-$VERSION/images/*.JPG
-    rm -f shorewall-docs-xml-$VERSION/images/publish
-    rm -f shorewall-docs-xml-$VERSION/images/Thumbs.db
-
-    cd shorewall-docs-xml-$VERSION
-
-    rm -rf manpages.save
-    rm -rf manpages6.save
-
-    progress_message "Exporting $MANPAGETAG from SVN..."
-    do_or_die "svn export --non-interactive --force ${SVN}/$MANPAGETAG manpages >> $LOGFILE 2>&1"
-    mv manpages manpages.save
-
-    if [ -n "$MANPAGE6TAG" ]; then
-	progress_message "Exporting $MANPAGE6TAG from SVN..."
-	do_or_die "svn export --non-interactive --force ${SVN}/$MANPAGE6TAG manpages >> $LOGFILE 2>&1"
-	do_or_die mv manpages manpages6.save/
-    fi
-
-    progress_message "Exporting $LITEMANPAGETAG from SVN..."	
-    do_or_die "svn export --non-interactive --force ${SVN}/$LITEMANPAGETAG manpages >> $LOGFILE 2>&1"
-    do_or_die mv manpages/* manpages.save/
-
-    if [ -n "$LITE6MANPAGETAG" ]; then
-	progress_message "Exporting $LITE6MANPAGETAG from SVN..."
-	do_or_die "svn export --non-interactive --force ${SVN}/$LITE6MANPAGETAG manpages >> $LOGFILE 2>&1"    
-	do_or_die mv manpages/* manpages6.save/
-    fi
-
-    do_or_die rm -rf manpages
-    do_or_die rm -rf manpages6
-
-    do_or_die mv manpages.save manpages
-    do_or_die mv manpages6.save manpages6
-
-    cd $DIR
-
-    if [ -n "$BUILDXML" ]; then
-	progress_message "Creating $DIR/shorewall-docs-xml-$VERSION tarballs"
-        tar -zcvf shorewall-docs-xml-$VERSION.tgz shorewall-docs-xml-$VERSION >> $LOGFILE 2>&1
-        tar -jcvf shorewall-docs-xml-$VERSION.tar.bz2 shorewall-docs-xml-$VERSION >> $LOGFILE 2>&1 || true
-	if [ -n "$SIGN" ]; then
-	    for shoresuffix in tgz tar.bz2; do
-		xmlball=shorewall-docs-xml-$VERSION.${shoresuffix}
-		report "GPG signing $DIR/$xmlball tarball"
-		rm -f ${xmlball}.asc
-		do_or_die "$GPG $xmlball"
-	    done
-	fi
-    fi
-
-    if [ -n "$BUILDHTML" ]; then
-	progress_message "Building $HTMLDIR ..."
-
-	rm -rf $HTMLDIR
-
-	do_or_die mkdir $HTMLDIR
-	do_or_die mkdir $HTMLDIR/images
-	#
-	# The original HTML documents were created using MS FrontPage and used
-	# the .htm suffix. The remainder use the .html suffix.
-	#
-	HTMFILES="
-	    6to4.htm
-	    blacklisting_support.htm
-	    configuration_file_basics.htm
-	    CorpNetwork.htm
-	    dhcp.htm
-	    Documentation.htm
-	    errata.htm
-	    fallback.htm
-	    FAQ.htm
-	    GnuCopyright.htm
-	    Install.htm
-	    IPIP.htm
-	    IPSEC.htm
-	    kernel.htm
-	    myfiles.htm
-	    NAT.htm
-	    ports.htm
-	    PPTP.htm
-	    ProxyARP.htm
-	    quotes.htm
-	    samba.htm
-	    shorewall_extension_scripts.htm
-	    shorewall_features.htm
-	    shorewall_mirrors.htm
-	    shorewall_prerequisites.htm
-	    shorewall_quickstart_guide.htm
-	    shorewall_setup_guide_fr.htm
-	    shorewall_setup_guide.htm
-	    Shorewall_sfindex_frame.htm
-	    standalone.htm
-	    starting_and_stopping_shorewall.htm
-	    support.htm
-	    three-interface.htm
-	    traffic_shaping.htm
-	    troubleshoot.htm
-	    two-interface.htm
-	    upgrade_issues.htm
-	    VPN.htm
-	    whitelisting_under_shorewall.htm"
-
-	NOTOC="
-            Documentation_Index.xml
-            ECN.xml
-            fallback.xml
-            GettingStarted.xml
-            IPP2P.xml
-            ping.xml
-            ProxyARP.xml
-            Shorewall_Doesnt.xml
-            shorewall_features.xml
-            shorewall_prerequisites.xml
-            SimpleBridge.xml"
-
-	for file in shorewall-docs-xml-$VERSION/*.xml; do
-	    a=$(basename $file)
-	    b=${a%.*}
-	    list_search $b.htm $HTMFILES && b=$b.htm || b=$b.html
-	    f="shorewall-docs-html-$VERSION/$b"
-	    list_search $1 $NOTOC && GENTOC="--stringparam generate.toc ''" || GENTOC=
-
-	    case $file in
-		*_ru.xml)
-		    LANGUAGE="--stringparam l10n.gentext.default.language ru"
-		    ;;
-		*_fr.xml)
-		    LANGUAGE="--stringparam l10n.gentext.default.language fr"
-		    ;;
-		*)
-		    LANGUAGE=
-		    ;;
-	    esac
-
-	    report "Converting $DIR/$file from XML to HTML ($DIR/$f) ..."
-
-	    do_or_die xsltproc --output $f --stringparam html.stylesheet html.css --stringparam ulink.target _self $GENTOC -param toc.section.depth 3 $STYLESHEET $file
-	done
-
-	for f in shorewall-docs-xml-$VERSION/manpages/*.xml shorewall-docs-xml-$VERSION/manpages6/*.xml; do
-	    case $f in
-		*template.xml)
-		    ;;
-		*)
-		    progress_message "Generating HTML from $f..."
-		    do_or_die xsltproc --output ${f%.xml}.html --stringparam html.stylesheet html.css --stringparam ulink.target _self -param toc.section.depth 3 $STYLESHEET $f
-		    ;;
-	    esac
-	done
-
-	progress_message "Copying manpages to $DIR/$HTMLDIR/images ..."
-
-	do_or_die mkdir $HTMLDIR/manpages
-	do_or_die cp -a shorewall-docs-xml-$VERSION/manpages/*.html $HTMLDIR/manpages/
-	do_or_die rm -f shorewall-docs-xml-$VERSION/manpages/*.html
-
-	do_or_die mkdir $HTMLDIR/manpages6
-	do_or_die cp -a shorewall-docs-xml-$VERSION/manpages6/*.html $HTMLDIR/manpages6/
-	do_or_die rm -f shorewall-docs-xml-$VERSION/manpages6/*.html
-
-	progress_message "Copying images to $DIR/$HTMLDIR/images ..."
-
-	do_or_die cp -a shorewall-docs-xml-$VERSION/images/*.png $HTMLDIR/images
-	do_or_die cp -a shorewall-docs-xml-$VERSION/images/*.gif $HTMLDIR/images
-	do_or_die cp -a shorewall-docs-xml-$VERSION/images/*.jpg $HTMLDIR/images
-	do_or_die cp -a shorewall-docs-xml-$VERSION/*.css $HTMLDIR
-
-	do_or_die ln -s Documentation_Index.html shorewall-docs-html-$VERSION/index.html
-
-	progress_message "Creating $DIR/shorewall-docs-html-$VERSION tarballs ..."
-
-	do_or_die "tar -zcvf shorewall-docs-html-$VERSION.tgz shorewall-docs-html-$VERSION >> $LOGFILE 2>&1"
-	do_or_die "tar -jcvf shorewall-docs-html-$VERSION.tar.bz2 shorewall-docs-html-$VERSION >> $LOGFILE 2>&1"
-	if [ -n "$SIGN" ]; then
-	    for shoresuffix in tgz tar.bz2; do
-		htmlball=shorewall-docs-html-$VERSION.${shoresuffix}
-		report "GPG signing $DIR/$htmlball tarball"
-		rm -f ${htmlball}.asc
-		do_or_die "$GPG $htmlball"
-	    done
-	fi
-    fi
-fi
-
-progress_message "Creating md5sums and sha1sums"
-
-rm -f $VERSION.md5sums $VERSION.sha1sums
-
-#
-# The following rather awkward algorithm gets around the problem of builds that don't
-# include the RPM
-#
-case $VERSION in
-    *Beta*|*RC*)
-	if [ -n "$BUILDCOMMON" ]; then		
-	    do_or_die "md5sum shorewall-common-${BASEVERSION}-0${VERSION#*-}.noarch.rpm >> $VERSION.md5sums"
-	    do_or_die "sha1sum shorewall-common-${BASEVERSION}-0${VERSION#*-}.noarch.rpm >> $VERSION.sha1sums"
-	fi
-
-	if [ -n "$BUILDLITE" ]; then		
-	    do_or_die "md5sum shorewall-lite-${BASEVERSION}-0${VERSION#*-}.noarch.rpm >> $VERSION.md5sums"
-	    do_or_die "sha1sum shorewall-lite-${BASEVERSION}-0${VERSION#*-}.noarch.rpm >> $VERSION.sha1sums"
-	fi
-
-	if [ -n "$BUILDPERL" ]; then		
-	    do_or_die "md5sum shorewall-perl-${BASEVERSION}-0${VERSION#*-}.noarch.rpm >> $VERSION.md5sums"
-	    do_or_die "sha1sum shorewall-perl-${BASEVERSION}-0${VERSION#*-}.noarch.rpm >> $VERSION.sha1sums"
-	fi
-
-	if [ -n "$BUILDSHELL" ]; then		
-	    do_or_die "md5sum shorewall-shell-${BASEVERSION}-0${VERSION#*-}.noarch.rpm >> $VERSION.md5sums"
-	    do_or_die "sha1sum shorewall-shell-${BASEVERSION}-0${VERSION#*-}.noarch.rpm >> $VERSION.sha1sums"
-	fi
-	;;
-    *.*.*.*)
-	[ -f $RPMNAME ]      && do_or_die "md5sum $RPMNAME >> $VERSION.md5sums"
-	[ -f $RPM6NAME ]     && do_or_die "md5sum $RPM6NAME >> $VERSION.md5sums"
-	[ -f $LITERPMNAME ]  && do_or_die "md5sum $LITERPMNAME >> $VERSION.md5sums"
-	[ -f $LITE6RPMNAME ] && do_or_die "md5sum $LITE6RPMNAME >> $VERSION.md5sums"
-	[ -f $PERLRPMNAME ]  && do_or_die "md5sum $PERLRPMNAME >> $VERSION.md5sums"
-	[ -f $SHELLRPMNAME ] && do_or_die "md5sum $SHELLRPMNAME >> $VERSION.md5sums"
-	;;
-esac
-
-for file in *; do
-    case $file in
-	*$VERSION[-.]*tgz|*$VERSION[-.]*rpm|*$VERSION[-.]*bz2)
-	    do_or_die "md5sum $file >> $VERSION.md5sums"
-	    do_or_die "sha1sum $file >> $VERSION.sha1sums"
-	    ;;
-    esac
-done
-
-if [ -n "$PATCHRELEASE" ]; then
-    svn update ~/shorewall/tags/${BASEVERSION}
-    if [ -f ~/shorewall/tags/${BASEVERSION}/known_problems.txt ]; then
-	cp ~/shorewall/tags/${BASEVERSION}/known_problems.txt .
-    else 
-	[ -f known_problems.txt ] || echo "There are no known problems in Shorewall version $VERSION" > known_problems.txt
-    fi
-else
-    echo "There are no known problems in Shorewall version $VERSION" > known_problems.txt
-fi
-
-if [ -n "$OLDVERSION" ]; then
-    
-    progress_message "Creating patch-$VERSION ..."
-
-    [ -d shorewall-common-$VERSION ] && diff -Naur -X $(dirname $0)/exclude.txt shorewall-common-$OLDVERSION shorewall-common-$VERSION > patch-common-$VERSION || true
-    [ -d shorewall6-$VERSION ]       && diff -Naur -X $(dirname $0)/exclude.txt shorewall6-$OLDVERSION       shorewall6-$VERSION       > patch-6-$VERSION      || true
-    [ -d shorewall-lite-$VERSION ]   && diff -Naur -X $(dirname $0)/exclude.txt shorewall-lite-$OLDVERSION shorewall-lite-$VERSION     > patch-lite-$VERSION   || true
-    [ -d shorewall6-lite-$VERSION ]  && diff -Naur -X $(dirname $0)/exclude.txt shorewall6-lite-$OLDVERSION shorewall6-lite-$VERSION   > patch-6-lite-$VERSION || true
-    [ -d shorewall-perl-$VERSION ]   && diff -Naur -X $(dirname $0)/exclude.txt shorewall-perl-$OLDVERSION shorewall-perl-$VERSION     > patch-perl-$VERSION   || true
-    [ -d shorewall-shell-$VERSION ]  && diff -Naur -X $(dirname $0)/exclude.txt shorewall-shell-$OLDVERSION shorewall-shell-$VERSION   > patch-shell-$VERSION  || true
-    
-fi
-
-progress_message "Shorewall $VERSION Build complete - $(date)"
diff --git a/tools/build/exclude.txt b/tools/build/exclude.txt
deleted file mode 100644
index 3813cc22e..000000000
--- a/tools/build/exclude.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-*.5
-*.8
-*.gz
-diff*
diff --git a/tools/build/makeshorewall b/tools/build/makeshorewall
deleted file mode 100755
index a76d64916..000000000
--- a/tools/build/makeshorewall
+++ /dev/null
@@ -1,715 +0,0 @@
-#!/bin/sh
-#
-# Shorewall Release Processing -- (C) 2003,2004,2005 -- Tom Eastep (teastep@shorewall.net)
-#                              -- (C) 2005,2006 -- Cristian Rodriguez (webmaster@shorewall.net)
-# Version : $Id$
-#
-#     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
-#
-#	This program is free software; you can redistribute it and/or modify
-#	it under the terms of Version 2 of the GNU General Public License
-#	as published by the Free Software Foundation.
-#
-#	This program is distributed in the hope that it will be useful,
-#	but WITHOUT ANY WARRANTY; without even the implied warranty of
-#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-#	GNU General Public License for more details.
-#
-#	You should have received a copy of the GNU General Public License
-#	along with this program; if not, write to the Free Software
-#	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# I install this script in /usr/local/bin/makeshorewall.
-#
-# Usage:
-#
-#   makeshorewall [ -trhxl ] <version> [ <previous version> ]
-#
-#      -t      Build tarball
-#      -r      Build RPM
-#      -h      Build HTML documentation
-#      -x      Build XML documentation
-#      -s      Sign with GPG
-#      -p      Build shorewall-perl
-#
-# If no options are given, all options are assumed.
-#
-# If <previous version> is given, a patch file reflecting the differences
-# between that version and the current version ( <version> ) is
-# generated. The directory ./shorewall-<previous version> must exist and
-# contain the version against which the patch is generated.
-################################################################################
-#                          C O N F I G U R A T I O N
-################################################################################
-#
-# XSL Stylesheet to use for XML->HTML conversion
-#
-STYLESHEET=/usr/share/xml/docbook/stylesheet/nwalsh/current/xhtml/docbook.xsl
-#
-# Directory where the build log will be placed. The log has the name
-# shorewall_build_<version>.log
-#
-LOGDIR=$PWD
-#
-# Your RPM build directory
-#
-RPMDIR=~/rpm/
-#
-# Directory where you want the release to be built
-#
-DIR=$PWD
-#
-# location and options for GnuPG
-#
-GPG="/usr/bin/gpg -ab --batch --comment 'To verify this, you can download our public key at https://lists.shorewall.net/shorewall.gpg.key'"
-#
-# SVN Repository
-#
-SVN=https://shorewall.svn.sourceforge.net/svnroot/shorewall
-#
-# Program that generates man pages from Docbook XML
-#
-DOCBOOK2MAN="docbook-to-man -C /usr/share/docbook2X/xslt/catalog.xml --utf8trans-map /usr/share/docbook2X/charmaps/roff.charmap"
-################################################################################
-#                               V A R I A B L E S
-################################################################################
-VERSION=
-OLDVERSION=
-SHOREWALLDIR=
-SHOREWALLLITEDIR=
-SOURCEDIR=
-SVNBRANCH=
-LITESVNBRANCH=
-XMLPROJ=
-RPMNAME=
-LITERPMNAME=
-TARBALL=
-LITETARBALL=
-LOGFILE=
-HTMLDIR=
-BUILDTARBALL=
-BUILDRPM=
-BUILDXML=
-BUILDHTML=
-SAMPLESTAG=
-HASLITE=
-SIGN=
-MANPAGETAG=
-LITEMANPAGETAG=
-BUILDPERL=
-PERLDIR=
-PERLBRANCH=
-PERLRPMNAME=
-PERLTARBALL=
-################################################################################
-#                               F U N C T I O N S
-################################################################################
-progress_message()
-{
-    echo         >>    $LOGFILE
-    echo "$@" | tee -a $LOGFILE
-    echo         >>    $LOGFILE
-}
-
-report()
-{
-    echo "$@" | tee -a $LOGFILE
-}
-
-do_or_die()
-{
-    eval $@ || { progress_message "Step \"$*\" FAILED" ; exit 2; }
-}
-
-fatal_error() {
-    progress_message "$*"
-    exit 2
-}
-
-list_search() # $1 = element to search for , $2-$n = list
-{
-    local e
-    e=$1
-
-    while [ $# -gt 1 ]; do
-	shift
-	[ "x$e" = "x$1" ] && return 0
-    done
-
-    return 1
-}
-
-usage()
-{
-    echo "usage: $(basename $0) [ -trhxl] <version> [ <old-version> ]"
-    exit 2
-}
-################################################################################
-#                E X E C U T I O N   S T A R T S   H E R E
-################################################################################
-
-set -e
-set -u
-
-
-done=
-
-[ $# -eq 0 ] && usage
-
-case $1 in
-    -*)
-	;;
-    *)
-	BUILDTARBALL=Yes
-	BUILDRPM=Yes
-	BUILDHTML=Yes
-	BUILDXML=Yes
-	BUILDRPM=Yes
-	done=Yes
-	SIGN=Yes
-	;;
-esac
-
-while [ -z "$done" ]; do
-    [ $# -eq 0 ] && break
-
-    option=$1
-    case $option in
-	-*)
-	    option=${option#-}
-
-	    [ -z "$option" ] && break
-
-	    while [ -n "$option" ]; do
-		case $option in
-		    t*)
-			BUILDTARBALL=Yes
-			option=${option#t}
-			;;
-		    r*)
-			BUILDTARBALL=Yes
-			BUILDRPM=Yes
-			option=${option#r}
-			;;
-		    h*)
-			BUILDHTML=Yes
-			option=${option#h}
-			;;
-		    x*)
-			BUILDXML=Yes
-			option=${option#x}
-			;;
-		    s*)
-			SIGN=Yes
-			option=${option#s}
-			;;
-		    p*)
-			BUILDPERL=Yes
-			option=${option#p}
-			;;
-	    	    *)
-			usage
-			;;
-		esac
-	    done
-	    shift
-	    ;;
-	*)
-	    done=Yes
-	    ;;
-    esac
-done
-
-case $# in
-    1)
-	;;
-    2)
-	OLDVERSION=$2
-	;;
-    *)
-	usage
-	;;
-esac
-
-VERSION=$1
-LOGFILE=$LOGDIR/shorewall_build_${VERSION}.log
-touch $LOGFILE
-progress_message "Build of Shorewall $VERSION on $(date)"
-
-case $VERSION in
-    3.2.*)
-	SVNBRANCH="branches/3.2/Shorewall"
-	LITESVNBRANCH="branches/3.2/Shorewall-lite"
-	DOCTAG="branches/3.4/docs"
-	XMLPROJ="docs-3.2"
-	SAMPLESTAG="branches/3.2/Samples"
-	HASLITE=Yes
-	;;
-     3.4.*)
-	SVNBRANCH="branches/3.4/Shorewall"
-	LITESVNBRANCH="branches/3.4/Shorewall-lite"
-	DOCTAG="branches/3.4/docs"
-	XMLPROJ="docs-3.4"
-	SAMPLESTAG="branches/3.4/Samples"
-	HASLITE=Yes
-	MANPAGETAG=branches/3.4/manpages
-	LITEMANPAGETAG=branches/3.4/manpages-lite
-	;;
-   *)
-	echo "Unsupported Version: $VERSION"
-	exit 2
-	;;
-esac
-
-[ -d $DIR ] || { echo "Directory $DIR does not exist or is unaccessible" ; exit 2 ; }
-
-progress_message "Distribution directory is $DIR"
-
-cd $DIR
-
-case $VERSION in
-    *Beta*|*RC*)
-	#
-	# Beta or Release Candidate
-	#
-	SHOREWALLDIR=shorewall-${VERSION%-*}
-	SHOREWALLLITEDIR=shorewall-lite-${VERSION%-*}
-	TARBALL=shorewall-${VERSION%-*}.tgz
-	LITETARBALL=shorewall-lite-${VERSION%-*}.tgz
-	RPMNAME=shorewall-${VERSION%-*}-0${VERSION#*-}.noarch.rpm
-	LITERPMNAME=shorewall-lite-${VERSION%-*}-0${VERSION#*-}.noarch.rpm
-	PERLRPMNAME=shorewall-perl-${VERSION%-*}-0${VERSION#*-}.noarch.rpm
-	PERLTARBALL=shorewall-perl-${VERSION%-*}.tgz
-	PERLDIR=shorewall-perl-${VERSION%-*}
-	;;
-    *)
-	#
-	# Normal Release
-	#
-	SHOREWALLDIR=shorewall-$VERSION
-	SHOREWALLLITEDIR=shorewall-lite-$VERSION
-	TARBALL=shorewall-$VERSION.tgz
-	LITETARBALL=shorewall-lite-$VERSION.tgz
-	RPMNAME=shorewall-${VERSION}-1.noarch.rpm
-	LITERPMNAME=shorewall-lite-${VERSION}-1.noarch.rpm
-	PERLRPMNAME=shorewall-perl-${VERSION}-1.noarch.rpm
-	PERLDIR=shorewall-perl-$VERSION
-	PERLTARBALL=shorewall-perl-$VERSION.tgz
-	;;
-esac
-
-HTMLDIR=shorewall-docs-html-$VERSION
-
-if [ -n "${BUILDTARBALL}${BUILDRPM}" ]; then
-    report "Shorewall directory is $DIR/$SHOREWALLDIR"
-    report "Shorewall Lite directory is $DIR/$SHOREWALLLITEDIR"
-    report "SVN tag is $SVNBRANCH"
-    report "Lite SVN tag is $LITESVNBRANCH"
-    [ -n "$BUILDTARBALL" ] && report "TARBALL is $TARBALL" && report "LITETARBALL is $LITETARBALL"
-    [ -n "$BUILDRPM" ]     && report "RPM is $RPMNAME" && report "LITERPM is $LITERPMNAME"
-fi
-
-[ -n "$BUILDHTML" ] && report "HTML Directory is $HTMLDIR"
-
-if [ -n "$BUILDPERL" ]; then
-    report "shorewall-perl directory is $DIR/$PERLDIR"
-    report "Perl SVN tag is $PERLBRANCH"
-    report "Perl RPM is $PERLRPMNAME"
-
-    rm -rf $PERLDIR
-    	
-    progress_message "Exporting $PERLBRANCH from SVN..."
-    do_or_die "svn export --non-interactive --force ${SVN}/$PERLBRANCH  $PERLDIR >> $LOGFILE 2>&1"
-
-    progress_message "Creating $DIR/$PERLTARBALL..."
-    do_or_die "tar -zcvf $PERLTARBALL $PERLDIR >> $LOGFILE 2>&1"
-    do_or_die "tar -jcvf shorewall-perl-${VERSION%-*}.tar.bz2 $PERLDIR >> $LOGFILE 2>&1"
-
-    if [ -n "$SIGN" ]; then
-	for shoresuffix in tgz tar.bz2; do
-	    shoreball=shorewall-perl-${VERSION%-*}.${shoresuffix}
-	    report "GPG signing $DIR/$shoreball"
-	    rm -f ${shoreball}.asc
-	    do_or_die "$GPG $shoreball"
-	done
-    fi
-
-    progress_message "Building $PERLRPMNAME..."
-
-    test -n "$SIGN" && SIGN="--sign"
-    rm -rf $RPMDIR/BUILD/shorewall-perl-${VERSION%-*}*
-    do_or_die "cp shorewall-perl-${VERSION%-*}.tgz $RPMDIR/SOURCES/"
-    do_or_die "cp $PERLDIR/shorewall-perl.spec $RPMDIR/SPECS/"
-    do_or_die "rpmbuild -ba $SIGN $RPMDIR/SPECS/shorewall-perl.spec >> $LOGFILE 2>&1"
-    do_or_die cp -a $RPMDIR/RPMS/noarch/$PERLRPMNAME  .
-
-    > $VERSION.md5sums
-    > $VERSION.sha1sums
-
-    for file in *; do
-	case $file in
-	    *-perl-$VERSION[-.]*tgz|*-perl-$VERSION[-.]*rpm|*perl-$VERSION[-.]*bz2)
-	    do_or_die "md5sum $file >> $VERSION.md5sums"
-	    do_or_die "sha1sum $file >> $VERSION.sha1sums"
-	    ;;
-    esac
-done
-fi
-
-if [ -n "${BUILDTARBALL}${BUILDRPM}" ]; then
-    progress_message "Exporting $SVNBRANCH from SVN..."
-
-    rm -rf $SHOREWALLDIR
-    rm -rf $SHOREWALLLITEDIR
-
-    do_or_die "svn export --non-interactive --force ${SVN}/$SVNBRANCH  $SHOREWALLDIR >> $LOGFILE 2>&1"
- 
-    if [ -n "$HASLITE" ]; then
-	progress_message "Exporting $LITESVNBRANCH from SVN..."
-	do_or_die "svn export --non-interactive --force ${SVN}/$LITESVNBRANCH  $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-	do_or_die "cp $SHOREWALLDIR/modules $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-	if [ -f $SHOREWALLDIR/lib.base ]; then
-	    do_or_die "cp $SHOREWALLDIR/lib.base $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-	    if [ -f $SHOREWALLDIR/lib.cli ]; then
-		do_or_die "cp $SHOREWALLDIR/lib.cli $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-	    fi
-	    if [ -f $SHOREWALLDIR/wait4ifup ]; then
-		do_or_die "cp $SHOREWALLDIR/wait4ifup $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-	    fi
-	else
-	    do_or_die "cp $SHOREWALLDIR/functions $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-	fi
-	do_or_die "cp $SHOREWALLDIR/changelog.txt  $SHOREWALLDIR/releasenotes.txt $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-    fi
-
-    fgrep VERSION=$VERSION $SHOREWALLDIR/install.sh > /dev/null 2>&1     || fatal_error "install.sh has wrong version"
-    fgrep VERSION=$VERSION $SHOREWALLDIR/uninstall.sh > /dev/null 2>&1   || fatal_error "uninstall.sh has wrong version"
-    fgrep VERSION=$VERSION $SHOREWALLDIR/fallback.sh > /dev/null 2>&1    || fatal_error "fallback.sh has wrong version"
-    if [ -n "$HASLITE" ]; then
-	fgrep VERSION=$VERSION $SHOREWALLLITEDIR/install.sh > /dev/null 2>&1     || fatal_error "Lite install.sh has wrong version"
-	fgrep VERSION=$VERSION $SHOREWALLLITEDIR/uninstall.sh > /dev/null 2>&1   || fatal_error "Lite uninstall.sh has wrong version"
-	fgrep VERSION=$VERSION $SHOREWALLLITEDIR/fallback.sh > /dev/null 2>&1    || fatal_error "Lite fallback.sh has wrong version"
-    fi
-
-    if [ -n "$SAMPLESTAG" ]; then
-	cd $SHOREWALLDIR
-	do_or_die "svn export --non-interactive --force ${SVN}/$SAMPLESTAG Samples >> $LOGFILE 2>&1"
-	cd $DIR
-    fi
-
-    if [ -n "$MANPAGETAG" ]; then
-	cd $SHOREWALLDIR
-	progress_message "Exporting $MANPAGETAG from SVN..."
-	do_or_die "svn export --non-interactive --force ${SVN}/$MANPAGETAG manpages >> $LOGFILE 2>&1"
-	cd manpages
-	for f in *.xml; do
-	    if [ $f != shorewall-template.xml ]; then
-		progress_message "Generating Man Page from $f..."
-		$DOCBOOK2MAN $f
-	    fi
-	done
-	rm *.xml
-	perl -p -i'' -e 's/ \[.*?html\]//g' *.5 *.8
-	cd $DIR
-
-	cd $SHOREWALLLITEDIR
-
-	progress_message "Exporting $LITEMANPAGETAG from SVN..."
-	do_or_die "svn export --non-interactive --force ${SVN}/$LITEMANPAGETAG manpages >> $LOGFILE 2>&1"
-	cd manpages
-	for f in *.xml; do
-	    if [ $f != shorewall-template.xml ]; then
-		progress_message "Generating Man Page from $f..."
-		$DOCBOOK2MAN $f
-	    fi
-	done
-	rm *.xml
-	perl -p -i'' -e 's/ \[.*?html\]//g' *.5 *.8
-	cd $DIR 
-    fi	
-
-    do_or_die "rm -rf $SHOREWALLDIR/debian"
-
-    if [ -n "$BUILDTARBALL" ]; then
-	
-	progress_message "Creating $DIR/$TARBALL..."
-	
-	do_or_die "tar -zcvf $TARBALL $SHOREWALLDIR >> $LOGFILE 2>&1"
-        do_or_die "tar -jcvf shorewall-${VERSION%-*}.tar.bz2 $SHOREWALLDIR >> $LOGFILE 2>&1"
-	if [ -n "$SIGN" ]; then
-	    for shoresuffix in tgz tar.bz2; do
-		shoreball=shorewall-${VERSION%-*}.${shoresuffix}
-		report "GPG signing $DIR/$shoreball"
-		rm -f ${shoreball}.asc
-		do_or_die "$GPG $shoreball"
-	    done
-	fi
-	if [ -n "$HASLITE" ]; then
-	    progress_message "Creating $DIR/$LITETARBALL..."
-	    do_or_die "tar -zcvf $LITETARBALL $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-	    do_or_die "tar -jcvf shorewall-lite-${VERSION%-*}.tar.bz2 $SHOREWALLLITEDIR >> $LOGFILE 2>&1"
-	    if [ -n "$SIGN" ]; then
-		for shoresuffix in tgz tar.bz2; do
-		    shoreball=shorewall-lite-${VERSION%-*}.${shoresuffix}
-		    report "GPG signing $DIR/$shoreball"
-		    rm -f ${shoreball}.asc
-		    do_or_die "$GPG $shoreball"
-		done
-	    fi
-	fi
-    fi
-
-    if [ -n "$BUILDRPM" ]; then
-	progress_message "Building $RPMNAME..."
-
-	test -n "$SIGN" && SIGN="--sign"
-	rm -rf $RPMDIR/BUILD/shorewall-${VERSION%-*}
-	do_or_die "cp shorewall-${VERSION%-*}.tgz $RPMDIR/SOURCES/"
-	do_or_die "cp $SHOREWALLDIR/shorewall.spec $RPMDIR/SPECS/"
-	do_or_die "rpmbuild -ba $SIGN $RPMDIR/SPECS/shorewall.spec >> $LOGFILE 2>&1"
-	do_or_die cp -a $RPMDIR/RPMS/noarch/$RPMNAME .
-
-	if [ -n "$HASLITE" ]; then
-	    progress_message "Building $LITERPMNAME..."
-
-	    rm -rf $RPMDIR/BUILD/shorewall-${VERSION%-*}
-	    do_or_die "cp shorewall-lite-${VERSION%-*}.tgz $RPMDIR/SOURCES/"
-	    do_or_die "cp $SHOREWALLLITEDIR/shorewall-lite.spec $RPMDIR/SPECS/"
-	    do_or_die "rpmbuild -ba $SIGN $RPMDIR/SPECS/shorewall-lite.spec >> $LOGFILE 2>&1"
-	    do_or_die cp -a $RPMDIR/RPMS/noarch/$LITERPMNAME .
-	fi
-    fi
-fi
-
-if [ -n "${BUILDXML}${BUILDHTML}" ]; then
-    progress_message "Exporting $XMLPROJ from SVN..."
-
-    rm -rf $XMLPROJ
-    rm -rf shorewall-docs-xml-$VERSION
-
-    do_or_die "svn export --non-interactive --force ${SVN}/$DOCTAG $XMLPROJ >> $LOGFILE 2>&1"
-    do_or_die mv $XMLPROJ shorewall-docs-xml-$VERSION
-
-    rm -f shorewall-docs-xml-$VERSION/images/*.vsd
-    rm -f shorewall-docs-xml-$VERSION/images/~*
-    rm -f shorewall-docs-xml-$VERSION/images/*.JPG
-    rm -f shorewall-docs-xml-$VERSION/images/publish
-    rm -f shorewall-docs-xml-$VERSION/images/Thumbs.db
-
-    if [ -n "$BUILDXML" ]; then
-	progress_message "Creating $DIR/shorewall-docs-xml-$VERSION tarballs"
-        do_or_die "tar -zcvf shorewall-docs-xml-$VERSION.tgz shorewall-docs-xml-$VERSION >> $LOGFILE 2>&1"
-        do_or_die "tar -jcvf shorewall-docs-xml-$VERSION.tar.bz2 shorewall-docs-xml-$VERSION >> $LOGFILE 2>&1"
-	if [ -n "$SIGN" ]; then
-	    for shoresuffix in tgz tar.bz2; do
-		xmlball=shorewall-docs-xml-$VERSION.${shoresuffix}
-		report "GPG signing $DIR/$xmlball tarball"
-		rm -f ${xmlball}.asc
-		do_or_die "$GPG $xmlball"
-	    done
-	fi
-    fi
-
-    if [ -n "$BUILDHTML" ]; then
-	progress_message "Building $HTMLDIR ..."
-
-	rm -rf $HTMLDIR
-
-	do_or_die mkdir $HTMLDIR
-	do_or_die mkdir $HTMLDIR/images
-	#
-	# The original HTML documents were created using MS FrontPage and used
-	# the .htm suffix. The remainder use the .html suffix.
-	#
-	HTMFILES="
-	    6to4.htm
-	    blacklisting_support.htm
-	    configuration_file_basics.htm
-	    CorpNetwork.htm
-	    dhcp.htm
-	    Documentation.htm
-	    errata.htm
-	    fallback.htm
-	    FAQ.htm
-	    GnuCopyright.htm
-	    Install.htm
-	    IPIP.htm
-	    IPSEC.htm
-	    kernel.htm
-	    myfiles.htm
-	    NAT.htm
-	    ports.htm
-	    PPTP.htm
-	    ProxyARP.htm
-	    quotes.htm
-	    samba.htm
-	    shorewall_extension_scripts.htm
-	    shorewall_features.htm
-	    shorewall_mirrors.htm
-	    shorewall_prerequisites.htm
-	    shorewall_quickstart_guide.htm
-	    shorewall_setup_guide_fr.htm
-	    shorewall_setup_guide.htm
-	    Shorewall_sfindex_frame.htm
-	    standalone.htm
-	    starting_and_stopping_shorewall.htm
-	    support.htm
-	    three-interface.htm
-	    traffic_shaping.htm
-	    troubleshoot.htm
-	    two-interface.htm
-	    upgrade_issues.htm
-	    VPN.htm
-	    whitelisting_under_shorewall.htm"
-
-	NOTOC="
-            Documentation_Index.xml
-            ECN.xml
-            fallback.xml
-            GettingStarted.xml
-            IPP2P.xml
-            ping.xml
-            ProxyARP.xml
-            Shorewall_Doesnt.xml
-            shorewall_features.xml
-            shorewall_prerequisites.xml
-            SimpleBridge.xml"
-
-	for file in shorewall-docs-xml-$VERSION/*.xml; do
-	    a=$(basename $file)
-	    b=${a%.*}
-	    list_search $b.htm $HTMFILES && b=$b.htm || b=$b.html
-	    f="shorewall-docs-html-$VERSION/$b"
-	    list_search $1 $NOTOC && GENTOC="--stringparam generate.toc ''" || GENTOC=
-
-	    case $file in
-		*_ru.xml)
-		    LANGUAGE="--stringparam l10n.gentext.default.language ru"
-		    ;;
-		*_fr.xml)
-		    LANGUAGE="--stringparam l10n.gentext.default.language fr"
-		    ;;
-		*)
-		    LANGUAGE=
-		    ;;
-	    esac
-
-	    report "Converting $DIR/$file from XML to HTML ($DIR/$f) ..."
-
-	    do_or_die xsltproc --output $f --stringparam html.stylesheet html.css --stringparam ulink.target _self $GENTOC -param toc.section.depth 3 $STYLESHEET $file
-	done
-
-	progress_message "Copying images to $DIR/$HTMLDIR/images ..."
-
-	do_or_die cp -a shorewall-docs-xml-$VERSION/images/*.png $HTMLDIR/images
-	do_or_die cp -a shorewall-docs-xml-$VERSION/images/*.gif $HTMLDIR/images
-	do_or_die cp -a shorewall-docs-xml-$VERSION/images/*.jpg $HTMLDIR/images
-	do_or_die cp -a shorewall-docs-xml-$VERSION/*.css $HTMLDIR
-
-	do_or_die ln -s Documentation_Index.html shorewall-docs-html-$VERSION/index.html
-
-	progress_message "Creating $DIR/shorewall-docs-html-$VERSION tarballs ..."
-
-	do_or_die "tar -zcvf shorewall-docs-html-$VERSION.tgz shorewall-docs-html-$VERSION >> $LOGFILE 2>&1"
-	do_or_die "tar -jcvf shorewall-docs-html-$VERSION.tar.bz2 shorewall-docs-html-$VERSION >> $LOGFILE 2>&1"
-	if [ -n "$SIGN" ]; then
-	    for shoresuffix in tgz tar.bz2; do
-		htmlball=shorewall-docs-html-$VERSION.${shoresuffix}
-		report "GPG signing $DIR/$htmlball tarball"
-		rm -f ${htmlball}.asc
-		do_or_die "$GPG $htmlball"
-	    done
-	fi
-    fi
-fi
-
-[ -n "$BUILDTARBALL" ] && case $VERSION in
-    *Beta*|*RC*)
-	#
-	# The original tarball created above didn't include the -Beta or -RC portion of the
-	# name in either the tarball name or the directory name. Create it here
-	#
-	progress_message "Creating $DIR/shorewall-$VERSION..."
-
-	rm -rf shorewall-$VERSION
-
-	do_or_die mv $SHOREWALLDIR shorewall-$VERSION
-
-	progress_message "Creating $DIR/shorewall-${VERSION}.tgz ..."
-
-        do_or_die "tar -zcvf shorewall-${VERSION}.tgz shorewall-$VERSION >> $LOGFILE 2>&1"
-        do_or_die "tar -jcvf shorewall-$VERSION.tar.bz2 shorewall-$VERSION >> $LOGFILE 2>&1"
-
-	if [ -n "$SIGN" ]; then
-	    for shoresuffix in tgz tar.bz2; do
-		betaball=shorewall-$VERSION.${shoresuffix}
-		report "GPG signing $DIR/$betaball tarball"
-		rm -f ${betaball}.asc
-		do_or_die "$GPG $betaball"
-	    done
-	fi
-
-
-	if [ -n "$HASLITE" ]; then
-	    progress_message "Creating $DIR/shorewall-lite-$VERSION..."
-
-	    rm -rf shorewall-lite-$VERSION
-
-	    do_or_die mv $SHOREWALLLITEDIR shorewall-lite-$VERSION
-
-
-	    progress_message "Creating $DIR/shorewall-lite-${VERSION}.tgz ..."
-
-	    do_or_die "tar -zcvf shorewall-lite-${VERSION}.tgz shorewall-lite-$VERSION >> $LOGFILE 2>&1"
-	    do_or_die "tar -jcvf shorewall-lite-$VERSION.tar.bz2 shorewall-lite-$VERSION >> $LOGFILE 2>&1"
-
-	    if [ -n "$SIGN" ]; then
-		for shoresuffix in tgz tar.bz2; do
-		    betaball=shorewall-lite-$VERSION.${shoresuffix}
-		    report "GPG signing $DIR/$betaball tarball"
-		    rm -f ${betaball}.asc
-		    do_or_die "$GPG $betaball"
-		done
-	    fi
-	fi
-	;;
-esac
-
-progress_message "Creating md5sums and sha1sums"
-
-rm -f $VERSION.md5sums $VERSION.sha1sums
-
-#
-# The following rather awkward algorithm gets around the problem of builds that don't
-# include the RPM
-#
-case $VERSION in
-    *Beta*|*RC*)
-	do_or_die "md5sum shorewall-${VERSION%-*}-0${VERSION#*-}.noarch.rpm >> $VERSION.md5sums"
-	do_or_die "sha1sum shorewall-${VERSION%-*}-0${VERSION#*-}.noarch.rpm >> $VERSION.sha1sums"
-	if [ -n "$HASLITE" ]; then
-	    do_or_die "md5sum shorewall-lite-${VERSION%-*}-0${VERSION#*-}.noarch.rpm >> $VERSION.md5sums"
-	    do_or_die "sha1sum shorewall-lite-${VERSION%-*}-0${VERSION#*-}.noarch.rpm >> $VERSION.sha1sums"
-	fi
-	;;
-esac
-
-for file in *; do
-    case $file in
-	*$VERSION[-.]*tgz|*$VERSION[-.]*rpm|*$VERSION[-.]*bz2)
-	    do_or_die "md5sum $file >> $VERSION.md5sums"
-	    do_or_die "sha1sum $file >> $VERSION.sha1sums"
-	    ;;
-    esac
-done
-
-if [ -n "$OLDVERSION" ]; then
-    progress_message "Creating patch-$VERSION ..."
-
-    diff -Naur -X $(dirname $0)/exclude.txt shorewall-$OLDVERSION shorewall-$VERSION > patch-$VERSION || true
-    if [ -n "$HASLITE" ]; then
-	diff -Naur -X $(dirname $0)/exclude.txt shorewall-lite-$OLDVERSION shorewall-lite-$VERSION >> patch-$VERSION || true
-    fi
-fi
-
-progress_message "Shorewall $VERSION Build complete - $(date)"
diff --git a/tools/build/makeshorewall-debian b/tools/build/makeshorewall-debian
deleted file mode 100755
index c6d9e92e3..000000000
--- a/tools/build/makeshorewall-debian
+++ /dev/null
@@ -1,46 +0,0 @@
-#!/bin/sh
-
-# Basic script to build a Debian package - should be executed from the
-# main Shorewall source directory (containing the debian/ subdirectory).
-
-set -e
-set -u
-set -x
-
-PROGNAME=`basename $0`
-MODULE=Shorewall
-PACKAGE=shorewall
-DATE=`date +%Y%m%d`
-VERSION="2.5-cvs$DATE.1"
-# This uses developer CVS - until SF.net fix the 5-hour delay between
-# developer and anonymous CVS, this is the preferred mechanism.
-ROOT=":ext:cvs.sourceforge.net:/cvsroot/shorewall"
-#ROOT=":pserver:anonymous@cvs.sourceforge.net:/cvsroot/shorewall"
-TAG=HEAD
-DIR="/tmp/$PACKAGE-$VERSION"
-# Adjust this to the location of a local repository.
-REPOSITORY=/share/src/shorewall/apt
-
-# Email address for Debian changelog entry - the email address is also
-# used by dpkg-buildpackage to look up the GPG key.
-export DEBEMAIL='Shorewall Autobuilder <autobuild@gear.dyndns.org>'
-
-# clean up first
-rm -rf $DIR
-mkdir -p $DIR
-cd $DIR
-
-# Export the source
-cvs -d "$ROOT" -q export -r HEAD $MODULE
-cd $MODULE
-
-# Create a dummy changelog entry
-debchange --newversion $VERSION "Autobuild by $PROGNAME"
-
-# Build the package
-dpkg-buildpackage -rfakeroot
-
-# move to repository
-cd ..
-mkdir -p $REPOSITORY/incoming
-mv *.dsc *.tar.gz *.changes *.deb $REPOSITORY/incoming/
diff --git a/tools/build/setversion b/tools/build/setversion
deleted file mode 100755
index f41c53031..000000000
--- a/tools/build/setversion
+++ /dev/null
@@ -1,75 +0,0 @@
-#!/bin/sh
-#
-#  Update the version in a set of Shorewall product directories
-#
-#  (C) 2007 -- Tom Eastep (teastep@shorewall.net)
-#
-#
-#     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
-#
-#	This program is free software; you can redistribute it and/or modify
-#	it under the terms of Version 2 of the GNU General Public License
-#	as published by the Free Software Foundation.
-#
-#	This program is distributed in the hope that it will be useful,
-#	but WITHOUT ANY WARRANTY; without even the implied warranty of
-#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-#	GNU General Public License for more details.
-#
-#	You should have received a copy of the GNU General Public License
-#	along with this program; if not, write to the Free Software
-#	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Usage:
-#
-#       setversion <version>
-#
-[ $# -eq 1 ] || { echo "usage: setversion <version>" >&2; exit 1; }
-
-VERSION=$1
-SUFFIX=
-
-case $VERSION in
-    *.*.*.*)
-	RPMVERSION=${VERSION%.*}
-	RELEASE=${VERSION##*.}
-	SUFFIX="-$RELEASE"
-	;;
-    *-*)
-	RPMVERSION=${VERSION%-*}
-	RELEASE=0${VERSION##*-}
-	;;
-    *)
-	RPMVERSION=${VERSION}
-	RELEASE=0base
-	;;
-esac
-
-for product in "" -common 6 -lite 6-lite -shell -perl; do
-    dir=Shorewall${product}${SUFFIX}
-
-    for file in $dir/install.sh $dir/uninstall.sh $dir/fallback.sh; do
-	[ -f $file ] && eval perl -p -i -e "'s/^VERSION=.*/VERSION=${VERSION}/'" $file
-    done
-
-    file=$dir/shorewall${product}.spec
-    [ -f $file ] && eval perl -n -i -e "'s/^%define version .*/%define version ${RPMVERSION}/; \
-                                         s/^%define release .*/%define release ${RELEASE}/; \
-                                         print \$_; \
-                                         if ( /%changelog/ ) {\
-                                             print \"\* $(date +'%a %b %d %Y') Tom Eastep tom\\@shorewall.net\\n\"; \
-                                             print \"- Updated to ${RPMVERSION}-${RELEASE}\\n\"; \
-                                         }'" $file
-done
-
-file=Shorewall-perl${SUFFIX}/Shorewall/Config.pm
-[ -f $file ] && eval perl -p -i -e "'s/^(\s+)VERSION => .*/\$1VERSION => \"${VERSION}\",/'" $file
-
-file=Shorewall${SUFFIX}/Shorewall/Config.pm
-[ -f $file ] && eval perl -p -i -e "'s/^(\s+)VERSION => .*/\$1VERSION => \"${VERSION}\",/'" $file
-
-file=Shorewall${SUFFIX}/Perl/Shorewall/Config.pm
-[ -f $file ] && eval perl -p -i -e "'s/^(\s+)VERSION => .*/\$1VERSION => \"${VERSION}\",/'" $file
-
-[ -d Shorewall${SUFFIX} ] && echo "There are no known problems in Shorewall version ${VERSION}" > Shorewall${SUFFIX}/known_problems.txt
-
diff --git a/tools/build/stage b/tools/build/stage
deleted file mode 100755
index bf3d72ea3..000000000
--- a/tools/build/stage
+++ /dev/null
@@ -1,266 +0,0 @@
-#!/bin/sh
-#
-#  Stage a release on the master server
-#
-#  (C) 2007 -- Tom Eastep (teastep@shorewall.net)
-#
-#
-#     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
-#
-#	This program is free software; you can redistribute it and/or modify
-#	it under the terms of Version 2 of the GNU General Public License
-#	as published by the Free Software Foundation.
-#
-#	This program is distributed in the hope that it will be useful,
-#	but WITHOUT ANY WARRANTY; without even the implied warranty of
-#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-#	GNU General Public License for more details.
-#
-#	You should have received a copy of the GNU General Public License
-#	along with this program; if not, write to the Free Software
-#	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Usage:
-#
-#       stage [-pclL6sxh] <version>
-#
-
-usage() {
-    echo "Usage: stage [-pclL6sxh] <version>"
-}
-
-rpm=
-rpm6=
-literpm=
-lite6rpm=
-perlrpm=
-shellrpm=
-
-DEST=
-USER="webadmin@mail.shorewall.net"
-SHOREWALL=shorewall
-COMMAND=scp
-
-UPLOADCOMMON=
-UPLOADPERL=
-UPLOADSHELL=
-UPLOADLITE=
-UPLOADXML=
-UPLOADHTML=
-UPLOAD6=
-UPLOAD6LITE=
-PARTIAL=Yes
-BASE=
-
-done=
-
-case $1 in
-    -*)
-	;;
-    *)
-	UPLOADCOMMON=Yes
-	UPLOADPERL=Yes
-	UPLOADSHELL=Yes
-	UPLOADLITE=Yes
-	UPLOADXML=Yes
-	UPLOADHTML=Yes
-
-	case $1 in
-	    4.0.*)
-		;;
-	    *)
-		UPLOAD6=Yes
-		UPLOAD6LITE=Yes
-		;;
-	esac
-
-	PARTIAL=
-	done=Yes
-	;;
-esac
-
-while [ -z "$done" ]; do
-    [ $# -eq 0 ] && break
-
-    option=$1
-    case $option in
-	-*)
-	    option=${option#-}
-
-	    [ -z "$option" ] && break
-
-	    while [ -n "$option" ]; do
-		case $option in
-		    p*)
-			UPLOADPERL=Yes
-			option=${option#p}
-			;;
-		    c*)
-			UPLOADCOMMON=Yes
-			option=${option#c}
-			;;
-		    s*)
-			UPLOADSHELL=Yes
-			option=${option#s}
-			;;
-		    l*)
-			UPLOADLITE=Yes
-			option=${option#l}
-			;;
-		    x*)
-			UPLOADXML=Yes
-			option=${option#x}
-			;;
-		    h*)
-			UPLOADHTML=Yes
-			option=${option#h}
-			;;
-		    6*)
-			UPLOAD6=Yes
-			option=${option#6}
-			;;
-		    L*)
-			UPLOAD6LITE=Yes
-			option=${option#L}
-			;;
-	    	    *)
-			usage
-			;;
-		esac
-	    done
-	    shift
-	    ;;
-	*)
-	    done=Yes
-            ;;
-    esac
- done
-
-
-case $1 in
-    4.*Beta*|4.*RC*)
-	DEST="/srv/ftp/pub/shorewall/development/staging/${1%.*}/shorewall-$1"
-	SHOREWALL=shorewall-common
-	rpm=shorewall-common-${1%-*}-0${1#*-}.noarch.rpm
-	rpm6=shorewall6-${1%-*}-0${1#*-}.noarch.rpm
-	literpm=shorewall-lite-${1%-*}-0${1#*-}.noarch.rpm
-	lite6rpm=shorewall6-lite-${1%-*}-0${1#*-}.noarch.rpm
-	perlrpm=shorewall-perl-${1%-*}-0${1#*-}.noarch.rpm
-	shellrpm=shorewall-shell-${1%-*}-0${1#*-}.noarch.rpm
-	BASE=Yes
-	;;
-    *.*.*.*)
-	BASEVERSION=${1%.*}
-	PATCHNUM=${1##*.}
-	DEST="/srv/ftp/pub/shorewall/development/staging/${BASEVERSION%.*}/shorewall-${BASEVERSION}"
-	SHOREWALL=shorewall-common
-	rpm=shorewall-common-${BASEVERSION}-${PATCHNUM}.noarch.rpm
-	literpm=shorewall-lite-${BASEVERSION}-${PATCHNUM}.noarch.rpm
-	perlrpm=shorewall-perl-${BASEVERSION}-${PATCHNUM}.noarch.rpm
-	shellrpm=shorewall-shell-${BASEVERSION}-${PATCHNUM}.noarch.rpm
-	;;
-    4.0.*)
-	DEST="/srv/ftp/pub/shorewall/development/staging/${1%.*}/shorewall-$1"
-	SHOREWALL=shorewall-common
-	rpm=shorewall-common-${1}-0base.noarch.rpm
-	literpm=shorewall-lite-${1}-0base.noarch.rpm
-	perlrpm=shorewall-perl-${1}-0base.noarch.rpm
-	shellrpm=shorewall-shell-${1}-0base.noarch.rpm
-	BASE=Yes
-	;;
-    4.[12].*)
-	DEST="/srv/ftp/pub/shorewall/development/staging/${1%.*}/shorewall-$1"
-	SHOREWALL=shorewall-common
-	rpm=shorewall-common-${1}-0base.noarch.rpm
-	rpm6=shorewall6-${BASEVERSION}-${PATCHNUM}.noarch.rpm
-	literpm=shorewall-lite-${1}-0base.noarch.rpm
-	lite6rpm=shorewall6-lite-${1}-0base.noarch.rpm
-	perlrpm=shorewall-perl-${1}-0base.noarch.rpm
-	shellrpm=shorewall-shell-${1}-0base.noarch.rpm
-	BASE=Yes
-	;;
-    4.3.*)
-	DEST="/srv/ftp/pub/shorewall/development/staging/${1%.*}/shorewall-$1"
-	SHOREWALL=shorewall-common
-	rpm=shorewall-common-${1}-0base.noarch.rpm
-	literpm=shorewall-lite-${1}-0base.noarch.rpm
-	perlrpm=shorewall-perl-${1}-0base.noarch.rpm
-	shellrpm=shorewall-shell-${1}-0base.noarch.rpm
-	rpm6=shorewall6-${1}-0base.noarch.rpm
-	lite6rpm=shorewall6-lite-${1}-0base.noarch.rpm
-	BASE=Yes
-	;;
-    3.*[13579].*)
-	DEST="/srv/ftp/pub/shorewall/development/staging/${1%.*}/shorewall-$1"
-	rpm=shorewall-${1}-1.noarch.rpm
-	literpm=shorewall-lite-${1}-1.noarch.rpm
-	;;
-    *.*[13579].*)
-	DEST="/srv/ftp/pub/shorewall/development/staging/${1%.*}/shorewall-$1"
-	rpm=shorewall-${1}-1.noarch.rpm
-	;;
-    3.*Beta*|*RC*)
-	DEST="/srv/ftp/pub/shorewall/development/staging/${1%.*}/shorewall-$1"
-	rpm=shorewall-${1%-*}-0${1#*-}.noarch.rpm
-	literpm=shorewall-lite-${1%-*}-0${1#*-}.noarch.rpm
-	;;
-    *.*Beta*|*RC*)
-	DEST="/srv/ftp/pub/shorewall/development/staging/${1%.*}/shorewall-$1"
-	rpm=shorewall-${1%-*}-0${1#*-}.noarch.rpm
-	literpm=shorewall-lite-${1%-*}-0${1#*-}.noarch.rpm
-	perlrpm=shorewall-perl-${1%-*}-0${1#*-}.noarch.rpm
-	shellrpm=shorewall-shell-${1%-*}-0${1#*-}.noarch.rpm
-	;;
-    3.[2468].*)
-	DEST="/srv/ftp/pub/shorewall/development/staging/${1%.*}/shorewall-$1"
-	rpm=shorewall-${1}-1.noarch.rpm
-	literpm=shorewall-lite-${1}-1.noarch.rpm
-	;;
-    *.[2468].*)
-	DEST="/srv/ftp/pub/shorewall/development/staging/${1%.*}/shorewall-$1"
-	rpm=shorewall-${1}-1.noarch.rpm
-	literpm=shorewall-lite-${1}-1.noarch.rpm
-	perlrpm=shorewall-perl-${1}-1.noarch.rpm
-	shellrpm=shorewall-shell-${1}-1.noarch.rpm
-	;;
-    *)
-	DEST="/srv/ftp/pub/shorewall/development/staging/${1%.*}/shorewall-$1"
-	rpm=shorewall-${1}-1.noarch.rpm
-	;;
-esac
-
-[ $# -eq 1 ] || { echo "Usage: $(basename $0) <version>"; exit 2; }
-
-[ -d errata ] || mkdir errata
-
-[ -f known_problems.txt ] || echo "There are no known problems in Shorewall version $1" > known_problems.txt
-
-[ -n "$PARTIAL" -a -z "$UPLOADCOMMON" ]  && SHOREWALLDIR=shorewall-common || SHOREWALLDIR=$SHOREWALL-${1}
-
-cp $SHOREWALLDIR/releasenotes.txt releasenotes.txt
-
-if [ "$HOSTNAME" = lists ]; then
-	mkdir -p $DEST
-	[ -n "$BASE" ] && mkdir $DEST/base
-	COMMAND=cp
-else
-	ssh $USER mkdir -p $DEST
-	[ -n "$BASE" ] && ssh $USER mkdir -p $DEST/base
-	DEST=${USER}:${DEST}
-fi
-
-files="errata known_problems.txt releasenotes.txt patch-*-$1 ${1}.*"
-base=
-
-[ -n "$UPLOAD6" ]      && base="shorewall6-${1}.tar.*"                && files="$files shorewall6-${1}.*          $rpm6"
-[ -n "$UPLOADPERL" ]   && base="shorewall-perl-${1}.tar.*"            && files="$files shorewall-perl-${1}.*      $perlrpm"
-[ -n "$UPLOADCOMMON" ] && base="$base shorewall-common-${1}.tar.*"    && files="$files shorewall-common-${1}.*    $rpm"
-[ -n "$UPLOADSHELL" ]  && base="$base shorewall-shell-${1}.tar.*"     && files="$files shorewall-shell-${1}.*     $shellrpm"
-[ -n "$UPLOADLITE" ]   && base="$base shorewall-lite-${1}.tar.*"      && files="$files shorewall-lite-${1}.*      $literpm"
-[ -n "$UPLOAD6LITE" ]  && base="$base shorewall6-lite-${1}.tar.*"     && files="$files shorewall6-lite-${1}.*     $lite6rpm"
-[ -n "$UPLOADXML" ]    && base="$base shorewall-docs-xml-${1}.tar.*"  && files="$files shorewall-docs-xml-${1}.*  $literpm"
-[ -n "$UPLOADHTML" ]   && base="$base shorewall-docs-html-${1}.tar.*" && files="$files shorewall-docs-html-${1}.* $literpm"
-
-[ -n "$BASE" ] && $COMMAND $base $DEST/base
-
-$COMMAND -r $files $DEST
diff --git a/tools/build/stage44 b/tools/build/stage44
deleted file mode 100755
index 453eb946c..000000000
--- a/tools/build/stage44
+++ /dev/null
@@ -1,194 +0,0 @@
-#!/bin/sh
-#
-#  Stage a release to the master server
-#
-#  (C) 2007 -- Tom Eastep (teastep@shorewall.net)
-#
-#
-#     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
-#
-#	This program is free software; you can redistribute it and/or modify
-#	it under the terms of Version 2 of the GNU General Public License
-#	as published by the Free Software Foundation.
-#
-#	This program is distributed in the hope that it will be useful,
-#	but WITHOUT ANY WARRANTY; without even the implied warranty of
-#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-#	GNU General Public License for more details.
-#
-#	You should have received a copy of the GNU General Public License
-#	along with this program; if not, write to the Free Software
-#	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Usage:
-#
-#       stage [-pclL6sxh] <version>
-#
-
-usage() {
-    echo "Usage: stage [-pclL6sxh] <version>"
-}
-
-rpm=
-rpm6=
-literpm=
-lite6rpm=
-perlrpm=
-shellrpm=
-
-DEST=
-USER="webadmin@mail.shorewall.net"
-SHOREWALL=shorewall
-COMMAND=scp
-
-STAGECOMMON=
-STAGELITE=
-STAGEXML=
-STAGEHTML=
-STAGE6=
-STAGE6LITE=
-PARTIAL=Yes
-BASE=
-
-done=
-
-case $1 in
-    -*)
-	;;
-    *)
-	STAGECOMMON=Yes
-	STAGEPERL=Yes
-	STAGESHELL=Yes
-	STAGELITE=Yes
-	STAGEXML=Yes
-	STAGEHTML=Yes
-	STAGE6=Yes
-	STAGE6LITE=Yes
-	PARTIAL=
-	done=Yes
-	;;
-esac
-
-while [ -z "$done" ]; do
-    [ $# -eq 0 ] && break
-
-    option=$1
-    case $option in
-	-*)
-	    option=${option#-}
-
-	    [ -z "$option" ] && break
-
-	    while [ -n "$option" ]; do
-		case $option in
-		    c*)
-			STAGECOMMON=Yes
-			option=${option#c}
-			;;
-		    l*)
-			STAGELITE=Yes
-			option=${option#l}
-			;;
-		    x*)
-			STAGEXML=Yes
-			option=${option#x}
-			;;
-		    h*)
-			STAGEHTML=Yes
-			option=${option#h}
-			;;
-		    6*)
-			STAGE6=Yes
-			option=${option#6}
-			;;
-		    L*)
-			STAGE6LITE=Yes
-			option=${option#L}
-			;;
-	    	    *)
-			usage
-			;;
-		esac
-	    done
-	    shift
-	    ;;
-	*)
-	    done=Yes
-	    ;;
-    esac
-done
-
-
-case $1 in
-    4.*Beta*|4.*RC*)
-	DEST="/srv/ftp/pub/private/development/${1%.*}/shorewall-$1"
-	SHOREWALL=shorewall
-	rpm=shorewall-${1%-*}-0${1#*-}.noarch.rpm
-	rpm6=shorewall6-${1%-*}-0${1#*-}.noarch.rpm
-	literpm=shorewall-lite-${1%-*}-0${1#*-}.noarch.rpm
-	lite6rpm=shorewall6-lite-${1%-*}-0${1#*-}.noarch.rpm
-	BASE=Yes
-	;;
-    4.4.*)
-	DEST="/srv/ftp/pub/private/${1%.*}/shorewall-$1"
-	SHOREWALL=shorewall
-	rpm=shorewall-${1}-0base.noarch.rpm
-	literpm=shorewall-lite-${1}-0base.noarch.rpm
-	rpm6=shorewall6-${1}-0base.noarch.rpm
-	lite6rpm=shorewall6-lite-${1}-0base.noarch.rpm
-	BASE=Yes
-	;;
-    *)
-	echo "Unknown Version $1" >&2
-	exit 1
-	;;
-esac
-
-[ $# -eq 1 ] || { echo "Usage: $(basename $0) <version>"; exit 2; }
-
-if [ -z "$PATCHNUM" -a -d shorewall-common ]; then
-    echo "   ERROR: Paranoid to stage a base release when a patch release has been built in the current directory" >&2
-    exit 1 
-fi
-
-[ -d errata ] || mkdir errata
-
-[ -f known_problems.txt ] || echo "There are no known problems in Shorewall version $1" > known_problems.txt
-
-[ -n "$PARTIAL" -a -z "$STAGECOMMON" ]  && SHOREWALLDIR=shorewall || SHOREWALLDIR=$SHOREWALL-${1}
-
-cp $SHOREWALLDIR/releasenotes.txt releasenotes.txt
-
-if [ "$HOSTNAME" = lists ]; then
-	mkdir -p $DEST
-	[ -n "$BASE" ] && mkdir $DEST/base
-	COMMAND=cp
-else
-	ssh $USER mkdir -p $DEST
-	[ -n "$BASE" ] && ssh $USER mkdir -p $DEST/base
-	DEST=${USER}:${DEST}
-fi
-
-files="errata known_problems.txt releasenotes.txt patch-*-$1 ${1}.*"
-base=
-
-rm -f *-${1}*.asc
-
-for f in *-${1}.tar.bz2 *-${1}.tgz; do
-    /usr/bin/gpg -ab --batch --comment 'To verify this, you can download our public key at https://lists.shorewall.net/shorewall.gpg.key' $f
-done
-
-[ -n "$STAGE6" ]      && base="shorewall6-${1}.tar.*"                && files="$files shorewall6-${1}.*          $rpm6"
-[ -n "$STAGECOMMON" ] && base="$base shorewall-${1}.tar.*"           && files="$files shorewall-${1}.*           $rpm"
-[ -n "$STAGELITE" ]   && base="$base shorewall-lite-${1}.tar.*"      && files="$files shorewall-lite-${1}.*      $literpm"
-[ -n "$STAGE6LITE" ]  && base="$base shorewall6-lite-${1}.tar.*"     && files="$files shorewall6-lite-${1}.*     $lite6rpm"
-[ -n "$STAGEXML" ]    && base="$base shorewall-docs-xml-${1}.tar.*"  && files="$files shorewall-docs-xml-${1}.*"
-[ -n "$STAGEHTML" ]   && base="$base shorewall-docs-html-${1}.tar.*" && files="$files shorewall-docs-html-${1}.*"
-
-rpms=`for f in $files; do case $f in *.rpm) echo $f;; *);; esac done`
-
-[ -n "$rpms" ] && rpm --resign $rpms
-
-[ -n "$BASE" ] && $COMMAND $base $DEST/base
-
-$COMMAND -r $files $DEST
diff --git a/tools/build/tagrelease b/tools/build/tagrelease
deleted file mode 100755
index 4cc8ef625..000000000
--- a/tools/build/tagrelease
+++ /dev/null
@@ -1,57 +0,0 @@
-#!/bin/sh
-#
-#  Tag a release
-#
-#  (C) 2007 -- Tom Eastep (teastep@shorewall.net)
-#
-#     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
-#
-#	This program is free software; you can redistribute it and/or modify
-#	it under the terms of Version 2 of the GNU General Public License
-#	as published by the Free Software Foundation.
-#
-#	This program is distributed in the hope that it will be useful,
-#	but WITHOUT ANY WARRANTY; without even the implied warranty of
-#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-#	GNU General Public License for more details.
-#
-#	You should have received a copy of the GNU General Public License
-#	along with this program; if not, write to the Free Software
-#	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Usage:
-#
-#       tagrelease <version>
-#
-[ $# -eq 1 ] || { echo "usage: tagrelease <version>" >&2; exit 1; }
-
-VERSION=$1
-
-case $VERSION in
-    4.0.*)
-	BRANCH=~/shorewall/branches/4.0/
-	;;
-    4.1.*)
-	BRANCH=~/shorewall/trunk/
-	;;
-    *)
-	BRANCH=~/shorewall/3.4/
-	;;
-esac
-
-cd ~/shorewall/tags/
-
-svn mkdir $VERSION
-
-cd $VERSION
-
-for directory in Shorewall-common Shorewall-shell Shorewall-lite Shorewall-perl manpages manpages-lite Samples; do
-    if [ -d $BRANCH/$directory ]; then
-	rm -f $BRANCH/$directory/*~
-	[ -d $BRANCH/$directory/Shorewall ] && rm -f $BRANCH/$directory/Shorewall/*~
-	svn cp $BRANCH/$directory/ .
-    fi
-done
-
-svn commit -m "Tag version $VERSION"
-
diff --git a/tools/build/upload b/tools/build/upload
deleted file mode 100755
index 85d1446ef..000000000
--- a/tools/build/upload
+++ /dev/null
@@ -1,231 +0,0 @@
-#!/bin/sh
-#
-#  Upload a release to the master server
-#
-#  (C) 2007 -- Tom Eastep (teastep@shorewall.net)
-#
-#
-#     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
-#
-#	This program is free software; you can redistribute it and/or modify
-#	it under the terms of Version 2 of the GNU General Public License
-#	as published by the Free Software Foundation.
-#
-#	This program is distributed in the hope that it will be useful,
-#	but WITHOUT ANY WARRANTY; without even the implied warranty of
-#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-#	GNU General Public License for more details.
-#
-#	You should have received a copy of the GNU General Public License
-#	along with this program; if not, write to the Free Software
-#	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Usage:
-#
-#       upload [-pclL6sxh] <version>
-#
-
-usage() {
-    echo "Usage: upload [-pclL6sxh] <version>"
-}
-
-rpm=
-rpm6=
-literpm=
-lite6rpm=
-perlrpm=
-shellrpm=
-
-DEST=
-USER="webadmin@mail.shorewall.net"
-SHOREWALL=shorewall
-COMMAND=scp
-
-UPLOADCOMMON=
-UPLOADPERL=
-UPLOADSHELL=
-UPLOADLITE=
-UPLOADXML=
-UPLOADHTML=
-UPLOAD6=
-UPLOAD6LITE=
-PARTIAL=Yes
-BASE=
-
-done=
-
-case $1 in
-    -*)
-	;;
-    *)
-	UPLOADCOMMON=Yes
-	UPLOADPERL=Yes
-	UPLOADSHELL=Yes
-	UPLOADLITE=Yes
-	UPLOADXML=Yes
-	UPLOADHTML=Yes
-
-	case $1 in
-	    4.0.*)
-		;;
-	    *)
-		UPLOAD6=Yes
-		UPLOAD6LITE=Yes
-		;;
-	esac
-
-	PARTIAL=
-	done=Yes
-	;;
-esac
-
-while [ -z "$done" ]; do
-    [ $# -eq 0 ] && break
-
-    option=$1
-    case $option in
-	-*)
-	    option=${option#-}
-
-	    [ -z "$option" ] && break
-
-	    while [ -n "$option" ]; do
-		case $option in
-		    p*)
-			UPLOADPERL=Yes
-			option=${option#p}
-			;;
-		    c*)
-			UPLOADCOMMON=Yes
-			option=${option#c}
-			;;
-		    s*)
-			UPLOADSHELL=Yes
-			option=${option#s}
-			;;
-		    l*)
-			UPLOADLITE=Yes
-			option=${option#l}
-			;;
-		    x*)
-			UPLOADXML=Yes
-			option=${option#x}
-			;;
-		    h*)
-			UPLOADHTML=Yes
-			option=${option#h}
-			;;
-		    6*)
-			UPLOAD6=Yes
-			option=${option#6}
-			;;
-		    L*)
-			UPLOAD6LITE=Yes
-			option=${option#L}
-			;;
-	    	    *)
-			usage
-			;;
-		esac
-	    done
-	    shift
-	    ;;
-	*)
-	    done=Yes
-	    ;;
-    esac
-done
-
-
-case $1 in
-    4.*Beta*|4.*RC*)
-	DEST="/srv/ftp/pub/shorewall/development/${1%.*}/shorewall-$1"
-	SHOREWALL=shorewall-common
-	rpm=shorewall-common-${1%-*}-0${1#*-}.noarch.rpm
-	rpm6=shorewall6-${1%-*}-0${1#*-}.noarch.rpm
-	literpm=shorewall-lite-${1%-*}-0${1#*-}.noarch.rpm
-	lite6rpm=shorewall6-lite-${1%-*}-0${1#*-}.noarch.rpm
-	perlrpm=shorewall-perl-${1%-*}-0${1#*-}.noarch.rpm
-	shellrpm=shorewall-shell-${1%-*}-0${1#*-}.noarch.rpm
-	BASE=Yes
-	;;
-    4.[02].*.*)
-	BASEVERSION=${1%.*}
-	PATCHNUM=${1##*.}
-	DEST="/srv/ftp/pub/shorewall/${BASEVERSION%.*}/shorewall-${BASEVERSION}"
-	SHOREWALL=shorewall-common
-	rpm=shorewall-common-${BASEVERSION}-${PATCHNUM}.noarch.rpm
-	rpm6=shorewall6-${BASEVERSION}-${PATCHNUM}.noarch.rpm
-	literpm=shorewall-lite-${BASEVERSION}-${PATCHNUM}.noarch.rpm
-	lite6rpm=shorewall6-lite-${BASEVERSION}-${PATCHNUM}.noarch.rpm
-	perlrpm=shorewall-perl-${BASEVERSION}-${PATCHNUM}.noarch.rpm
-	shellrpm=shorewall-shell-${BASEVERSION}-${PATCHNUM}.noarch.rpm
-	;;
-    4.[02].*)
-	DEST="/srv/ftp/pub/shorewall/${1%.*}/shorewall-$1"
-	SHOREWALL=shorewall-common
-	rpm=shorewall-common-${1}-0base.noarch.rpm
-	rpm6=shorewall6-${1}-0base.noarch.rpm
-	literpm=shorewall-lite-${1}-0base.noarch.rpm
-	lite6rpm=shorewall6-lite-${1}-0base.noarch.rpm
-	perlrpm=shorewall-perl-${1}-0base.noarch.rpm
-	shellrpm=shorewall-shell-${1}-0base.noarch.rpm
-	BASE=Yes
-	;;
-    4.3.*)
-	DEST="/srv/ftp/pub/shorewall/development/${1%.*}/shorewall-$1"
-	SHOREWALL=shorewall-common
-	rpm=shorewall-common-${1}-0base.noarch.rpm
-	literpm=shorewall-lite-${1}-0base.noarch.rpm
-	perlrpm=shorewall-perl-${1}-0base.noarch.rpm
-	shellrpm=shorewall-shell-${1}-0base.noarch.rpm
-	rpm6=shorewall6-${1}-0base.noarch.rpm
-	lite6rpm=shorewall6-lite-${1}-0base.noarch.rpm
-	BASE=Yes
-	;;
-    *)
-	echo "Unknown Version $1" >&2
-	exit 1
-	;;
-esac
-
-[ $# -eq 1 ] || { echo "Usage: $(basename $0) <version>"; exit 2; }
-
-if [ -z "$PATCHNUM" -a -d shorewall-common ]; then
-    echo "   ERROR: Paranoid to upload a base release when a patch release has been built in the current directory" >&2
-    exit 1 
-fi
-
-[ -d errata ] || mkdir errata
-
-[ -f known_problems.txt ] || echo "There are no known problems in Shorewall version $1" > known_problems.txt
-
-[ -n "$PARTIAL" -a -z "$UPLOADCOMMON" ]  && SHOREWALLDIR=shorewall-common || SHOREWALLDIR=$SHOREWALL-${1}
-
-cp $SHOREWALLDIR/releasenotes.txt releasenotes.txt
-
-if [ "$HOSTNAME" = lists ]; then
-	mkdir -p $DEST
-	[ -n "$BASE" ] && mkdir $DEST/base
-	COMMAND=cp
-else
-	ssh $USER mkdir -p $DEST
-	[ -n "$BASE" ] && ssh $USER mkdir -p $DEST/base
-	DEST=${USER}:${DEST}
-fi
-
-files="errata known_problems.txt releasenotes.txt patch-*-$1 ${1}.*"
-base=
-
-[ -n "$UPLOAD6" ]      && base="$base shorewall6-${1}.tar.*"          && files="$files shorewall6-${1}.*          $rpm6"
-[ -n "$UPLOADPERL" ]   && base="$base shorewall-perl-${1}.tar.*"      && files="$files shorewall-perl-${1}.*      $perlrpm"
-[ -n "$UPLOADCOMMON" ] && base="$base shorewall-common-${1}.tar.*"    && files="$files shorewall-common-${1}.*    $rpm"
-[ -n "$UPLOADSHELL" ]  && base="$base shorewall-shell-${1}.tar.*"     && files="$files shorewall-shell-${1}.*     $shellrpm"
-[ -n "$UPLOADLITE" ]   && base="$base shorewall-lite-${1}.tar.*"      && files="$files shorewall-lite-${1}.*      $literpm"
-[ -n "$UPLOAD6LITE" ]  && base="$base shorewall6-lite-${1}.tar.*"     && files="$files shorewall6-lite-${1}.*     $lite6rpm"
-[ -n "$UPLOADXML" ]    && base="$base shorewall-docs-xml-${1}.tar.*"  && files="$files shorewall-docs-xml-${1}.*  $literpm"
-[ -n "$UPLOADHTML" ]   && base="$base shorewall-docs-html-${1}.tar.*" && files="$files shorewall-docs-html-${1}.* $literpm"
-
-[ -n "$BASE" ] && $COMMAND $base $DEST/base
-
-$COMMAND -r $files $DEST
diff --git a/tools/build/upload44 b/tools/build/upload44
deleted file mode 100755
index d4a4998fc..000000000
--- a/tools/build/upload44
+++ /dev/null
@@ -1,194 +0,0 @@
-#!/bin/sh
-#
-#  Upload a release to the master server
-#
-#  (C) 2007 -- Tom Eastep (teastep@shorewall.net)
-#
-#
-#     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
-#
-#	This program is free software; you can redistribute it and/or modify
-#	it under the terms of Version 2 of the GNU General Public License
-#	as published by the Free Software Foundation.
-#
-#	This program is distributed in the hope that it will be useful,
-#	but WITHOUT ANY WARRANTY; without even the implied warranty of
-#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-#	GNU General Public License for more details.
-#
-#	You should have received a copy of the GNU General Public License
-#	along with this program; if not, write to the Free Software
-#	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Usage:
-#
-#       upload [-pclL6sxh] <version>
-#
-
-usage() {
-    echo "Usage: upload [-pclL6sxh] <version>"
-}
-
-rpm=
-rpm6=
-literpm=
-lite6rpm=
-perlrpm=
-shellrpm=
-
-DEST=
-USER="webadmin@mail.shorewall.net"
-SHOREWALL=shorewall
-COMMAND=scp
-
-UPLOADCOMMON=
-UPLOADLITE=
-UPLOADXML=
-UPLOADHTML=
-UPLOAD6=
-UPLOAD6LITE=
-PARTIAL=Yes
-BASE=
-
-done=
-
-case $1 in
-    -*)
-	;;
-    *)
-	UPLOADCOMMON=Yes
-	UPLOADPERL=Yes
-	UPLOADSHELL=Yes
-	UPLOADLITE=Yes
-	UPLOADXML=Yes
-	UPLOADHTML=Yes
-	UPLOAD6=Yes
-	UPLOAD6LITE=Yes
-	PARTIAL=
-	done=Yes
-	;;
-esac
-
-while [ -z "$done" ]; do
-    [ $# -eq 0 ] && break
-
-    option=$1
-    case $option in
-	-*)
-	    option=${option#-}
-
-	    [ -z "$option" ] && break
-
-	    while [ -n "$option" ]; do
-		case $option in
-		    c*)
-			UPLOADCOMMON=Yes
-			option=${option#c}
-			;;
-		    l*)
-			UPLOADLITE=Yes
-			option=${option#l}
-			;;
-		    x*)
-			UPLOADXML=Yes
-			option=${option#x}
-			;;
-		    h*)
-			UPLOADHTML=Yes
-			option=${option#h}
-			;;
-		    6*)
-			UPLOAD6=Yes
-			option=${option#6}
-			;;
-		    L*)
-			UPLOAD6LITE=Yes
-			option=${option#L}
-			;;
-	    	    *)
-			usage
-			;;
-		esac
-	    done
-	    shift
-	    ;;
-	*)
-	    done=Yes
-	    ;;
-    esac
-done
-
-
-case $1 in
-    4.*Beta*|4.*RC*)
-	DEST="/srv/ftp/pub/shorewall/development/${1%.*}/shorewall-$1"
-	SHOREWALL=shorewall
-	rpm=shorewall-${1%-*}-0${1#*-}.noarch.rpm
-	rpm6=shorewall6-${1%-*}-0${1#*-}.noarch.rpm
-	literpm=shorewall-lite-${1%-*}-0${1#*-}.noarch.rpm
-	lite6rpm=shorewall6-lite-${1%-*}-0${1#*-}.noarch.rpm
-	BASE=Yes
-	;;
-    4.3.*)
-	DEST="/srv/ftp/pub/shorewall/development/${1%.*}/shorewall-$1"
-	SHOREWALL=shorewall
-	rpm=shorewall-${1}-0base.noarch.rpm
-	literpm=shorewall-lite-${1}-0base.noarch.rpm
-	rpm6=shorewall6-${1}-0base.noarch.rpm
-	lite6rpm=shorewall6-lite-${1}-0base.noarch.rpm
-	BASE=Yes
-	;;
-    *)
-	echo "Unknown Version $1" >&2
-	exit 1
-	;;
-esac
-
-[ $# -eq 1 ] || { echo "Usage: $(basename $0) <version>"; exit 2; }
-
-if [ -z "$PATCHNUM" -a -d shorewall-common ]; then
-    echo "   ERROR: Paranoid to upload a base release when a patch release has been built in the current directory" >&2
-    exit 1 
-fi
-
-[ -d errata ] || mkdir errata
-
-[ -f known_problems.txt ] || echo "There are no known problems in Shorewall version $1" > known_problems.txt
-
-[ -n "$PARTIAL" -a -z "$UPLOADCOMMON" ]  && SHOREWALLDIR=shorewall || SHOREWALLDIR=$SHOREWALL-${1}
-
-cp $SHOREWALLDIR/releasenotes.txt releasenotes.txt
-
-if [ "$HOSTNAME" = lists ]; then
-	mkdir -p $DEST
-	[ -n "$BASE" ] && mkdir $DEST/base
-	COMMAND=cp
-else
-	ssh $USER mkdir -p $DEST
-	[ -n "$BASE" ] && ssh $USER mkdir -p $DEST/base
-	DEST=${USER}:${DEST}
-fi
-
-files="errata known_problems.txt releasenotes.txt patch-*-$1 ${1}.*"
-base=
-
-rm -f *-${1}*.asc
-
-for f in *-${1}.tar.bz2 *-${1}.tgz; do
-    /usr/bin/gpg -ab --batch --comment 'To verify this, you can download our public key at https://lists.shorewall.net/shorewall.gpg.key' $f
-done
-
-[ -n "$UPLOAD6" ]      && base="shorewall6-${1}.tar.*"                && files="$files shorewall6-${1}.*          $rpm6"
-[ -n "$UPLOADCOMMON" ] && base="$base shorewall-${1}.tar.*"           && files="$files shorewall-${1}.*           $rpm"
-[ -n "$UPLOADLITE" ]   && base="$base shorewall-lite-${1}.tar.*"      && files="$files shorewall-lite-${1}.*      $literpm"
-[ -n "$UPLOAD6LITE" ]  && base="$base shorewall6-lite-${1}.tar.*"     && files="$files shorewall6-lite-${1}.*     $lite6rpm"
-[ -n "$UPLOADXML" ]    && base="$base shorewall-docs-xml-${1}.tar.*"  && files="$files shorewall-docs-xml-${1}.*"
-[ -n "$UPLOADHTML" ]   && base="$base shorewall-docs-html-${1}.tar.*" && files="$files shorewall-docs-html-${1}.*"
-
-rpms=`for f in $files; do case $f in *.rpm) echo $f;; *);; esac done`
-
-[ -n "$rpms" ] && rpm --resign $rpms
-
-[ -n "$BASE" ] && $COMMAND $base $DEST/base
-
-$COMMAND -r $files $DEST
diff --git a/tools/subversion/config b/tools/subversion/config
deleted file mode 100644
index 2b65b1514..000000000
--- a/tools/subversion/config
+++ /dev/null
@@ -1,184 +0,0 @@
-### This file configures various client-side behaviors.
-###
-### The commented-out examples below are intended to demonstrate
-### how to use this file.
-
-### Section for authentication and authorization customizations.
-# [auth]
-### Set store-passwords to 'no' to avoid storing passwords in the
-### auth/ area of your config directory.  It defaults to 'yes'.
-### Note that this option only prevents saving of *new* passwords;
-### it doesn't invalidate existing passwords.  (To do that, remove
-### the cache files by hand as described in the Subversion book.)
-# store-passwords = no
-### Set store-auth-creds to 'no' to avoid storing any subversion
-### credentials in the auth/ area of your config directory.
-### It defaults to 'yes'.  Note that this option only prevents
-### saving of *new* credentials;  it doesn't invalidate existing
-### caches.  (To do that, remove the cache files by hand.)
-# store-auth-creds = no
-
-### Section for configuring external helper applications.
-### Set editor to the command used to invoke your text editor.
-###   This will override the environment variables that Subversion
-###   examines by default to find this information ($EDITOR,
-###   et al).
-### Set diff-cmd to the absolute path of your 'diff' program.
-###   This will override the compile-time default, which is to use
-###   Subversion's internal diff implementation.
-### Set diff3-cmd to the absolute path of your 'diff3' program.
-###   This will override the compile-time default, which is to use
-###   Subversion's internal diff3 implementation.
-### Set diff3-has-program-arg to 'true' or 'yes' if your 'diff3'
-###   program accepts the '--diff-program' option.
-
-[helpers]
-#editor-cmd = pico # (vi, emacs, notepad, etc.)
-
-#diff-cmd = /usr/bin/diff -bB
-#diff3-cmd = diff3_program (diff3, gdiff3, etc.)
-#diff3-has-program-arg = true 
-
-### Section for configuring tunnel agents.
-# [tunnels]
-### Configure svn protocol tunnel schemes here.  By default, only
-### the 'ssh' scheme is defined.  You can define other schemes to
-### be used with 'svn+scheme://hostname/path' URLs.  A scheme
-### definition is simply a command, optionally prefixed by an
-### environment variable name which can override the command if it
-### is defined.  The command (or environment variable) may contain
-### arguments, using standard shell quoting for arguments with
-### spaces.  The command will be invoked as:
-###   <command> <hostname> svnserve -t
-### (If the URL includes a username, then the hostname will be
-### passed to the tunnel agent as <user>@<hostname>.)  If the
-### built-in ssh scheme were not predefined, it could be defined
-### as:
-# ssh = $SVN_SSH ssh
-### If you wanted to define a new 'rsh' scheme, to be used with
-### 'svn+rsh:' URLs, you could do so as follows:
-# rsh = rsh
-### Or, if you wanted to specify a full path and arguments:
-# rsh = /path/to/rsh -l myusername
-### On Windows, if you are specifying a full path to a command,
-### use a forward slash (/) or a paired backslash (\\) as the
-### path separator.  A single backslash will be treated as an
-### escape for the following character.
-
-### Section for configuring miscelleneous Subversion options.
-[miscellany]
-### Set global-ignores to a set of whitespace-delimited globs
-### which Subversion will ignore in its 'status' output.
-global-ignores = *.o *.lo *.la #*# .*.rej *.rej .*~ *~ .#* .DS_Store *.bak .depdb .depdblock .filemap .lock .registry .channels .tmp *.webprj *.kdevelop
-### Set log-encoding to the default encoding for log messages
-log-encoding = utf-8
-### Set use-commit-times to make checkout/update/switch/revert
-### put last-committed timestamps on every file touched.
-use-commit-times = yes
-### Set enable-auto-props to 'yes' to enable automatic properties
-### for 'svn add' and 'svn import', it defaults to 'no'.
-### Automatic properties are defined in the section 'auto-props'.
-enable-auto-props = yes
-
-### Section for configuring automatic properties.
-### The format of the entries is:
-###   file-name-pattern = propname[=value][;propname[=value]...]
-### The file-name-pattern can contain wildcards (such as '*' and
-### '?').  All entries which match will be applied to the file.
-### Note that auto-props functionality must be enabled, which
-### is typically done by setting the 'enable-auto-props' option.
-[auto-props]
-
-*.sh = svn:eol-style=native;svn:executable;svn:keywords=Id;svn:mime-type=text/plain;charset=utf-8
-*.php = svn:eol-style=native;svn:keywords=Id;svn:mime-type=text/x-php;charset=utf-8
-*.txt = svn:eol-style=native;svn:keywords=Id;svn:mime-type=text/plain;charset=utf-8
-*.cgi = svn:eol-style=native;svn:keywords=Id;svn:mime-type=text/plain;charset=utf-8
-*.pl = svn:eol-style=native;svn:keywords=Id;svn:mime-type=text/plain;charset=utf-8
-
-# Images
-*.gif  = svn:mime-type=image/gif
-*.png  = svn:mime-type=image/png
-*.jpg  = svn:mime-type=image/jpeg
-*.jpeg = svn:mime-type=image/jpeg
-*.ico  = svn:mime-type=image/x-icon
-
-#apache
-.htaccess = svn:eol-style=native;svn:mime-type=text/plain;charset=utf-8;svn:keywords=Id
-htaccess* = svn:eol-style=native;svn:mime-type=text/plain;charset=utf-8;svn:keywords=Id
-
-#python
-
-*.py = svn:eol-style=native;svn:executable;svn:keywords=Id;svn:mime-type=text/plain;charset=utf-8
-
-# Web, XML
-
-*.htm  = svn:eol-style=native;svn:keywords=Id;svn:mime-type=text/html;charset=utf-8
-*.html = svn:eol-style=native;svn:keywords=Id;svn:mime-type=text/html;charset=utf-8
-*.js   = svn:eol-style=native;svn:keywords=Id;svn:mime-type=text/javascript;charset=utf-8
-*.css  = svn:eol-style=native;svn:keywords=Id;svn:mime-type=text/css;charset=utf-8
-*.xml  = svn:eol-style=native;svn:keywords=Id;svn:mime-type=text/xml;charset=utf-8
-
-#SQL
-*.sql  = svn:eol-style=native;svn:keywords=Id;svn:mime-type=text/plain;charset=utf-8
-
-#JAVA 
-
-*.java = svn:eol-style=native;svn:keywords=Id;svn:mime-type=text/plain;charset=utf-8
-
-
-
-
-# "Hasefroch" stuff here..
-
-*.doc = svn:mime-type=application/msword
-*.vdx = svn:mime-type=application/vnd.visio.xml
-
-# adobe(tm) stuff here.
-
-*.pdf = svn:mime-type=application/pdf
-
-# other common files
-
-INSTALL* = svn:eol-style=native;svn:keywords=Id;svn:mime-type=text/plain;charset=utf-8
-README* = svn:eol-style=native;svn:keywords=Id;svn:mime-type=text/plain;charset=utf-8
-BUGS* = svn:eol-style=native;svn:keywords=Id;svn:mime-type=text/plain;charset=utf-8
-LICENSE* = svn:eol-style=native;svn:keywords=Id;svn:mime-type=text/plain;charset=utf-8
-*.conf = svn:eol-style=native;svn:keywords=Id;svn:mime-type=text/plain;charset=utf-8
-*.dist = svn:eol-style=native;svn:keywords=Id;svn:mime-type=text/plain;charset=utf-8
-
-#OpenDocuments..
-
-*.sds = svn:mime-type=application/vnd.stardivision.chart
-*.sdc = svn:mime-type=application/vnd.stardivision.calc
-*.sdw = svn:mime-type=application/vnd.stardivision.writer
-*.sgl = svn:mime-type=application/vnd.stardivision.writer-global
-*.sda = svn:mime-type=application/vnd.stardivision.draw
-*.sdd = svn:mime-type=application/vnd.stardivision.impress
-*.sdf = svn:mime-type=application/vnd.stardivision.math
-*.sxw = svn:mime-type=application/vnd.sun.xml.writer
-*.stw = svn:mime-type=application/vnd.sun.xml.writer.template
-*.sxg = svn:mime-type=application/vnd.sun.xml.writer.global
-*.sxc = svn:mime-type=application/vnd.sun.xml.calc
-*.stc = svn:mime-type=application/vnd.sun.xml.calc.template
-*.sxi = svn:mime-type=application/vnd.sun.xml.impress
-*.sti = svn:mime-type=application/vnd.sun.xml.impress.template
-*.sxd = svn:mime-type=application/vnd.sun.xml.draw
-*.std = svn:mime-type=application/vnd.sun.xml.draw.template
-*.sxm = svn:mime-type=application/vnd.sun.xml.math
-*.odt = svn:mime-type=application/vnd.oasis.opendocument.text
-*.ott = svn:mime-type=application/vnd.oasis.opendocument.text-template
-*.oth = svn:mime-type=application/vnd.oasis.opendocument.text-web
-*.odm = svn:mime-type=application/vnd.oasis.opendocument.text-master
-*.odg = svn:mime-type=application/vnd.oasis.opendocument.graphics
-*.otg = svn:mime-type=application/vnd.oasis.opendocument.graphics-template
-*.odp = svn:mime-type=application/vnd.oasis.opendocument.presentation
-*.otp = svn:mime-type=application/vnd.oasis.opendocument.presentation-template
-*.ods = svn:mime-type=application/vnd.oasis.opendocument.spreadsheet
-*.ots = svn:mime-type=application/vnd.oasis.opendocument.spreadsheet-template
-*.odc = svn:mime-type=application/vnd.oasis.opendocument.chart
-*.odf = svn:mime-type=application/vnd.oasis.opendocument.formula
-*.odb = svn:mime-type=application/vnd.oasis.opendocument.database
-*.odi = svn:mime-type=application/vnd.oasis.opendocument.image
-
-# DIA 
-*.dia = svn:mime-type=application/octet-stream
diff --git a/tools/subversion/servers b/tools/subversion/servers
deleted file mode 100644
index cecdfc515..000000000
--- a/tools/subversion/servers
+++ /dev/null
@@ -1,78 +0,0 @@
-### This file specifies server-specific protocol parameters,
-### including HTTP proxy information, and HTTP timeout settings.
-###
-### The currently defined server options are:
-###   http-proxy-host            Proxy host for HTTP connection
-###   http-proxy-port            Port number of proxy host service
-###   http-proxy-username        Username for auth to proxy service
-###   http-proxy-password        Password for auth to proxy service
-###   http-proxy-exceptions      List of sites that do not use proxy
-###   http-timeout               Timeout for HTTP requests in seconds
-###   http-compression           Whether to compress HTTP requests
-###   neon-debug-mask            Debug mask for Neon HTTP library
-###   ssl-authority-files        List of files, each of a trusted CAs
-###   ssl-trust-default-ca       Trust the system 'default' CAs
-###   ssl-client-cert-file       PKCS#12 format client certificate file
-###   ssl-client-cert-password   Client Key password, if needed.
-###
-### HTTP timeouts, if given, are specified in seconds.  A timeout
-### of 0, i.e. zero, causes a builtin default to be used.
-###
-### The commented-out examples below are intended only to
-### demonstrate how to use this file; any resemblance to actual
-### servers, living or dead, is entirely coincidental.
-
-### In this section, the URL of the repository you're trying to
-### access is matched against the patterns on the right.  If a
-### match is found, the server info is from the section with the
-### corresponding name.
-
-[groups]
-sourceforge = *.sourceforge.net
-# othergroup = repository.blarggitywhoomph.com
-# thirdgroup = *.example.com
-
-[sourceforge]
-http-compression = no
-
-### Information for the first group:
-# [group1]
-# http-proxy-host = proxy1.some-domain-name.com
-# http-proxy-port = 80
-# http-proxy-username = blah
-# http-proxy-password = doubleblah
-# http-timeout = 60
-# neon-debug-mask = 130
-
-### Information for the second group:
-# [othergroup]
-# http-proxy-host = proxy2.some-domain-name.com
-# http-proxy-port = 9000
-# No username and password, so use the defaults below.
-
-### You can set default parameters in the 'global' section.
-### These parameters apply if no corresponding parameter is set in
-### a specifically matched group as shown above.  Thus, if you go
-### through the same proxy server to reach every site on the
-### Internet, you probably just want to put that server's
-### information in the 'global' section and not bother with
-### 'groups' or any other sections.
-###
-### If you go through a proxy for all but a few sites, you can
-### list those exceptions under 'http-proxy-exceptions'.  This only
-### overrides defaults, not explicitly matched server names.
-###
-### 'ssl-authority-files' is a semicolon-delimited list of files,
-### each pointing to a PEM-encoded Certificate Authority (CA) 
-### SSL certificate.  See details above for overriding security 
-### due to SSL.
-[global]
-# http-proxy-exceptions = *.exception.com, www.internal-site.org
-# http-proxy-host = defaultproxy.whatever.com
-# http-proxy-port = 7000
-# http-proxy-username = defaultusername
-# http-proxy-password = defaultpassword
-http-compression = yes
-# No http-timeout, so just use the builtin default.
-# No neon-debug-mask, so neon debugging is disabled.
-# ssl-authority-files = /path/to/CAcert.pem;/path/to/CAcert2.pem
diff --git a/tools/testing/accepttest b/tools/testing/accepttest
deleted file mode 100755
index 41f86f4b1..000000000
--- a/tools/testing/accepttest
+++ /dev/null
@@ -1,31 +0,0 @@
-#!/bin/sh
-#
-#     Clear an exception on one or more regression tests  -- (C) 2007, Tom Eastep (teastep@shorewall.net)
-#
-#     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
-#
-#	This program is free software; you can redistribute it and/or modify
-#	it under the terms of Version 2 of the GNU General Public License
-#	as published by the Free Software Foundation.
-#
-#	This program is distributed in the hope that it will be useful,
-#	but WITHOUT ANY WARRANTY; without even the implied warranty of
-#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-#	GNU General Public License for more details.
-#
-#	You should have received a copy of the GNU General Public License
-#	along with this program; if not, write to the Free Software
-#	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-#
-
-for directory in $*; do
-    if [ -d $directory ]; then
-	cp -f $directory/firewall $directory/firewall.last && echo "Test $directory ACCEPTED"
-    else
-	echo "   WARNING: No directory named $directory" >&2
-    fi
-done
-	
-
-  
diff --git a/tools/testing/regression b/tools/testing/regression
deleted file mode 100755
index 04e09c4ed..000000000
--- a/tools/testing/regression
+++ /dev/null
@@ -1,59 +0,0 @@
-#!/bin/sh
-#
-#     Shorewall Compiler Positive Regression test driver -- (C) 2007, Tom Eastep (teastep@shorewall.net)
-#
-#     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
-#
-#	This program is free software; you can redistribute it and/or modify
-#	it under the terms of Version 2 of the GNU General Public License
-#	as published by the Free Software Foundation.
-#
-#	This program is distributed in the hope that it will be useful,
-#	but WITHOUT ANY WARRANTY; without even the implied warranty of
-#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-#	GNU General Public License for more details.
-#
-#	You should have received a copy of the GNU General Public License
-#	along with this program; if not, write to the Free Software
-#	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-#
-
-case $(/sbin/shorewall version) in
-    4.0.*)
-	OPTIONS=vvv
-	;;
-    *)
-	OPTIONS=v2
-	;;
-esac
-
-DIRECTORIES="$*"
-
-[ -n "${DIRECTORIES:=*}" ]
-
-for directory in $DIRECTORIES; do
-    if [ -d $directory ]; then
-	existing=$(ls -l $directory/firewall 2> /dev/null);
-	if /sbin/shorewall -${OPTIONS} compile -t $directory $directory/firewall > $directory/compileroutput 2> $directory/compilererrors; then
-	    if [ "$existing" = "$(ls -l $directory/firewall)" ]; then
-		echo "Test $directory FAILED ******** No object produced"
-	    elif [ -f $directory/firewall.last ]; then
-		if diff -au $directory/firewall.last $directory/firewall > $directory/compare; then
-		    echo "Test $directory PASSED"
-		else
-		    echo "Test $directory FAILED ********* Failure data is in $directory/compare"
-		fi
-	    else
-		cp $directory/firewall $directory/firewall.last
-		echo "Test $directory INITIAL RUN"
-	    fi
-	else
-	    echo "Test $directory FAILED ********* Failure data is in $directory/compilererrors"
-	    rm -f $directory/faildata
-	fi
-    fi
-done
-
-
-  
diff --git a/tools/web/cronpublish.sh b/tools/web/cronpublish.sh
deleted file mode 100755
index b67d25d4a..000000000
--- a/tools/web/cronpublish.sh
+++ /dev/null
@@ -1,47 +0,0 @@
-#!/bin/sh
-
-STYLESHEET=/usr/share/xml/docbook/stylesheet/nwalsh/current/xhtml/docbook.xsl
-WEBSITE=/srv/www/html
-PROJECTS="web docs docs-fr"
-HOMEDIR=/home/judas_iscariote
-SVN_BIN=/usr/bin/svn
-
-publish() {
-    case $1 in
-	*.xml)
-	    b=${1%.*}
-
-	    if [ -f $WEBSITE/$b.htm ]; then
-		b=$b.htm
-		f="$WEBSITE/$b"
-	    else
-		b=$b.html
-		f="$WEBSITE/$b"
-	    fi
-
-	    echo "Converting $1 from XML to HTML ($b) ..."
-
-	    xmllint --valid --noout $1 && xsltproc --output $f --stringparam html.stylesheet html.css --stringparam ulink.target _self -param toc.section.depth 3 $STYLESHEET $1
-	    chmod g+w $f
-	    ;;
-	*)
-	    cp $1 $WEBSITE/$1
-	    chmod g+w $WEBSITE/$1
-	    ;;
-    esac
-
-}
-
-for project in $PROJECTS; do
-    cd $HOMEDIR/$project
-    $SVN_BIN  update --non-interactive | while read UA file; do 
-	case $UA in
-	    U|P|G)
-		publish $file
-		;;
-	    A)
-		[ -d $file ] && mkdir $WEBSITE/$file || publish $file
-		;;
-	esac
-    done
-done
diff --git a/tools/web/publish b/tools/web/publish
deleted file mode 100755
index 2d885d0c3..000000000
--- a/tools/web/publish
+++ /dev/null
@@ -1,143 +0,0 @@
-#!/bin/sh
-
-#STYLESHEET=/home/teastep/Shorewall/docbook-xsl-1.62.4//xhtml/docbook.xsl
-STYLESHEET=/usr/share/xml/docbook/stylesheet/nwalsh/current/xhtml/docbook.xsl
-WEBSITE=/home/teastep/Shorewall/Website
-HTMFILES="
-    6to4.htm
-    blacklisting_support.htm
-    configuration_file_basics.htm
-    CorpNetwork.htm
-    dhcp.htm
-    Documentation.htm
-    errata.htm
-    fallback.htm
-    FAQ.htm
-    GnuCopyright.htm
-    Install.htm
-    IPIP.htm
-    IPSEC.htm
-    kernel.htm
-    myfiles.htm
-    NAT.htm
-    ports.htm
-    PPTP.htm
-    ProxyARP.htm
-    quotes.htm
-    samba.htm
-    shorewall_extension_scripts.htm
-    shorewall_features.htm
-    shorewall_mirrors.htm
-    shorewall_prerequisites.htm
-    shorewall_quickstart_guide.htm
-    shorewall_setup_guide_fr.htm
-    shorewall_setup_guide.htm
-    Shorewall_sfindex_frame.htm
-    standalone.htm
-    starting_and_stopping_shorewall.htm
-    support.htm
-    three-interface.htm
-    traffic_shaping.htm
-    troubleshoot.htm
-    two-interface.htm
-    upgrade_issues.htm
-    VPN.htm
-    whitelisting_under_shorewall.htm"
-#
-# Suppress the table of contents in these short articles
-#
-NOTOC="
-    Documentation_Index.xml
-    ECN.xml
-    fallback.xml
-    GettingStarted.xml
-    IPP2P.xml
-    ping.xml
-    ProxyARP.xml
-    Shorewall_Doesnt.xml
-    shorewall_features.xml
-    shorewall_prerequisites.xml
-    SimpleBridge.xml"
-
-list_search() # $1 = element to search for , $2-$n = list
-{
-    local e
-    e=$1
-
-    while [ $# -gt 1 ]; do
-	shift
-	[ "x$e" = "x$1" ] && return 0
-    done
-
-    return 1
-}
-
-if [ $# -eq 0 ]; then
-    echo "Usage: $(basename $0) <XML file> ..."
-    exit 2
-fi
-
-while [ $# -gt 0 ]; do
-
-    case $1 in
-	*.xml)
-	    b=${1%.*}
-            #
-	    # The original HTML documents were created using MS FrontPage and
-	    # used the .htm suffix. The remainder use the .html suffix.
-	    #
-	    if list_search $b.htm $HTMFILES ; then
-		b=$b.htm
-		f="$WEBSITE/$b"
-	    else
-		b=$b.html
-		f="$WEBSITE/$b"
-	    fi
-
-	    list_search $1 $NOTOC && GENTOC="--stringparam generate.toc ''" || GENTOC=
-
-	    case $1 in
-		*_ru.xml)
-		    LANGUAGE="--stringparam l10n.gentext.default.language ru"
-		    ;;
-		*_fr.xml)
-		    LANGUAGE="--stringparam l10n.gentext.default.language fr"
-		    ;;
-		*)
-		    LANGUAGE=
-		    ;;
-	    esac
-
-	    echo "Converting $1 from XML to HTML ($b) ..."
-
-	    if xmllint --valid --noout $1 && xsltproc --output $f --stringparam html.stylesheet html.css --stringparam ulink.target _self $GENTOC $LANGUAGE --param toc.section.depth 3 $STYLESHEET $1 ; then
-		filestocopy="$filestocopy $f"
-	    fi
-	    ;;
-
-	*)
-	    filestocopy="$filestocopy $1"
-	    ;;
-    esac
-
-    shift
-
-done
-
-DESTS="
-webadmin@mail.shorewall.net:/srv/www/html
-"
-
-if [ -n "$filestocopy" ]; then
-    for f in $filestocopy; do
-	filestoreport="$filestoreport $(basename $f)"
-    done
-
-    chmod 664 $filestocopy
-    for d in $DESTS; do
-	echo "$filestoreport -> $d"
-	scp -qp $filestocopy $d
-    done
-fi
-
-
diff --git a/tools/web/publish-3.0 b/tools/web/publish-3.0
deleted file mode 100755
index addbd83c2..000000000
--- a/tools/web/publish-3.0
+++ /dev/null
@@ -1,143 +0,0 @@
-#!/bin/sh
-
-#STYLESHEET=/home/teastep/Shorewall/docbook-xsl-1.62.4//xhtml/docbook.xsl
-STYLESHEET=/usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl
-WEBSITE=/home/teastep/Shorewall/Website
-HTMFILES="
-    6to4.htm
-    blacklisting_support.htm
-    configuration_file_basics.htm
-    CorpNetwork.htm
-    dhcp.htm
-    Documentation.htm
-    errata.htm
-    fallback.htm
-    FAQ.htm
-    GnuCopyright.htm
-    Install.htm
-    IPIP.htm
-    IPSEC.htm
-    kernel.htm
-    myfiles.htm
-    NAT.htm
-    ports.htm
-    PPTP.htm
-    ProxyARP.htm
-    quotes.htm
-    samba.htm
-    shorewall_extension_scripts.htm
-    shorewall_features.htm
-    shorewall_mirrors.htm
-    shorewall_prerequisites.htm
-    shorewall_quickstart_guide.htm
-    shorewall_setup_guide_fr.htm
-    shorewall_setup_guide.htm
-    Shorewall_sfindex_frame.htm
-    standalone.htm
-    starting_and_stopping_shorewall.htm
-    support.htm
-    three-interface.htm
-    traffic_shaping.htm
-    troubleshoot.htm
-    two-interface.htm
-    upgrade_issues.htm
-    VPN.htm
-    whitelisting_under_shorewall.htm"
-#
-# Suppress the table of contents in these short articles
-#
-NOTOC="
-    Documentation_Index.xml
-    ECN.xml
-    fallback.xml
-    GettingStarted.xml
-    IPP2P.xml
-    ping.xml
-    ProxyARP.xml
-    Shorewall_Doesnt.xml
-    shorewall_features.xml
-    shorewall_prerequisites.xml
-    SimpleBridge.xml"
-
-list_search() # $1 = element to search for , $2-$n = list
-{
-    local e
-    e=$1
-
-    while [ $# -gt 1 ]; do
-	shift
-	[ "x$e" = "x$1" ] && return 0
-    done
-
-    return 1
-}
-
-if [ $# -eq 0 ]; then
-    echo "Usage: $(basename $0) <XML file> ..."
-    exit 2
-fi
-
-while [ $# -gt 0 ]; do
-
-    case $1 in
-	*.xml)
-	    b=${1%.*}
-            #
-	    # The original HTML documents were created using MS FrontPage and
-	    # used the .htm suffix. The remainder use the .html suffix.
-	    #
-	    if list_search $b.htm $HTMFILES ; then
-		b=$b.htm
-		f="$WEBSITE/$b"
-	    else
-		b=$b.html
-		f="$WEBSITE/$b"
-	    fi
-
-	    list_search $1 $NOTOC && GENTOC="--stringparam generate.toc ''" || GENTOC=
-
-	    case $1 in
-		*_ru.xml)
-		    LANGUAGE="--stringparam l10n.gentext.default.language ru"
-		    ;;
-		*_fr.xml)
-		    LANGUAGE="--stringparam l10n.gentext.default.language fr"
-		    ;;
-		*)
-		    LANGUAGE=
-		    ;;
-	    esac
-
-	    echo "Converting $1 from XML to HTML ($b) ..."
-
-	    if xmllint --valid --noout $1 && xsltproc --output $f --stringparam html.stylesheet html.css --stringparam ulink.target _self $GENTOC --param toc.section.depth 3 $STYLESHEET $1 ; then
-		filestocopy="$filestocopy $f"
-	    fi
-	    ;;
-
-	*)
-	    filestocopy="$filestocopy $1"
-	    ;;
-    esac
-
-    shift
-
-done
-
-DESTS="
-webadmin@mail.shorewall.net:/srv/www/html/3.0
-"
-
-if [ -n "$filestocopy" ]; then
-    for f in $filestocopy; do
-	filestoreport="$filestoreport $(basename $f)"
-    done
-
-    chmod 664 $filestocopy
-    for d in $DESTS; do
-	echo "$filestoreport -> $d"
-	scp -qp $filestocopy $d
-    done
-fi
-
-
diff --git a/tools/web/publish-4.4 b/tools/web/publish-4.4
deleted file mode 100755
index 4fef68156..000000000
--- a/tools/web/publish-4.4
+++ /dev/null
@@ -1,143 +0,0 @@
-#!/bin/sh
-
-#STYLESHEET=/home/teastep/Shorewall/docbook-xsl-1.62.4//xhtml/docbook.xsl
-STYLESHEET=/usr/share/xml/docbook/stylesheet/nwalsh/current/xhtml/docbook.xsl
-WEBSITE=/home/teastep/Shorewall/Website
-HTMFILES="
-    6to4.htm
-    blacklisting_support.htm
-    configuration_file_basics.htm
-    CorpNetwork.htm
-    dhcp.htm
-    Documentation.htm
-    errata.htm
-    fallback.htm
-    FAQ.htm
-    GnuCopyright.htm
-    Install.htm
-    IPIP.htm
-    IPSEC.htm
-    kernel.htm
-    myfiles.htm
-    NAT.htm
-    ports.htm
-    PPTP.htm
-    ProxyARP.htm
-    quotes.htm
-    samba.htm
-    shorewall_extension_scripts.htm
-    shorewall_features.htm
-    shorewall_mirrors.htm
-    shorewall_prerequisites.htm
-    shorewall_quickstart_guide.htm
-    shorewall_setup_guide_fr.htm
-    shorewall_setup_guide.htm
-    Shorewall_sfindex_frame.htm
-    standalone.htm
-    starting_and_stopping_shorewall.htm
-    support.htm
-    three-interface.htm
-    traffic_shaping.htm
-    troubleshoot.htm
-    two-interface.htm
-    upgrade_issues.htm
-    VPN.htm
-    whitelisting_under_shorewall.htm"
-#
-# Suppress the table of contents in these short articles
-#
-NOTOC="
-    Documentation_Index.xml
-    ECN.xml
-    fallback.xml
-    GettingStarted.xml
-    IPP2P.xml
-    ping.xml
-    ProxyARP.xml
-    Shorewall_Doesnt.xml
-    shorewall_features.xml
-    shorewall_prerequisites.xml
-    SimpleBridge.xml"
-
-list_search() # $1 = element to search for , $2-$n = list
-{
-    local e
-    e=$1
-
-    while [ $# -gt 1 ]; do
-	shift
-	[ "x$e" = "x$1" ] && return 0
-    done
-
-    return 1
-}
-
-if [ $# -eq 0 ]; then
-    echo "Usage: $(basename $0) <XML file> ..."
-    exit 2
-fi
-
-while [ $# -gt 0 ]; do
-
-    case $1 in
-	*.xml)
-	    b=${1%.*}
-            #
-	    # The original HTML documents were created using MS FrontPage and
-	    # used the .htm suffix. The remainder use the .html suffix.
-	    #
-	    if list_search $b.htm $HTMFILES ; then
-		b=$b.htm
-		f="$WEBSITE/$b"
-	    else
-		b=$b.html
-		f="$WEBSITE/$b"
-	    fi
-
-	    list_search $1 $NOTOC && GENTOC="--stringparam generate.toc ''" || GENTOC=
-
-	    case $1 in
-		*_ru.xml)
-		    LANGUAGE="--stringparam l10n.gentext.default.language ru"
-		    ;;
-		*_fr.xml)
-		    LANGUAGE="--stringparam l10n.gentext.default.language fr"
-		    ;;
-		*)
-		    LANGUAGE=
-		    ;;
-	    esac
-
-	    echo "Converting $1 from XML to HTML ($b) ..."
-
-	    if xmllint --valid --noout $1 && xsltproc --output $f --stringparam html.stylesheet html.css --stringparam ulink.target _self $GENTOC $LANGUAGE --param toc.section.depth 3 $STYLESHEET $1 ; then
-		filestocopy="$filestocopy $f"
-	    fi
-	    ;;
-
-	*)
-	    filestocopy="$filestocopy $1"
-	    ;;
-    esac
-
-    shift
-
-done
-
-DESTS="
-webadmin@mail.shorewall.net:/srv/www/html/4.4
-"
-
-if [ -n "$filestocopy" ]; then
-    for f in $filestocopy; do
-	filestoreport="$filestoreport $(basename $f)"
-    done
-
-    chmod 664 $filestocopy
-    for d in $DESTS; do
-	echo "$filestoreport -> $d"
-	scp -qp $filestocopy $d
-    done
-fi
-
-
diff --git a/tools/web/publish-image b/tools/web/publish-image
deleted file mode 100755
index 69038cf5c..000000000
--- a/tools/web/publish-image
+++ /dev/null
@@ -1,7 +0,0 @@
-#!/bin/sh
-
-#	scp $@ teastep@shorewall.sourceforge.net:/home/groups/s/sh/shorewall/htdocs/images
-	scp -p  $@ webadmin@mail.shorewall.net:/srv/www/html/images
-#	cp  -pf $@ /home/teastep/Shorewall-docs
-
-
diff --git a/tools/web/publish-image-3.0 b/tools/web/publish-image-3.0
deleted file mode 100755
index a2e0b2ac1..000000000
--- a/tools/web/publish-image-3.0
+++ /dev/null
@@ -1,7 +0,0 @@
-#!/bin/sh
-
-#	scp $@ teastep@shorewall.sourceforge.net:/home/groups/s/sh/shorewall/htdocs/images
-	scp -p  $@ webadmin@mail:/srv/www/html/3.0/images
-#	cp  -pf $@ /home/teastep/Shorewall-docs
-
-
diff --git a/tools/web/publish-image-4.4 b/tools/web/publish-image-4.4
deleted file mode 100755
index 24eaf9a5f..000000000
--- a/tools/web/publish-image-4.4
+++ /dev/null
@@ -1,7 +0,0 @@
-#!/bin/sh
-
-#	scp $@ teastep@shorewall.sourceforge.net:/home/groups/s/sh/shorewall/htdocs/images
-	scp -p  $@ webadmin@mail.shorewall.net:/srv/www/html/4.4/images
-#	cp  -pf $@ /home/teastep/Shorewall-docs
-
-
diff --git a/tools/web/publish-manpage b/tools/web/publish-manpage
deleted file mode 100755
index 661a68143..000000000
--- a/tools/web/publish-manpage
+++ /dev/null
@@ -1,65 +0,0 @@
-#!/bin/sh
-
-#STYLESHEET=/home/teastep/Shorewall/docbook-xsl-1.62.4//xhtml/docbook.xsl
-STYLESHEET=/usr/share/xml/docbook/stylesheet/nwalsh/current/xhtml/docbook.xsl
-WEBSITE=/home/teastep/Shorewall/Website
-
-list_search() # $1 = element to search for , $2-$n = list
-{
-    local e
-    e=$1
-
-    while [ $# -gt 1 ]; do
-	shift
-	[ "x$e" = "x$1" ] && return 0
-    done
-
-    return 1
-}
-
-if [ $# -eq 0 ]; then
-    echo "Usage: $(basename $0) <XML file> ..."
-    exit 2
-fi
-
-while [ $# -gt 0 ]; do
-
-    case $1 in
-	*.xml)
-	    b=${1%.*}.html
-
-	    f="$WEBSITE/$b"
-
-	    echo "Converting $1 from XML to HTML ($b) ..."
-
-	    if xsltproc --output $f --stringparam html.stylesheet html.css --stringparam ulink.target _self -param toc.section.depth 3 $STYLESHEET $1 ; then
-		filestocopy="$filestocopy $f"
-	    fi
-	    ;;
-
-	*)
-	    filestocopy="$filestocopy $1"
-	    ;;
-    esac
-
-    shift
-
-done
-
-DESTS="
-webadmin@mail.shorewall.net:/srv/www/html/manpages/
-"
-
-if [ -n "$filestocopy" ]; then
-    for f in $filestocopy; do
-	filestoreport="$filestoreport $(basename $f)"
-    done
-
-    chmod 664 $filestocopy
-    for d in $DESTS; do
-	echo "$filestoreport -> $d"
-	scp -qp $filestocopy $d
-    done
-fi
-
-
diff --git a/tools/web/publish-manpage-3.0 b/tools/web/publish-manpage-3.0
deleted file mode 100755
index 2835c394f..000000000
--- a/tools/web/publish-manpage-3.0
+++ /dev/null
@@ -1,65 +0,0 @@
-#!/bin/sh
-
-#STYLESHEET=/home/teastep/Shorewall/docbook-xsl-1.62.4//xhtml/docbook.xsl
-STYLESHEET=/usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl
-WEBSITE=/home/teastep/Shorewall/Website
-
-list_search() # $1 = element to search for , $2-$n = list
-{
-    local e
-    e=$1
-
-    while [ $# -gt 1 ]; do
-	shift
-	[ "x$e" = "x$1" ] && return 0
-    done
-
-    return 1
-}
-
-if [ $# -eq 0 ]; then
-    echo "Usage: $(basename $0) <XML file> ..."
-    exit 2
-fi
-
-while [ $# -gt 0 ]; do
-
-    case $1 in
-	*.xml)
-	    b=${1%.*}.html
-
-	    f="$WEBSITE/$b"
-
-	    echo "Converting $1 from XML to HTML ($b) ..."
-
-	    if xsltproc --output $f --stringparam html.stylesheet html.css --stringparam ulink.target _self -param toc.section.depth 3 $STYLESHEET $1 ; then
-		filestocopy="$filestocopy $f"
-	    fi
-	    ;;
-
-	*)
-	    filestocopy="$filestocopy $1"
-	    ;;
-    esac
-
-    shift
-
-done
-
-DESTS="
-webadmin@mail.shorewall.net:/srv/www/html/3.0/manpages/
-"
-
-if [ -n "$filestocopy" ]; then
-    for f in $filestocopy; do
-	filestoreport="$filestoreport $(basename $f)"
-    done
-
-    chmod 664 $filestocopy
-    for d in $DESTS; do
-	echo "$filestoreport -> $d"
-	scp -qp $filestocopy $d
-    done
-fi
-
-
diff --git a/tools/web/publish-manpage-4.0 b/tools/web/publish-manpage-4.0
deleted file mode 100755
index 28908d4c4..000000000
--- a/tools/web/publish-manpage-4.0
+++ /dev/null
@@ -1,65 +0,0 @@
-#!/bin/sh
-
-#STYLESHEET=/home/teastep/Shorewall/docbook-xsl-1.62.4//xhtml/docbook.xsl
-STYLESHEET=/usr/share/xml/docbook/stylesheet/nwalsh/xhtml/docbook.xsl
-WEBSITE=/home/teastep/Shorewall/Website
-
-list_search() # $1 = element to search for , $2-$n = list
-{
-    local e
-    e=$1
-
-    while [ $# -gt 1 ]; do
-	shift
-	[ "x$e" = "x$1" ] && return 0
-    done
-
-    return 1
-}
-
-if [ $# -eq 0 ]; then
-    echo "Usage: $(basename $0) <XML file> ..."
-    exit 2
-fi
-
-while [ $# -gt 0 ]; do
-
-    case $1 in
-	*.xml)
-	    b=${1%.*}.html
-
-	    f="$WEBSITE/$b"
-
-	    echo "Converting $1 from XML to HTML ($b) ..."
-
-	    if xsltproc --output $f --stringparam html.stylesheet html.css --stringparam ulink.target _self -param toc.section.depth 3 $STYLESHEET $1 ; then
-		filestocopy="$filestocopy $f"
-	    fi
-	    ;;
-
-	*)
-	    filestocopy="$filestocopy $1"
-	    ;;
-    esac
-
-    shift
-
-done
-
-DESTS="
-webadmin@mail.shorewall.net:/srv/www/html/4.0/manpages/
-"
-
-if [ -n "$filestocopy" ]; then
-    for f in $filestocopy; do
-	filestoreport="$filestoreport $(basename $f)"
-    done
-
-    chmod 664 $filestocopy
-    for d in $DESTS; do
-	echo "$filestoreport -> $d"
-	scp -qp $filestocopy $d
-    done
-fi
-
-
diff --git a/tools/web/publish-manpage-4.4 b/tools/web/publish-manpage-4.4
deleted file mode 100755
index 5874b23ea..000000000
--- a/tools/web/publish-manpage-4.4
+++ /dev/null
@@ -1,65 +0,0 @@
-#!/bin/sh
-
-#STYLESHEET=/home/teastep/Shorewall/docbook-xsl-1.62.4//xhtml/docbook.xsl
-STYLESHEET=/usr/share/xml/docbook/stylesheet/nwalsh/current/xhtml/docbook.xsl
-WEBSITE=/home/teastep/Shorewall/Website
-
-list_search() # $1 = element to search for , $2-$n = list
-{
-    local e
-    e=$1
-
-    while [ $# -gt 1 ]; do
-	shift
-	[ "x$e" = "x$1" ] && return 0
-    done
-
-    return 1
-}
-
-if [ $# -eq 0 ]; then
-    echo "Usage: $(basename $0) <XML file> ..."
-    exit 2
-fi
-
-while [ $# -gt 0 ]; do
-
-    case $1 in
-	*.xml)
-	    b=${1%.*}.html
-
-	    f="$WEBSITE/$b"
-
-	    echo "Converting $1 from XML to HTML ($b) ..."
-
-	    if xsltproc --output $f --stringparam html.stylesheet html.css --stringparam ulink.target _self -param toc.section.depth 3 $STYLESHEET $1 ; then
-		filestocopy="$filestocopy $f"
-	    fi
-	    ;;
-
-	*)
-	    filestocopy="$filestocopy $1"
-	    ;;
-    esac
-
-    shift
-
-done
-
-DESTS="
-webadmin@mail.shorewall.net:/srv/www/html/4.4/manpages/
-"
-
-if [ -n "$filestocopy" ]; then
-    for f in $filestocopy; do
-	filestoreport="$filestoreport $(basename $f)"
-    done
-
-    chmod 664 $filestocopy
-    for d in $DESTS; do
-	echo "$filestoreport -> $d"
-	scp -qp $filestocopy $d
-    done
-fi
-
-
diff --git a/tools/web/publish-manpage6 b/tools/web/publish-manpage6
deleted file mode 100755
index 64c1231d1..000000000
--- a/tools/web/publish-manpage6
+++ /dev/null
@@ -1,65 +0,0 @@
-#!/bin/sh
-
-#STYLESHEET=/home/teastep/Shorewall/docbook-xsl-1.62.4//xhtml/docbook.xsl
-STYLESHEET=/usr/share/xml/docbook/stylesheet/nwalsh/current/xhtml/docbook.xsl
-WEBSITE=/home/teastep/Shorewall/Website
-
-list_search() # $1 = element to search for , $2-$n = list
-{
-    local e
-    e=$1
-
-    while [ $# -gt 1 ]; do
-	shift
-	[ "x$e" = "x$1" ] && return 0
-    done
-
-    return 1
-}
-
-if [ $# -eq 0 ]; then
-    echo "Usage: $(basename $0) <XML file> ..."
-    exit 2
-fi
-
-while [ $# -gt 0 ]; do
-
-    case $1 in
-	*.xml)
-	    b=${1%.*}.html
-
-	    f="$WEBSITE/$b"
-
-	    echo "Converting $1 from XML to HTML ($b) ..."
-
-	    if xsltproc --output $f --stringparam html.stylesheet html.css --stringparam ulink.target _self -param toc.section.depth 3 $STYLESHEET $1 ; then
-		filestocopy="$filestocopy $f"
-	    fi
-	    ;;
-
-	*)
-	    filestocopy="$filestocopy $1"
-	    ;;
-    esac
-
-    shift
-
-done
-
-DESTS="
-webadmin@mail.shorewall.net:/srv/www/html/manpages6/
-"
-
-if [ -n "$filestocopy" ]; then
-    for f in $filestocopy; do
-	filestoreport="$filestoreport $(basename $f)"
-    done
-
-    chmod 664 $filestocopy
-    for d in $DESTS; do
-	echo "$filestoreport -> $d"
-	scp -qp $filestocopy $d
-    done
-fi
-
-
diff --git a/tools/web/publish-manpage6-4.4 b/tools/web/publish-manpage6-4.4
deleted file mode 100755
index 1a667ac85..000000000
--- a/tools/web/publish-manpage6-4.4
+++ /dev/null
@@ -1,65 +0,0 @@
-#!/bin/sh
-
-#STYLESHEET=/home/teastep/Shorewall/docbook-xsl-1.62.4//xhtml/docbook.xsl
-STYLESHEET=/usr/share/xml/docbook/stylesheet/nwalsh/current/xhtml/docbook.xsl
-WEBSITE=/home/teastep/Shorewall/Website
-
-list_search() # $1 = element to search for , $2-$n = list
-{
-    local e
-    e=$1
-
-    while [ $# -gt 1 ]; do
-	shift
-	[ "x$e" = "x$1" ] && return 0
-    done
-
-    return 1
-}
-
-if [ $# -eq 0 ]; then
-    echo "Usage: $(basename $0) <XML file> ..."
-    exit 2
-fi
-
-while [ $# -gt 0 ]; do
-
-    case $1 in
-	*.xml)
-	    b=${1%.*}.html
-
-	    f="$WEBSITE/$b"
-
-	    echo "Converting $1 from XML to HTML ($b) ..."
-
-	    if xsltproc --output $f --stringparam html.stylesheet html.css --stringparam ulink.target _self -param toc.section.depth 3 $STYLESHEET $1 ; then
-		filestocopy="$filestocopy $f"
-	    fi
-	    ;;
-
-	*)
-	    filestocopy="$filestocopy $1"
-	    ;;
-    esac
-
-    shift
-
-done
-
-DESTS="
-webadmin@mail.shorewall.net:/srv/www/html/4.4/manpages6/
-"
-
-if [ -n "$filestocopy" ]; then
-    for f in $filestocopy; do
-	filestoreport="$filestoreport $(basename $f)"
-    done
-
-    chmod 664 $filestocopy
-    for d in $DESTS; do
-	echo "$filestoreport -> $d"
-	scp -qp $filestocopy $d
-    done
-fi
-
-
diff --git a/web/Banner.html b/web/Banner.html
deleted file mode 100644
index 547689b4c..000000000
--- a/web/Banner.html
+++ /dev/null
@@ -1,65 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
-<html>
-<head>
-  <meta name="generator"
- content="HTML Tidy for Linux (vers 1st April 2002), see www.w3.org">
-  <meta http-equiv="content-type" content="text/html; charset=UTF-8">
-  <title>Banner</title>
-  <meta name="author" content="Tom Eastep">
-  <base target="_top">
-</head>
-<body>
-<table id="AutoNumber3"
- style="border-collapse: collapse; background-color: rgb(255, 255, 255); width: 100%; height: 90px;"
- cellpadding="0">
-  <tbody>
-    <tr>
-      <td style="text-align: left; width: 34%; vertical-align: top;">
-      <div style="text-align: center;"> </div>
-      <div
- style="background-color: rgb(255, 255, 255); text-align: center;"> <img
- src="images/gareth-davies-logo3.png" alt="(Shorewall Logo)"
- style="width: 430px; height: 90px;" align="middle"> </div>
-      </td>
-      <td style="text-align: right; vertical-align: bottom;"> <br>
-      <table
- style="background-color: rgb(255, 255, 255); text-align: left; margin-left: auto; margin-right: 0px;"
- border="0" cellspacing="0">
-        <tbody>
-          <tr>
-            <td style="text-align: center;">
-            <form method="get" action="http://www.google.com/search"> <input
- name="ie" value="UTF-8" type="hidden"> <input name="oe" value="UTF-8"
- type="hidden"> <input name="as_sitesearch" value="www.shorewall.net"
- type="hidden">
-              <table style="background-color: rgb(255, 255, 255);"
- border="0" cellspacing="0">
-                <tbody>
-                  <tr>
-                    <td style="text-align: center;">&nbsp;<input
- name="q" size="25" maxlength="255" value="" type="text"> <input
- name="btnG" value="Site Search" type="submit"></td>
-                  </tr>
-                  <tr style="">
-                    <td style="background-color: rgb(255, 255, 255);"
- bgcolor="#3366ff">
-                    <p style="text-align: center; font-weight: bold;"><br>
-                    <a
- href="http://dir.gmane.org/gmane.comp.security.shorewall">Mailing
-List Archive Search</a></p>
-                    </td>
-                  </tr>
-                </tbody>
-              </table>
-            </form>
-            </td>
-          </tr>
-        </tbody>
-      </table>
-      <br>
-      </td>
-    </tr>
-  </tbody>
-</table>
-</body>
-</html>
diff --git a/web/Documentation.html b/web/Documentation.html
deleted file mode 100755
index fe5598a60..000000000
--- a/web/Documentation.html
+++ /dev/null
@@ -1,125 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
-<html>
-<head>
-  <meta http-equiv="content-type" content="text/html; charset=UTF-8">
-  <title>Shorewall Documentation</title>
-</head>
-<body>
-<h1 style="text-align: left;">Shorewall Documentation</h1>
-<span style="font-weight: bold;"></span>
-<span style="font-weight: bold;"></span>Copyright © 2005-2009 Thomas M.
-Eastep<br>
-<p>Permission is granted to copy, distribute and/or modify this
-document
-under the terms of the GNU Free Documentation License, Version 1.2 or
-any
-later version published by the Free Software Foundation; with no
-Invariant
-Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of
-the
-license is included in the section entitled “<span class="quote"><a
- href="GnuCopyright.htm" target="_self">GNU Free Documentation
-License</a></span>”.<br>
-</p>
-<p>2009-08-22<br>
-</p>
-<hr style="width: 100%; height: 2px;"> <strong></strong>
-<br>
-<table style="text-align: left; width: 100%;" border="0" cellpadding="2"
- cellspacing="0">
-  <tbody>
-    <tr style="font-weight: bold;">
-      <td style="vertical-align: top; text-align: center;">Shorewall
-4.4<br>
-(Stable)<br>
-      </td>
-      <th style="vertical-align: top; text-align: center;">Shorewall
-4.2<br>
-(Previous Stable)<br>
-      </th>
-      <th style="vertical-align: top; text-align: center;">Shorewall
-4.0<br>
-(Debian Lenny)<br>
-Note: 1<br>
-      </th>
-      <th style="vertical-align: top; text-align: center;">Shorewall
-3.x<br>
-(Obsolete)<br>
-      </th>
-      <th style="vertical-align: top; text-align: left;">Description<br>
-      </th>
-    </tr>
-    <tr>
-      <td style="vertical-align: top; text-align: center;"><a
- style="font-weight: bold;" href="4.4/Documentation_Index.html">Index</a></td>
-      <td style="vertical-align: top; text-align: center;"><span
- style="font-weight: bold;"></span><strong><a
- href="Documentation_Index.html"><strong>Index</strong></a></strong></td>
-      <td style="vertical-align: top; text-align: center;"><strong><a
- href="Documentation_Index.html"><strong>Index</strong></a></strong></td>
-      <td style="vertical-align: top; text-align: center;"><a
- style="font-weight: bold;" href="3.0/Documentation_Index.html">Index</a></td>
-      <td style="vertical-align: top;">Alphabetical index to over 70
-articles with
-topics ranging from Accounting to Xen</td>
-    </tr>
-    <tr>
-      <td style="vertical-align: top; text-align: center;"><strong></strong><strong><strong><a
- href="4.4/FAQ.htm"><strong>FAQs</strong></a></strong></strong></td>
-      <td
- style="vertical-align: top; text-align: center; font-weight: bold;"><a
- href="3.0/FAQ.htm"><strong></strong></a><strong><a href="FAQ.htm"><strong>FAQs</strong></a></strong></td>
-      <td style="vertical-align: top; text-align: center;"><a
- href="FAQ.htm"><strong>FAQs</strong></a> </td>
-      <td
- style="vertical-align: top; text-align: center; font-weight: bold;"><a
- href="3.0/FAQ.htm">FAQs</a> </td>
-      <td style="vertical-align: top;">Answers to the most commonly
-asked
-questions</td>
-    </tr>
-    <tr>
-      <td style="vertical-align: top; text-align: center;"><strong><strong></strong></strong><strong><strong><strong><a
- href="4.4/Manpages.html"><strong>IPv4 Manpages</strong></a></strong></strong></strong></td>
-      <td style="vertical-align: top; text-align: center;"><a
- href="3.0/manpages/Manpages.html"><span style="font-weight: bold;"></span></a><strong></strong><strong><strong><a
- href="Manpages.html"><strong>IPv4 Manpages</strong></a></strong></strong>
-      </td>
-      <td
- style="vertical-align: top; text-align: center; font-weight: bold;"><a
- href="../../../../../4.0/Manpages.html">Manpages</a></td>
-      <td style="vertical-align: top; text-align: center;"><a
- href="3.0/manpages/Manpages.html"><span style="font-weight: bold;">Manpages</span></a></td>
-      <td style="vertical-align: top;">Online version of the Shorewall
-and Shorewall-lite man pages</td>
-    </tr>
-    <tr>
-      <td style="vertical-align: top; text-align: center;"> <a
- href="4.4/Manpages6.html"><span style="font-weight: bold;">IPv6
-Manpages</span></a></td>
-      <td style="vertical-align: top; text-align: center;"><a
- href="Manpages6.html"><span style="font-weight: bold;">IPv6 Manpages</span></a>
-      </td>
-      <td style="vertical-align: top; text-align: center;">-<br>
-      </td>
-      <td style="vertical-align: top; text-align: center;">-<span
- style="font-weight: bold;"><br>
-      </span></td>
-      <td style="vertical-align: top;">Online version of the Shorewall6
-and Shorewall6-lite man pages<br>
-      </td>
-    </tr>
-  </tbody>
-</table>
-<br>
-<span style="font-weight: bold;">Note 1</span>: Shorewall 4.2 packages
-for Lenny are available from <a
- href="http://people.connexer.com/%7Eroberto/debian/">Roberto Sanchez's
-repository</a>. Roberto is the Debian Shorewall maintainer.<br>
-<br>
-<a href="3.0/manpages/Manpages.html"><span style="font-weight: bold;"></span></a><br>
-<a href="Documentation_Index.html"><strong></strong></a>
-<ul>
-</ul>
-</body>
-</html>
diff --git a/web/Manpages.html b/web/Manpages.html
deleted file mode 100644
index ccc8a3bec..000000000
--- a/web/Manpages.html
+++ /dev/null
@@ -1,74 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
-<html>
-<head>
-  <meta name="generator"
- content="HTML Tidy for Linux (vers 1st April 2002), see www.w3.org">
-  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
-  <title>Shorewall 3.4 Manpages</title>
-</head>
-<body>
-<h1 style="text-align: left;">Shorewall 3.4 Manpages<br>
-</h1>
-<span style="font-weight: bold;">Tom Eastep<br>
-<br>
-</span>Copyright © 2006-2007 Thomas M. Eastep<br>
-<p>Permission is granted to copy, distribute and/or modify this
-document under the terms of the GNU Free Documentation License, Version
-1.2 or any later version published by the Free Software Foundation;
-with no Invariant Sections, with no Front-Cover, and with no Back-Cover
-Texts. A copy of the license is included in the section entitled “<span
- class="quote"><a href="GnuCopyright.htm" target="_self">GNU Free
-Documentation License</a></span>”.<br>
-</p>
-<p>2007-01-18<br>
-</p>
-<hr style="width: 100%; height: 2px;"> <span style="font-weight: bold;">Warning:
-</span>These manpages are for Shorewall 3.4.0 only. They describe
-features and options not available on earlier releases.<br>
-<br>
-<span style="font-weight: bold;">Note:</span> The docbook to manpage
-translation tool that we are using has some indentation issues which
-require us to choose between correct output of the <span
- style="font-weight: bold;">man</span> command and correctly-indented
-HTML. We've chosen in favor of the <span style="font-weight: bold;">man</span>
-command so some of the manpages accessed through the links below have
-indentation problems. We're working to resolve these issues and ask for
-your patience.<br>
-<h2>Section 5 - Files and Concepts<br>
-</h2>
-<div style="margin-left: 40px;"><a href="shorewall-accounting.html">accounting</a><br>
-<a href="shorewall-actions.html">actions</a><br>
-<a href="shorewall-blacklist.html">blacklist</a><br>
-<a href="shorewall-ecn.html">ecn</a><br>
-<a href="shorewall-exclusion.html">exclusion</a><br>
-<a href="shorewall-hosts.html">hosts</a><br>
-<a href="shorewall-interfaces.html">interfaces</a><br>
-<a href="shorewall-maclist.html">maclist</a><br>
-<a href="shorewall-masq.html">masq</a><br>
-<a href="shorewall-nat.html">nat</a><br>
-<a href="shorewall-nesting.html">nesting</a><br>
-<a href="shorewall-netmap.html">netmap</a><br>
-<a href="shorewall-params.html">params</a><br>
-<a href="shorewall-policy.html">policy</a><br>
-<a href="shorewall-providers.html">providers</a><br>
-<a href="shorewall-proxyarp.html">proxyarp</a><br>
-<a href="shorewall-rfc1918.html">rfc1918</a><br>
-<a href="shorewall-route_rules.html">route_rules</a><br>
-<a href="shorewall-routestopped.html">routestopped</a><br>
-<a href="shorewall-rules.html">rules</a><br>
-<a href="shorewall-tcclasses.html">tcclasses</a><br>
-<a href="shorewall-tcdevices.html">tcdevices</a><br>
-<a href="shorewall-tcrules.html">tcrules</a><br>
-<a href="shorewall-tos.html">tos</a><br>
-<a href="shorewall-tunnels.html">tunnels</a><br>
-<a href="shorewall.conf.html">shorewall.conf</a><br>
-<a href="shorewall-lite.conf.html">shorewall-lite.conf</a><br>
-<a href="shorewall-zones.html">zones</a><br>
-</div>
-<h2>Section 8 - Administrative Commands<br>
-</h2>
-<div style="margin-left: 40px;"><a href="shorewall.html">shorewall</a><br>
-<a href="shorewall-lite.html">shorewall-lite</a><br>
-</div>
-</body>
-</html>
diff --git a/web/Manpages6.html b/web/Manpages6.html
deleted file mode 100644
index 0ceeb1aa3..000000000
--- a/web/Manpages6.html
+++ /dev/null
@@ -1,69 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
-<html>
-<head>
-  <meta name="generator"
- content="HTML Tidy for Linux (vers 1st April 2002), see www.w3.org">
-  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
-  <title>Shorewall 4.3 IPv6 Manpages</title>
-</head>
-<body>
-<h1 style="text-align: left;">Shorewall6 4.3 Manpages<br>
-</h1>
-<span style="font-weight: bold;">Tom Eastep<br>
-<br>
-</span>Copyright © 2008 Thomas M. Eastep<br>
-<p>Permission is granted to copy, distribute and/or modify this
-document under the terms of the GNU Free Documentation License, Version
-1.2 or any later version published by the Free Software Foundation;
-with no Invariant Sections, with no Front-Cover, and with no Back-Cover
-Texts. A copy of the license is included in the section entitled “<span
- class="quote"><a href="GnuCopyright.htm" target="_self">GNU Free
-Documentation License</a></span>”.<br>
-</p>
-<p>2008-12-16<br>
-</p>
-<hr style="width: 100%; height: 2px;"> <span style="font-weight: bold;">Warning:
-</span>These manpages are for Shorewall 3.4.0 only. They describe
-features and options not available on earlier releases.<br>
-<br>
-<span style="font-weight: bold;">Note:</span> The docbook to manpage
-translation tool that we are using has some indentation issues which
-require us to choose between correct output of the <span
- style="font-weight: bold;">man</span> command and correctly-indented
-HTML. We've chosen in favor of the <span style="font-weight: bold;">man</span>
-command so some of the manpages accessed through the links below have
-indentation problems. We're working to resolve these issues and ask for
-your patience.<br>
-<h2>Section 5 - Files and Concepts<br>
-</h2>
-<div style="margin-left: 40px;"><a href="shorewall6-accounting.html">accounting</a><br>
-<a href="shorewall6-actions.html">actions</a><br>
-<a href="shorewall6-blacklist.html">blacklist</a><br>
-<a href="shorewall6-exclusion.html">exclusion</a><br>
-<a href="shorewall6-hosts.html">hosts</a><br>
-<a href="shorewall6-interfaces.html">interfaces</a><br>
-<a href="shorewall6-maclist.html">maclist</a><a
- href="shorewall6-masq.html"></a><br>
-<a href="shorewall6-nesting.html">nesting</a><br>
-<a href="shorewall6-params.html">params</a><br>
-<a href="shorewall6-policy.html">policy</a><br>
-<a href="shorewall6-providers.html">providers</a><br>
-<a href="shorewall6-route_rules.html">route_rules</a><br>
-<a href="shorewall6-routestopped.html">routestopped</a><br>
-<a href="shorewall6-rules.html">rules</a><br>
-<a href="shorewall6-tcclasses.html">tcclasses</a><br>
-<a href="shorewall6-tcdevices.html">tcdevices</a><br>
-<a href="shorewall6-tcrules.html">tcrules</a><br>
-<a href="shorewall6-tos.html">tos</a><br>
-<a href="shorewall6-tunnels.html">tunnels</a><br>
-<a href="shorewall6.conf.html">shorewall6.conf</a><br>
-<a href="shorewall6-lite.conf.html">shorewall6-lite.conf</a><br>
-<a href="shorewall6-zones.html">zones</a><br>
-</div>
-<h2>Section 8 - Administrative Commands<br>
-</h2>
-<div style="margin-left: 40px;"><a href="shorewall6.html">shorewall6</a><br>
-<a href="shorewall6-lite.html">shorewall6-lite</a><br>
-</div>
-</body>
-</html>
diff --git a/web/News.htm b/web/News.htm
deleted file mode 100644
index d17e11ccf..000000000
--- a/web/News.htm
+++ /dev/null
@@ -1,284 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
-  <meta name="revised" content="$Id$">
-  <title>Shorewall News</title>
-</head>
-<body>
-<h1 style="text-align: left;">Shorewall News and Announcements<br>
-</h1>
-<p><span style="font-weight: bold;">
-</span>Copyright © 2001-2009 Thomas M. Eastep</p>
-<p>Permission is granted to copy, distribute and/or modify this
-document
-under the terms of the GNU Free Documentation License, Version 1.2 or
-any
-later version published by the Free Software Foundation; with no
-Invariant
-Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of
-the
-license is included in the section entitled <span
- style="text-decoration: underline;">"</span><span class="quote"><a
- href="GnuCopyright.htm" target="_self">GNU Free Documentation
-License</a></span>".
-</p>
-<p>August 03, 2009<br>
-</p>
-<hr style="width: 100%; height: 2px;">
-<p><strong>2009-08-02 Shorewall 4.4.0 RC 2<br>
-</strong></p>
-<pre>Read the details at <a
- href="http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-RC2/releasenotes.txt">http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-RC2/releasenotes.txt</a></pre>
-<p><strong>2009-07-26 Shorewall 4.4.0 RC 1<br>
-</strong></p>
-<pre>Read the details at <a
- href="http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-RC1/releasenotes.txt">http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-RC1/releasenotes.txt</a></pre>
-<p><strong>2009-07-12 Shorewall 4.4.0 Beta 4<br>
-</strong></p>
-<pre>Read the details at <a
- href="http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-Beta4/releasenotes.txt">http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-Beta4/releasenotes.txt</a><br><strong></strong></pre>
-<strong></strong>
-<strong></strong>
-<p><strong>2009-06-29 Shorewall 4.4.0 Beta 3<br>
-</strong></p>
-<pre>Read the details at <a
- href="http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-Beta3/releasenotes.txt">http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-Beta3/releasenotes.txt</a><br><strong></strong></pre>
-<strong></strong>
-<p><strong>2009-06-21 Shorewall 4.4.0 Beta 2<br>
-</strong></p>
-<pre>Read the details at <a
- href="http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-Beta2/releasenotes.txt">http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-Beta2/releasenotes.txt</a><br><strong></strong></pre>
-<strong></strong>
-<p><span style="font-weight: bold;">2009-06-18 Shorewall 4.2.10<br>
-</span><span style="font-weight: bold;"></span></p>
-<pre>Problems corrected in Shorewall 4.2.10<br><br>1)  A 'large quantum' warning log message during restart has been<br>    eliminated. The log message occurred when an interface with a large<br>    OUT-BANDWIDTH was defined in /etc/shorewall/tcdevices.<br><br>2)  When a REJECT rule included a log entry, the disposition in the log<br>    message was incorrectly shown as 'reject' rather than 'REJECT'.<br><br>3)  When 'forward' was specified on one or more interfaces in<br>    /etc/shorewall6/interfaces, the progress message "Compiling<br>    Interface forwarding..." was issued multiple times. Now, only one<br>    instance of the message is generated.<br><br>4)  A typing error in the IPv6 two-interface sample shorewall6.conf<br>    file has been corrected. This error prevented the compiler from<br>    being able to find macros in /usr/share/shorewall/.<br><br>Known Problems Remaining:<br><br>1)  When exclusion is used in an entry in /etc/shorewall/hosts, then<br>    Shorewall-shell produces an invalid iptables rule if any of the <br>    following OPTIONS are also specified in the entry:    <br><br>        blacklist<br>        maclist<br>        norfc1918<br>        tcpflags<br><br>2)  Shorewall-shell generates inversion rules which produce<br>    warnings with iptables 1.4.3.  <br><br>    Example:<br><br>        iptables -A  lan2fw  -p 6  --dport 999  -s ! 192.168.20.1  -j ACCEPT<br><br>    with iptables 1.4.3.1 the following information message is produced:<br><br>    Using intrapositioned negation (`--option ! this`) is deprecated in<br>    favor of extrapositioned (`! --option this`).<br><br>    We don't intend to fix this. It's time to migrate to Shorewall-perl<br>    anyway.<br><br>New Features in Shorewall 4.2.10<br><br>1)  Shorewall's suppport for dynamic gateways on interfaces managed by<br>    dhclient works on OpenSuSE systems but not on some other<br>    distributions.<br><br>    In order to generalize support for learning the gateway for dynamic<br>    interfaces, a new 'findgw' extension script (user exit) has been<br>    added.<br><br>    The exit will be invoked in a function that has a single argument:<br><br>        $1 = &lt;name of an interface&gt;<br><br>    If the function can determine the gateway for the passed interface,<br>    it should write the gateway to standard out. Here is a sample<br>    /etc/shorewall/findgw that works with dhclient (dhcp3) in Debian<br>    Lenny:<br><br>    if [ -f /var/lib/dhcp3/dhclient.${1}.leases ]; then<br>       grep 'option routers' /var/lib/dhcp3/dhclient.${1}.leases |\<br>          tail -n 1 |\<br>          while read j1 j2 gateway; do\<br>              echo $gateway | sed 's/;//';\<br>          done<br>    fi<br><br>    The same code works on Ubuntu Jaunty if you replace the first '.'<br>    with '-' and replace '.leases' with '.lease' (don't you just love<br>    the consistency between distributions?).<br><br>    That code also works on CentOS if you replace 'dhcp3' by<br>    'dhclient'.<br><br>    'findgw' files that have been customized for various distributions<br>    may be found at<br>    http://www.shorewall.net/pub/shorewall/contrib/findgw.<br></pre>
-<p><strong></strong></p>
-<p><strong>2009-06-13 Shorewall 4.4.0 Beta 1</strong></p>
-<pre>Read the details at <a
- href="http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-Beta1/releasenotes.txt">http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-Beta1/releasenotes.txt</a><br><strong></strong></pre>
-<p><strong>2009-05-14 Shorewall 4.2.9</strong></p>
-<p><strong></strong></p>
-<pre>Problems corrected in Shorewall 4.2.9<br><br>1)  The Shorweall-perl 4.2.8 compiler did not rename the output script<br>    file with the result that:<br><br>     a) Shorewall would not start for the first time after<br>        installation.<br>     b) Configuration changes were apparently ignored.<br><br>2)   Placing a broadcast address in the BROADCAST column of<br>    /etc/shorewall/interfaces caused Shorewall-perl to generate an<br>    error:<br><br>        ERROR: Invalid BROADCAST address : /etc/shorewall/interfaces\<br>                 (line 225)<br><br>3)  When Shorewall could not determine the MAC address of of a gateway<br>    router where multiple providers are configured through the same<br>    interface, invalid iptables-restore input was generated. This<br>    resulted in an error message similar to the following:<br><br>        iptables-restore v1.3.5: Bad mac address `-j'<br><br>4)  Shorewall-perl was not processing the tcrules file when<br>    TC_ENABLED=No.<br><br>5)  When 'all' appeared in the SOURCE column of a DNAT rule, no rule to<br>    redirect output from the firewall itself was generated.<br>    <br>6)  The 'shorewall iprange' command failed to produce a minimal list of<br>    networks.<br><br>New Features in Shorewall 4.2.9<br><br>1)  Shorewall6 has now been validated on Ubuntu Hardy running kernel<br>    2.6.24. Shorewall6 is now supported on that kernel version.<br></pre>
-<p><strong>2009-04-16 Shorewall 4.2.8<br>
-</strong></p>
-<p><strong></strong></p>
-<pre>Problems Corrected in Shorewall 4.2.8<br><br>1)  The 'start -f' command would previously skip the compilation step<br>    unconditionally when the 'make' utility was not installed. Now, the<br>    compilation step is run unconditionally in this case.<br><br>2)  When ADD_IP_ALIASES=Yes in shorewall.conf, entries in<br>    /etc/shorewall/nat produce this failure at compile time when<br>    using Shorewall-perl:<br><br>    ERROR: Internal Error in emit : /etc/shorewall/nat (line 12)<br><br>3)  When LOG_MARTIANS=Yes with Shorewall-perl, setting logmartians=0 in<br>    an entry in /etc/shorewall/interface failed to suppress martian<br>    logging on the interface.<br><br>4)  Shorewall-perl now generates rules with inversion that are<br>    compatible with iptables 1.4.3.<br><br>5) When a network address was specified in the SOURCE or DEST column of<br>   /etc/shorewall/tcfilters, Shorewall-perl was generating an incorrect<br>   netmask.<br><br>New Features in 4.2.8<br><br>1)  The /usr/share/shorewall/modules and /usr/share/shorewall6/modules<br>    files have been updated for iptables 1.4.3/kernel 2.6.29.<br></pre>
-<p><strong>2009-03-19 Shorewall 4.2.7</strong></p>
-<p><strong></strong></p>
-<pre>Problems corrected in 4.2.7<br><br>1)  Previously, the 'start' command set the permission flags on<br>    /var/lib/shorewall*/state so that it could be read by<br>    non-root users while the 'stop' command set the permissions such<br>    that the file could not be read by those users.<br><br>    Beginning with 4.2.7, both commands will secure the file for<br>    root-only access. If you want the file to be world-readable, then<br>    add <br><br>        chmod 744 &lt;file name&gt;<br><br>    To your /etc/shorewall/started, /etc/shorewall/stopped and<br>    /etc/shorewall/restored files.<br><br>2)  The 'shorewall6 dump' command now correctly displays the installed<br>    version of Shorewall-perl. It also displays the IPv6 neighbor table<br>    contents rather than the ARP table contents.<br><br>3)  Under some circumstances, interface options like nosmurfs and<br>    tcpflags would not be applied to forwarded traffic when using<br>    Shorewall-perl.<br><br>4)  The following rule was badly mis-handled:<br><br>       DNAT-    loc     net:1.2.3.4:2525        tcp     25<br><br>    The result:<br><br>     WARNING: Destination zone (1.2.3.4) ignored : /etc/shorewall/rules (line 459)<br>     Can't call method "inet_htoa" without a package or object reference at<br>       /usr/share/shorewall-perl/Shorewall/IPAddrs.pm line 150,<br>      &lt;$currentfile&gt; line 459.<br><br>5)  Previously, OPTIONS were not allowed with a bridge port in<br>    /etc/shorewall/interfaces. That oversight has been corrected and<br>    now the following OPTIONS are allowed:<br><br>        blacklist<br>        maclist<br>        norfc1918<br>        nosmurfs<br>        routeback<br>        tcpflags<br><br>6)  Tuomo Soini provided a workaround patch for a problem seen in some<br>    kernel's (see FAQ 82) that caused 'shorewall start' to fail when<br>    USE_DEFAULT_RT=Yes .<br><br>New Features in Shorewall 4.2.7<br><br>1)  Prior to Shorewall version 3.0.0, rules generated by<br>    /etc/shorewall/tunnels were traversed before those generated by<br>    /etc/shorewall/rules. When SECTIONs were added to the rules file in<br>    3.0.0, traversal of the tunnel rules was deferred until after those<br>    generated by the NEW section of the rules file. <br><br>    Beginning with Shorewall-perl 4.2.7, the tunnel rules are back<br>    where they started -- right before the first rule generated by the<br>    NEW section of /etc/shorewall/rules.<br><br>2)  To allow bypassing of connection tracking for certain traffic,<br>    /etc/shorewall/notrack and /etc/shorewall6/notrack files have been<br>    added.<br><br>    Columns in the file are:<br><br>        SOURCE - &lt;zone&gt;[:&lt;interface&gt;][:&lt;address list&gt;]<br><br>        DEST - [&lt;address list&gt;]<br><br>        PROTO - &lt;protocol name or number&gt;<br><br>        DEST PORT(S) - &lt;port number list&gt;<br><br>        SOURCE PORT(S) - &lt;port number list&gt;<br><br>        USER/GROUP - [&lt;user&gt;][:&lt;group&gt;]<br><br>            May only be specified if the SOURCE &lt;zone&gt; is $FW.<br><br>    Traffic that matches all given criteria will not be subject to<br>    connection tracking. For such traffic, your policies and/or rules<br>    must deal with ALL of the packets involved, in both the original<br>    and the opposite directions. All untracked traffic is passed<br>    through the relevant rules in the NEW section of the rules<br>    file. Untracked encapsulated tunnel traffic can be handled by<br>    entries in /etc/shorewall/tunnels just like tracked traffic<br>    is. Because every packet of an untracked connection must pass<br>    through the NEW section rules, it is suggested that rules that deal<br>    with untracked traffic should appear at the top of the file.<br><br>    Example:<br><br>    /etc/shorewall/tunnels:<br><br>        #TYPE   ZONE    GATEWAY<br>        6to4    net<br><br>    /etc/shorewall/notrack<br><br>        #SOURCE          DEST           PROTO   DEST    SOURCE  USER/<br>        #                                       PORT(S) PORT(S) GROUP<br>        net:!192.88.99.1 -              41<br><br>    Given that 192.88.99.1 is an anycast address, many hosts can<br>    respond to outward traffic to that address. The entry in<br>    /etc/shorewall/tunnels allows protocol 41 net&lt;-&gt;fw. The entry in<br>    /etc/shorewall/notrack prevents the inbound traffic from creating<br>    additional useless conntrack entries.<br><br>    As part of this change, the 'show' command is enhanced to support a <br>    'show raw' command that is an alias for 'show -t raw'. The raw<br>    table is where NOTRACK rules are created. The dump command is also<br>    enhanced to display the contents of the raw table.<br><br>3)  Shorewall-perl supports three additional columns in the<br>    /etc/shorewall/routestopped file:<br><br>    PROTO          -- Protocol name or number<br><br>    DEST PORT(S)   -- comma-separated list of service names and/or port<br>                      numbers<br> <br>    SOURCE PORT(S) -- comma-separated list of service names and/or port<br>                      numbers.<br><br>    These columns are only meaningful when the "-f" option to<br>    'shorewall stop' is used.<br><br>    As part of this change, the "-f" option to the 'stop' and 'clear'<br>    commands is now the default when FAST_STOP=Yes in shorewall.conf.<br>    To override this default, use the "-s" option:<br><br>        shorewall stop -s<br><br>    Note that if you have entries with one or more of the new columns,<br>    the -s option will result in warning messages.<br><br>        gateway:~ # shorewall stop -s<br>        Stopping Shorewall...<br>          WARNING: Unknown routestopped option ignored: notrack<br>          WARNING: Unknown routestopped option ignored: 41<br>          WARNING: Unknown routestopped option ignored: notrack<br>          WARNING: Unknown routestopped option ignored: 41<br>        done.<br>        gateway:~ #<br><br>4)  Shorewall-perl now handles SOURCE PORT lists of more than 15<br>    entries by breaking the containing rule into multiple rules.<br></pre>
-<p><strong>2009-02-15 Shorewall 4.2.6</strong></p>
-<pre>Problems corrected in 4.2.6<br><br>1)  The CONFIG_PATH in the two- and three-interface Shorewall6 sample<br>    configurations was incorrect with the result that this error<br>    occurred on 'shorewall6 check' or 'shorewall6 start'.<br><br>           ERROR: No IP zones defined<br><br>2)  Setting TCP_FLAGS_DISPOSITION=REJECT caused both Shorewall-shell<br>    and Shorewall-perl to create invalid iptables commands. This has<br>    been corrected but we still strongly recommend against that<br>    setting; TCP_FLAGS_DISPOSITION=DROP is preferred.<br><br>3)  Shorewall-perl was generating code that checked for state match<br>    before kernel modules were loaded. This caused start/restart to<br>    fail on systems without kernel module loading. <br><br>4)  The Shorewall6 and Shorewall6-lite Makefiles were incorrect.<br><br>5)  If a service name is used in a port-mapping rule (a DNAT or<br>    REDIRECT rule that changes the destination port), and if the<br>    kernel and iptables include Extended Connection Match support, then<br>    invalid iptables-restore input is produced by Shorewall-perl.<br><br>6)  If iptables 1.4.1 or later was installed, Shorewall-perl generated<br>    incorrect iptables-restore input if exclusion was used in the<br>    ORIGINAL DEST field of a DNAT or REDIRECT rule.<br><br>7)  On kernels earlier than 2.6.20, the 'shorewall show connections'<br>    command fails.<br><br>New Feature in Shorewall 4.2.6<br><br>1)  A BitTorrent32 macro has been added. This macro matches the<br>    extended TCP port range used by BitTorrent 3.2 and later.<br><br>2)  A new COUNT action has been added to Shorewall-perl. This action<br>    creates an iptables (ip6tables) rule with no target. Connections<br>    matching such a rule are simply counted and the packet is passed on<br>    to the next rule.<br><br>    Shorewall-shell ignores COUNT in actions and macros, thus allowing<br>    the standard actions (action.Drop and action.Reject) to have a<br>    COUNT rule as their first entry.<br><br>3)  A new RESTORE_DEFAULT_ROUTE option has been added to<br>    shorewall.conf. It is used to determine whether to restore the<br>    default route saved when there are 'balance' providers defined but<br>    all of them are down.<br><br>    The default is RESTORE_DEFAULT_ROUTE=Yes which preserves the<br>    pre-4.2.6 behavior. <br><br>    RESTORE_DEFAULT_ROUTE=No is appropriate when you don't want a<br>    default route in the main table (USE_DEFAULT_RT=No) or in the<br>    default table (USE_DEFAULT_RT=Yes) when there are no balance<br>    providers available. In that case, RESTORE_DEFAULT_ROUTE=No<br>    will cause any default route in the relevant table to be deleted.<br><br>4)  IPv4 firewall scripts produced by Shorewall-perl now use dhcpcd's<br>    database when trying to detect the gateway for an interface<br>    ("detect" in the GATEAWAY column in /etc/shorewall/interfaces).<br><br>    As part of this change, it is now permitted to specify 'detect'<br>    when USE_DEFAULT_RT=Yes; in that case, the script will only detect<br>    gateways for point-to-point devices and for devices configured by<br>    dhcpcd.<br><br>5)  Shorewall-perl now supports port inversion. A port number or list<br>    of port numbers may be preceded by '!" which will cause the rule to<br>    match all ports EXCEPT those listed:<br><br>    Example: To blacklist 206.124.146.176 for all tcp ports except 80:<br><br>             ADDRESS/SUBNET       PROTO           PORT(S)<br>             206.124.146.177      tcp             !80<br><br>6)  Shorewall-perl now supports protocol inversion. A protocol name or<br>    number may be preceded by '!' to specify all protocols except the<br>    one following '!'.<br><br>    Example: To blacklist 206.124.146.176 for all protocols except <br>             UDP:<br><br>             ADDRESS/SUBNET       PROTO           PORT(S)<br>             206.124.146.177      !udp<br><br>    Note that ports may not be specified when protocol inversion<br>    is used.<br><br>7)  When using Shorewall-perl, neither the 'start' nor 'started'<br>    extension script is run during processing of the 'restore'<br>    command. To allow extension of that command, we have added a<br>    'restored' extension script that runs at the successful completion<br>    of 'restore'. This script is only available with Shorewall-perl.<br><br>    With Shorewall-shell, both scripts are run during 'restore' but in<br>    that case, the run_iptables() function does nothing. So any<br>    run_iptables() calls in the 'start' script are effectively ignored.<br><br>8)  Shorewall-perl now correctly handles 'here documents' quoting<br>    (&lt;&lt;EOF .... EOF) in run-time extension scripts.<br><strong></strong></pre>
-<p><strong></strong><strong>2009-01-22 Shorewall 4.2.5</strong><br>
-</p>
-<p><strong></strong></p>
-<pre>Problems corrected in 4.2.5<br><br>1)  If exclusion is used to define a zone in /etc/shorewall/hosts and<br>    that zone is used as the SOURCE zone in a DNAT or REDIRECT rule,<br>    then Shorewall-perl can generate invalid iptables-restore input.<br><br>2)  A bug in the Perl Cwd module (see<br>    <a
- class="moz-txt-link-freetext"
- href="http://rt.cpan.org/Public/Bug/Display.html?id=13851">http://rt.cpan.org/Public/Bug/Display.html?id=13851</a>) causes the<br>    Shorewall-perl compiler to fail if it doesn't have at least read<br>    access to its current working directory. 4.2.5 contains a<br>    workaround.<br><br>3)  If 'critical' was specified on an entry in<br>    /etc/shorewall6/routestopped, Shorewall6 (Shorewall-perl) would<br>    generate an error.<br><br>4)  In certain cases where exclusion occurred in /etc/shorewall/hosts,<br>    Shorewall-perl would generate incorrect iptables-restore input.<br><br>5)  In certain cases where exclusion occurred in /etc/shorewall/hosts,<br>    Shorewall-perl would generate invalid iptables-restore input.<br><br>6)  The 'shorewall6 refresh' command runs iptables_restore rather than<br>    ip6tables_restore.<br><br>7)  The commands 'shorewall6 save-start', 'shorewall6-save-restart' and<br>    'shorewall6 restore' were previously broken.<br><br>8)  The Debian init script was checking $startup in<br>    /etc/default/shorewall rather than in /etc/default/shorweall6<br><br>9)  The Archlinux init scripts for Shorewall6 and Shorewall6 Lite were<br>    unconverted Shorewall scripts.<br><br>10) When 'detect' is used in the GATEWAY column of<br>    /etc/shorewall/providers, Shorewall-perl now ensures that the<br>    gateway was successfully detected. If the gateway cannot be<br>    detected, action is taken depending on whether the provider is<br>    'optional' or not. If the provider is optional, it's configuration<br>    is skipped; if the provider is not optional, the current operation<br>    is aborted.<br><br>11) The command 'shorewall6 debug start' would previously fail with<br>        ERROR: Command "/sbin/ip6tables -t nat -F" Failed<br><br>12) Both ipv4 and ipv6 compiled programs attempt to run the tcclear<br>    script itself at run time rather than running the copy of the<br>    file in the compiled script. This usually isn't noticable unless<br>    you are running Shorewall Lite or Shorewall6 Lite in which case,<br>    the script doesn't get run (since it is on the administrative<br>    system and not the firewall system).<br><br>13) If your iptables/kernel included "Extended Connection Tracking<br>    Match support" (see the output of "shorewall show capabilities"),<br>    then a REDIRECT rule that specified a port list or range would<br>    cause Shorewall-perl to create invalid iptables-restore input:<br><br>    Running /usr/sbin/iptables-restore...<br>    iptables-restore v1.4.2-rc1: conntrack: Bad value for<br>       "--ctorigdstport" option: "1025:65535"<br>       Error occurred at line: 191<br>       Try `iptables-restore -h' or 'iptables-restore --help' for more information.<br>      ERROR: iptables-restore Failed. Input is in <i
- class="moz-txt-slash"><span class="moz-txt-tag">/</span>var/lib/shorewall<span
- class="moz-txt-tag">/</span></i>.iptables-restore-input<br><br>Known Problems Remaiining:<br><br>1)  When exclusion is used in an entry in /etc/shorewall/hosts, then<br>    Shorewall-shell produces an invalid iptables rule if any of the<br>    following OPTIONS are also specified in the entry:<br><br>        blacklist<br>        maclist<br>        norfc1918<br>        tcpflags<br><br>New Feature in Shorewall 4.2.5<br><br>1)  A new 'fallback' option is added in<br>    /etc/shorewall/providers. The option works similar to 'balance'<br>    except that the default route is added in the default routing table<br>    (253) rather than in the main table (254).<br><br>    The option can be used by itself or followed by =&lt;number&gt; (e.g,<br>    fallback=2).<br><br>    When the option is used by itself, a separate (not balanced)<br>    default route is added with a metric equal to the provider's NUMBER.<br><br>    When the option is used with a number, a balanced route is added<br>    with the weight set to the specified number.<br><br>    'fallback' is ignored if USE_DEFAULT_RT=Yes in shorewall.conf and<br>    is only available with Shorewall-perl.<br><br>    'fallback' is useful in situations where:<br><br>    - You want all traffic to be sent via one primary provider unless<br>      there is a compelling reason to use a different provider<br><br>    - If the primary provider is down, then you want to balance the<br>      outgoing traffic among a set of other providers or to a<br>      ordered list of providers.<br><br>    In this case:<br><br>    - Do not specify 'balance' on any of the providers.<br>    - Disable route filtering ('ROUTE_FILTER=No' in shorewall.conf).<br>    - Specify 'fallback' on those providers that you want to use if<br>      the primary is down.<br>    - Only the primary provider should have a default route in the main<br>      routing table.<br><br>    See <a
- class="moz-txt-link-freetext"
- href="http://www.shorewall.net/MultiISP.html#Complete">http://www.shorewall.net/MultiISP.html#Complete</a> for an example<br>    of this option's use.<br><br>2)  Shorewall-perl now transparently handles the xtables-addon version<br>    of ipp2p. Shorewall detects whether the installed ipp2p is from<br>    patch-o-matic-ng or from xtables-addon and proceeds accordingly.<br><br>    If the patch-o-matic-ng version is installed:<br><br>    a) If no DEST PORT is supplied, the default is "--ipp2p".<br>    b) If "ipp2p" is supplied as the DEST PORT, it will be passed to<br>       iptables-restore as "--ipp2p".<br><br>    If the xtables-addons version is installed:<br><br>    a) If no DEST PORT is supplied, the default is "--edk --gnu --dc<br>       --kazaa".<br>    b) If "ipp2p" is supplied as the DEST PORT, it will be passed to<br>       iptables-restore as "--edk --gnu --dc --kazaa".<br><br>    Shorewall-perl now also accepts a comma-separated list of options<br>    (e.g., "edk,gnu,dc,kazaa).<br><br>    Additionally, Shorewall now looks for modules in <i
- class="moz-txt-slash"><span class="moz-txt-tag">/</span>lib/modules<span
- class="moz-txt-tag">/</span></i>$(uname<br>    -r)<i
- class="moz-txt-slash"><span class="moz-txt-tag">/</span>extra and in /lib/modules<span
- class="moz-txt-tag">/</span></i>$(uname -r)/extra/ipset<br><br>    This change introduced a new capability ("Old IPP2P Match Syntax")<br>    so if you use a capabilities file, be sure to re-generate the<br>    file(s) after you have installed 4.2.5.<br><br>3)  There is now a macro.Git, which opens git-daemon's port (9418/tcp).<br><br>4)  There is also a macro.IRC which open's the Internet Relay Chat port<br>    (6667/tcp).</pre>
-<p><strong>2009-01-06 Winner of the Shorewall Logo Design Competition
-Announced</strong></p>
-The Shorewall developers are pleased to announce that after deliberating<br>
-upon the matter, we have chosen Gareth Davies' #3 design.<br>
-<p>See<a target="_top"
- href="http://trac.shorewall.net/wiki/LogoDesignCompetition">
-http://trac.shorewall.net/wiki/LogoDesignCompetition</a> for details.<br>
-<strong></strong></p>
-<p><strong>2008-12-31 Shorewall 4.2.4</strong></p>
-<p><strong></strong></p>
-<pre>1) In 4.2.4, two new packages are included:<br><br>   a) Shorewall6 - analagous to Shorewall-common but handles IPv6<br>      rather than IPv4.<br><br>   b) Shorewall6-lite - analagous to Shorewall-lite but handles IPv6<br>      rather than IPv4.<br><br>   The packages store their configurations in /etc/shorewall6/ and<br>   /etc/shorewall6-lite/ respectively.  <br><br>   The fact that the packages are separate from their IPv4 counterparts<br>   means that you control IPv4 and IPv6 traffic separately (the same<br>   way that Netfilter does). Starting/Stopping the firewall for one<br>   address family has no effect on the other address family.<br><br>   For additional information, see<br>   http://www.shorewall.net/IPV6Support.html.<br><br>   Other features of Shorewall6 are:<br><br>   a) There is no NAT of any kind (most people see this as a giant step<br>      forward). When an ISP assigns you a public IPv6 address, you are<br>      actually assigned an IPv6 'prefix' which is like an IPv4<br>      subnet. A 64-bit prefix allows 4 billion squared individual hosts<br>      (the size of the current IPv4 address space squared).<br><br>   b) The default zone type is ipv6.<br><br>   c) The currently-supported interface options in Shorewall6 are:<br><br>        blacklist<br>        bridge<br>        dhcp<br>        nosmurfs (traps multicast and Subnet-router anycast addresses<br>        used as the packet source address).<br>        optional<br>        routeback<br>        sourceroute<br>        tcpflags<br>        mss<br>        forward (setting it to 0 makes the router behave like a host<br>                 on that interface rather than like a router).<br><br>   d)  The currently-supported host options in Shorewall6 are:<br><br>        blacklist<br>        routeback<br>        tcpflags<br><br>   e)  Traffic Shaping is disabled by default. The tcdevices and<br>       tcclasses files are address-family independent so<br>       to use the Shorewall builtin Traffic Shaper, TC_ENABLED=Internal<br>       should be specified in Shorewall or in Shorewall6 but not in<br>       both. In the configuration where the internal traffic shaper is<br>       not enabled, CLEAR_TC=No should be specified.<br><br>       tcfilters are not available in Shorewall6.<br><br>   f)  When both an interface and an address or address list need to<br>       be specified in a rule, the address or list must be enclosed in<br>       angle brackets. Example:<br><br>        #ACTION      SOURCE                                     DEST<br>        ACCEPT       net:eth0:&lt;2001:19f0:feee::dead:beef:cafe&gt;  dmz<br><br>       Note that this includes MAC addresses as well as IPv6 addresses.<br><br>       The HOSTS column in /etc/shorewall6/hosts also uses this<br>       convention:<br><br>           #ZONE      HOSTS                                     OPTIONS<br>           chat6      eth0:&lt;2001:19f0:feee::dead:beef:cafe&gt;<br><br>       Even when an interface is not specified, it is permitted to<br>       enclose addresses in &lt;&gt; to improve readability. Example:<br><br>           #ACTION      SOURCE          DEST<br>           ACCEPT       net:&lt;2001:1::1&gt; $FW<br><br>   g)  The options available in shorewall6.conf are a subset of those<br>       available in shorewall.conf.<br><br>   h)  The Socket6.pm Perl module is required if you include DNS names<br>       in your Shorewall6 configuration. Note that it is loaded the<br>       first time that a DNS name is encountered so if it is missing,<br>       you get a message similar to this one:<br><br>       ...<br>       Checking /etc/shorewall6/rules...<br>       Can't locate Socket6.pm in @INC (@INC contains: /root ...<br>       teastep@ursa:~/Configs/standalone6$ <br></pre>
-<p><strong>2008-12-16 Shorewall 4.2.3</strong></p>
-<p><strong></strong></p>
-<pre>Problems corrected in Shorewall 4.2.3<br><br>1)  Previously, Shorewall would allow compilation for export of a<br>    script named 'shorewall' with the unfortunate side effect that<br>    the 'shorewall.conf' file was overwritten. Scripts named<br>    'shorewall' now cause a fatal error to be raised.<br><br>2)  Previously, Shorewall-perl attempted to do Shell variable<br>    substitution on the first line in /etc/shorewall/compile.<br><br>3)  Following the Netfilter tradition, the IPP2P maintainer has made an<br>    incompatible syntax change (the --ipp2p option has been<br>    removed). Shorewall has always used "-m ipp2p --ipp2p" when<br>    detecting the presence of IPP2P support.<br><br>    Shorewall-common and Shorewall-perl have been modified to use<br>    "-m ipp2p --edk" instead.<br><br>4)  When Extended Conntrack Match support was available, Shorewall-perl<br>    would create invalid iptables-restore input for certain DNAT rules.<br><br>5)  An optimization in all Shorewall-perl 4.2 versions could  cause<br>    undesirable side effects. The optimization deleted the<br>    &lt;interface&gt;_in and &lt;interface&gt;_fwd chains and moved their rules<br>    to the appropriate rules chain (a &lt;zone&gt;2&lt;xxx&gt; chain).<br><br>    This worked badly in cases where a zone was associated with more<br>    than one interface. Rules could be duplicated or, worse, a rule<br>    that was intended for only input from one of the interfaces would<br>    be applied to input from all of the zone's interfaces.<br><br>    This problem has been corrected so that an interface-related<br>    chains is only deleted if:<br><br>    a) the chain has no rules in it; or<br>    b) the interface is associated with only one zone and that zone is<br>       associated with only that interface in which case it is safe to<br>       move the rules.<br><br>Other changes in Shorewall 4.2.3<br><br>1)  Except with the -e option is specified, the Shorewall-perl compiler<br>    now verifies user/group names appearing in the USER/GROUP column of<br>    the rules file.<br><br>2)  The output of 'shorewall dump' now includes the output from<br>    'netstat -tunap'.<br><br>3)  Shorewall-perl now accepts '+' as an interface name in<br>    /etc/shorewall/interfaces. That name matches any interface and is<br>    useful for defining a zone that will match any interface that might<br>    be added after Shorewall is started.<br><br>    A couple of words of caution are in order.<br><br>    a) Because '+' matches any interface name, Shorewall cannot<br>       verify interface names appearing in other files when '+' is<br>       defined in /etc/shorewall/interfaces.<br><br>    b) The zone assigned to '+' must be the last one defined in<br>       /etc/shorewall/zones.<br><br>4)  Shorewall-perl now uses the iptables --goto parameter in obvious<br>    cases.<br><br>5)  The 'reset' command now allows you to reset the packet and byte<br>    counter on individual chains:<br><br>            shorewall reset chain1 chain2 ...<br>            shorewall-lite reset chain1 chain2 ...<br></pre>
-<p><strong>2008-11-20 Shorewall 4.2.2</strong></p>
-<p><strong></strong></p>
-Problems corrected in Shorewall 4.2.2
-<pre><br>1)  Shorewall-perl now insures that each line copied from a<br>    configuration file or user exit is terminated with a newline<br>    character.<br><br>2) When ipranges were used to define zones, Shorewall-perl could<br>   generate invalid iptables-restore input if 'Repeat Match' was not<br>   available. Repeat Match is not a true match -- it rather is a<br>   feature of recent iptables releases that allows a match to be<br>   repeated within a rule.<br><br>3)  With Shorewall-perl, if a destination port list had exactly 16<br>    ports, where a port-range counts as two ports, then Shorewall-perl<br>    would fail to split the rule into multiple rules and an<br>    iptables-restore error would result.<br><br>4)  The change to Shorewall-perl in 4.2.1 that promised iptables 1.4.1<br>    compatibility contained a typo that prevented it from working<br>    correctly.<br><br>5)  If a no-NAT rule (DNAT-, ACCEPT+, NONAT) included a destination IP<br>    address and no zone name in the DEST column, Shorewall-perl would<br>    reject the rule. If a zone name was specified, Shorewall-perl <br>    would issue a Warning message.<br><br>6)  Previously, if Extended conntrack match support was available, a<br>    DNAT rule that specified a server port but no destination port <br>    would generate invalid iptables-restore input.     <br><br>Other changes in Shorewall 4.2.2<br><br>1)  A macro supporting JAP (anonymization protocol) has been added.<br>    It can be used as any other macro (e.g., JAP/ACCEPT) in the rules<br>    file.<br><br>2)  A macro supporting DAAP (Digital Audio Access Protocol) has been added.<br>    It can be used as any other macro (e.g., DAAP/ACCEPT) in the rules<br>    file.<br><br>3)  A macro supporting DCC (Distributed Checksum Clearinghouse) has been<br>    added.  It can be used as any other macro (e.g., DCCP/ACCEPT) in the<br>    rules file.<br><br>4)  A macro supporting GNUnet (secure peer-to-peer networking) has been<br>    added.  It can be used as any other macro (e.g., GNUnet/ACCEPT) in the<br>    rules file.<br><br>5)  In 4.2.1, a single capability ("Extended conntrack match support")<br>    was used both to control the use of --ctorigport and to trigger use<br>    of the new syntax for inversion of --ctorigdst (e.g., "!<br>    --ctorigdst ..."). In 4.2.2, these are controlled by two separate<br>    capabilities. If you use a capabilities file when compiling your<br>    configuration, be sure to generate a new one after installing<br>    4.2.2.<br></pre>
-<p><strong>2008-10-25 Shorewall 4.2.1<br>
-</strong><strong></strong></p>
-<pre>Problems corrected in Shorewall 4.2.1<br><br>1)  A description of the CONNBYTES column has been added to<br>    shorewall-tcrules(5).<br><br>2)  Previously, Shorewall-perl would accept zero as the &lt;max&gt; value in<br>    the CONNBYTES column of tcrules even when the &lt;min&gt; field was<br>    non-zero. A value of zero for &lt;max&gt; was equivalent to omitting<br>    &lt;max&gt;.<br><br>3)  iptables 1.4.1 discontinued support of syntax generated by<br>    shorewall in some cases. Shorewall now detects when the new syntax<br>    is required and uses it instead.<br><br>4)  The Shorewall-perl implementation of the LENGTH column in<br>    /etc/shorewall/tcrules was incomplete with the result that <br>    all LENGTH rules matched. Thanks to Lennart Sorensen for the patch.<br><br>5)  The 'export' command no longer fails with the error:<br><br>    /sbin/shorewall: 1413: Syntax error: "(" unexpected (expecting "fi")<br><br>Other changes in Shorewall 4.2.1<br><br>1)  With the recent renewed interest in DOS attacks, it seems<br>    appropriate to have connection limiting support in Shorewall. To<br>    that end, a CONNLIMIT column has been added to both the policy and<br>    rules files.<br><br>    The content of these columns is of the format<br><br>        [!] &lt;limit&gt;[:&lt;mask&gt;]<br><br>    where<br><br>        &lt;limit&gt; is the limit on simultaneous TCP connections.<br><br>        &lt;mask&gt;  specifies the size of the network to which<br>                the limit applies and is specified as a<br>                CIDR mask length. The default value for<br>                &lt;mask&gt; is 32 which means that each remote<br>                IP address can have &lt;limit&gt; TCP connections<br>                active at once.<br><br>        !       Not allowed in the policy file. In the rules file, it<br>                causes connections to match when the number of<br>                current connections exceeds &lt;limit&gt;.<br>    <br>    When specified in the policy file, the limit is enforced on all<br>    connections that are subject to the given policy (just like<br>    LIMIT:BURST). The limit is checked on new connections before the<br>    connection is passed through the rules in the NEW section of the<br>    rules file.<br><br>    It is important to note that while the limit is only checked for<br>    those destinations specified in the DEST column, the number of<br>    current connections is calculated over all destinations and not<br>    just the destination specified in the DEST column.<br><br>    Use of this feature requires the connlimit match capability in your<br>    kernel and iptables. If you use a capabilities file when compiling<br>    your Shorewall configuration(s), then you need to regenerate the<br>    file using Shorewall or Shorewall-lite 4.2.1.<br><br>2)  Shorewall now supports time/date restrictions on entries in the <br>    rules file via a new TIME column.<br><br>    The contents of this column is a series of one or more "time<br>    elements" separated by apersands ("&amp;"). Possible time elements are:<br><br>    utc         Times are expressed in Greenwich Mean Time.<br>    localtz     Times are expressed in local civil time (default)<br>    timestart=hh:mm[:ss]<br>    timestop=hh:mm[:ss]   Start and stop time of day for rule<br>    weekdays=ddd[,ddd]... where ddd is Mon,Tue,Wed,Thu,Fri,Sat or<br>                          Sun<br>    monthdays=dd[,dd]...  where dd is an ordinal day of the month.<br>    datestart=yyyy[-mm[-dd[Thh[:mm[:ss]]]]]<br>    datestop=yyyy[-mm[-dd[Thh[:mm[:ss]]]]]<br>                          where       yyyy = Year<br>                                first mm   = Month<br>                                      dd   = Day<br>                                      hh   = Hour<br>                                  2nd mm   = Minute<br>                                      ss   = Second<br><br>    Examples:<br><br>    1)  utc&amp;timestart=10:00&amp;timestop=12:00<br><br>        Between 10am and 12 noon each day, GMT<br><br>    2)  datestart=2008-11-01T12:00<br><br>        Beginning November 1, 2008 at noon LCT.<br><br>    Use of this feature requires the time match capability in your<br>    kernel and iptables. If you use a capabilities file when compiling<br>    your Shorewall configuration(s), then you need to regenerate the<br>    file using Shorewall or Shorewall-lite 4.2.1.<br></pre>
-<p><strong>2006-10-05 Shorewall 4.2.0</strong></p>
-<pre><strong><span style="font-weight: normal;">Release Highlights.</span><br
- style="font-weight: normal;"><br style="font-weight: normal;"><span
- style="font-weight: normal;">1) Support is included for multiple internet providers through the same</span><br
- style="font-weight: normal;"><span style="font-weight: normal;">   ethernet interface.</span><br
- style="font-weight: normal;"><br style="font-weight: normal;"><span
- style="font-weight: normal;">2) Support for NFLOG has been added.</span><br
- style="font-weight: normal;"><br style="font-weight: normal;"><span
- style="font-weight: normal;">3) Enhanced operational logging.</span><br
- style="font-weight: normal;"><br style="font-weight: normal;"><span
- style="font-weight: normal;">4) The tarball installers now work under Cygwin.</span><br
- style="font-weight: normal;"><br style="font-weight: normal;"><span
- style="font-weight: normal;">5) Shorewall-perl now supports IFB devices which allow traffic shaping of</span><br
- style="font-weight: normal;"><span style="font-weight: normal;">   incoming traffic.</span><br
- style="font-weight: normal;"><br style="font-weight: normal;"><span
- style="font-weight: normal;">6) Shorewall-perl supports definition of u32 traffic classification</span><br
- style="font-weight: normal;"><span style="font-weight: normal;">   filters.</span><br></strong></pre>
-<p><strong></strong></p>
-<hr style="width: 100%; height: 2px;">
-<p><strong>2008-03-29 Shorewall 4.0.10</strong></p>
-<p><strong></strong></p>
-<pre>Problems corrected in Shorewall-perl 4.0.10.<br><br>1)&nbsp; Shorewall-perl 4.0.9 erroneously reported an error message when a<br>&nbsp;&nbsp;&nbsp; bridge port was defined in /etc/shorewall/interfaces:<br><br>&nbsp;&nbsp;&nbsp;&nbsp; ERROR: Your iptables is not recent enough to support bridge ports<br><br>2)&nbsp; Under Shorewall-perl, if an empty action was invoked or was named<br>&nbsp;&nbsp;&nbsp; in one of the DEFAULT_xxx options in shorewall.conf, an<br>&nbsp;&nbsp;&nbsp; iptables-restore error occured.<br><br>3)&nbsp; If $ADMIN was empty, then the rule:<br><br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ACCEPT loc:$ADMIN all<br><br>&nbsp;&nbsp;&nbsp;&nbsp; became<br><br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ACCEPT loc&nbsp;&nbsp; net<br><br>&nbsp;&nbsp;&nbsp;&nbsp; It is now flagged as an error.<br><br>4)&nbsp; Previously, Shorewall-perl would reject an IP address range in the<br>&nbsp;&nbsp;&nbsp; ecn and routestopped files.<br><br>5)&nbsp; A POLICY of ":" in /etc/shorewall/policy would produce Perl<br>&nbsp;&nbsp;&nbsp; run-time errors.<br><br>6)&nbsp; An INTERFACE of ":" in /etc/shorewall/interfaces would produce Perl<br>&nbsp;&nbsp;&nbsp; run-time errors.<br><br>7)&nbsp; A MARK of ":" in /etc/shorewall/tcrules would produce Perl<br>&nbsp;&nbsp;&nbsp; run-time errors.<br><br>Problems corrected in Shorewall-shell 4.0.10.<br><br>1)&nbsp; Specifying a value for ACCEPT_DEFAULT or QUEUE_DEFAULT resulted in<br>&nbsp;&nbsp;&nbsp; a fatal error at compile time.<br><br>Known Problems Remaining.<br><br>1)&nbsp; The 'refresh' command doesn't refresh the mangle table. So changes<br>&nbsp;&nbsp;&nbsp; made to /etc/shorewall/providers and/or /etc/shorewall/tcrules may<br>&nbsp;&nbsp;&nbsp; not be reflected in the running ruleset.<br><br>Other changes in 4.0.10.<br><br>1)&nbsp; The Sample configurations have been updated to set<br>&nbsp;&nbsp;&nbsp; LOG_MARTIANS=keep. In 4.2, this will be changed to<br>&nbsp;&nbsp;&nbsp; LOG_MARTIANS=Yes.<br><br>2)&nbsp; Shorewall-perl now generates a fatal error if a non-existant shell<br>&nbsp;&nbsp;&nbsp; variable is used in any configuration file (except<br>&nbsp;&nbsp;&nbsp; /etc/shorewall/params).<br><br>3)&nbsp; Shorewall-perl now supports an 'l2tp' tunnel type. It opens UDP<br>&nbsp;&nbsp;&nbsp; port 1701 in both directions and assumes that the source port will<br>&nbsp;&nbsp;&nbsp; also be 1701. Some implementations (particularly OS X) use a<br>&nbsp;&nbsp;&nbsp; different source port. In that case, you should use<br>&nbsp;&nbsp;&nbsp; 'generic:udp:1701' rather than 'l2tp'.<br></pre>
-<p><strong>2008-03-01 Shorewall 3.4.8</strong></p>
-<pre>1)  Shorewall now removes any default bindings of ipsets before<br>    attempting to reload them. Previously, default bindins were not<br>    removed with the result that the ipsets could not be destroyed.<br><br><br>2)  When HIGH_ROUTE_MARKS=Yes, unpredictable results could occur when<br>    marking in the PREROUTING or OUTPUT chains. When a rule specified a<br>    mark value &gt; 255, the compiler was using the '--or-mark' operator<br>    rather than the '--set-mark' operator with the result that when a<br>    packet matched more than one rule, the resulting routing mark was<br>    the logical product of the mark values in the rules.<br><br><br>    Example:<br><br><br>        0x100   192.168.1.44    0.0.0.0/0<br>        0x200   0.0.0.0/0       0.0.0.0/0       tcp     25<br><br><br>    A TCP packet from 192.168.1.44 with destination port 25 would end<br>    up with a mark value of 0x300.<br><br><br>3)  Shorewall now properly parses comma separated SOURCE (formerly<br>    SUBNET) values in the masq configuration file.  Previously, the comma<br>    separated list was not split up into its components, resulting in an<br>    invalid address being passed to the iptables command.<br><br><br>    Example:<br><br><br>        # /etc/shorewall/masq<br>        #INTERFACE  SUBNET                   ADDRESS  PROTO  PORT(S)  IPSEC<br>        eth0        192.168.2.1,192.168.2.3<br><br><br>4)  Previously, specifying both an interface and a MAC address in the<br>    SOURCE column of the tcrules file caused a failure at runtime.<br>    Thanks to Justin Joseph for the patch.<br><br><br>5)  Previously, specifying both an interface and an address in the<br>    tcrules DEST column would cause an incomplete rule to be generated.<br><br><br>    Example:<br><br><br>    1   192.168.1.4     eth2:206.124.146.177    tcp     22<br><br><br>    The resulting tcrule would be as if this had been specified:<br><br><br>    1   0.0.0.0/0       eth2:206.124.146.177    tcp     22<br><br><br>6)  When HIGH_ROUTE_MARKS=Yes, the routing rules generated to match<br>    fwmarks to routing tables overflowed the designated range for such<br>    marks (10000 - 11000).</pre>
-<hr>
-<p><strong>2008-02-23 Shorewall 4.0.9</strong></p>
-<p><strong></strong></p>
-<pre>Problems corrected in Shorewall-perl 4.0.9.1<br><br>1)  In 4.0.9, Shorewall-perl incorrectly generated the following error<br>    message:<br><br>    ERROR: Your iptables is not recent enough to support bridge ports<br><br>Problems corrected in Shorewall-perl 4.0.9<br><br>1)  If a zone was defined with exclusion in /etc/shorewall/hosts, then<br>    the rules generated for directing outgoing connections to the zone<br>    were incorrect.<br><br>    Example:<br><br>    /etc/shorewall/zones:<br><br>    z   ipv4<br><br>    /etc/shorewall/interfaces:<br><br>    -   eth2    <br><br>    /etc/shorewall/hosts:<br><br>    z   eth2:192.168.1.0/24!192.168.1.5<br><br>    Traffic from the firewall to 192.168.1.5 was incorrectly classified<br>    as $FW-&gt;z.<br><br>2)  Qualifying 'SOURCE' and 'DEST' with an IP address in a macro file<br>    caused 'SOURCE' or 'DEST' to be interpreted incorrectly as the name<br>    of an interface.<br><br>    Example:<br><br>        PARAM   DEST    SOURCE:224.0.0.22<br><br>3)  Specifying '!&lt;user&gt;' in the USER/GROUP column of the files that<br>    support it resulted in an invalid iptables rule under<br>    Shorewall-perl.<br><br>4)  Previously, Shorewall would accept both an interface and an IP<br>    address in tcrules POSTROUTING entries (such as CLASSIFY).<br><br>    Example:<br><br>    1:11      eth1:192.168.4.9  -       tcp     22<br><br>    It also allowed both a destination interface and address.<br><br>    Example:<br><br>    1:P       -         eth1:192.168.4.9        tcp     22<br><br>    Because Netfilter does not allow an input interface to be specified<br>    in POSTROUTING or an output interface to be specified in<br>    PREROUTING, Shorewall must use the routing table to generate a list<br>    of networks accessed through any interface specified in these<br>    cases. Given that a specific address (or set of addresses) has<br>    already been specified, it makes no sense qualify it (them) by<br>    another list of addresses.<br><br>5)  Shorewall-perl incorrectly generated a fatal error when ':C', <br>    ':T' or ':CT' was used in a tcrules entry that gave $FW as the<br>    SOURCE.<br><br>6)  Users have been confused about this error message:<br><br>    ERROR: Bridge Ports require Repeat match in your kernel and iptables <br><br>    The message has been replaced with:<br><br>    ERROR:  Your iptables is not recent enough to support bridge ports<br><br>    The minimum version required is 1.3.8.<br><br>Problems corrected in Shorewall-shell 4.0.9.<br><br>1)  An optimization added to Shorewall-shell in 4.0.0 has been backed<br>    out to work around a limitation of Busybox 'sed'.<br><br>2)  Previously, specifying both an interface and an address in the<br>    tcrules DEST column would cause an incomplete rule to be generated.<br><br>    Example:<br><br>    1   192.168.1.4     eth2:206.124.146.177    tcp     22<br><br>    The resulting tcrule would be as if this had been specified:<br><br>    1   0.0.0.0/0       eth2:206.124.146.177    tcp     22<br><br>3)  When HIGH_ROUTE_MARKS=Yes, the routing rules generated to match<br>    fwmarks to routing tables previously overflowed the designated<br>    range defined for such marks (10000 - 11000). <br><br>Known Problems Remaining.<br><br>1)  The 'refresh' command doesn't refresh the mangle table. So changes<br>    made to /etc/shorewall/providers and/or /etc/shorewall/tcrules may<br>    not be reflected in the running ruleset.<br><br>Other changes in 4.0.9.<br><br>1)  The Shorewall-perl now flags unprintable garbage characters in<br>    configuration files with the message:<br><br>        ERROR: Non-ASCII gunk in file <br><br>2)  The /usr/share/shorewall/modules file has been updated to reflect<br>    module renaming in kernel 2.6.25.<br><br>3)  The 'ip route replace' command is broken in kernel 2.6.24. To work<br>    around this problem, the undocumented option BROKEN_ROUTING has<br>    been added to shorewall.conf. The default is BROKEN_ROUTING=No.<br><br>    If you are experiencing 'File Exists' errors from 'ip route<br>    replace' commands, then add the following line to your<br>    shorewall.conf:<br><br>        BROKEN_ROUTING=Yes<br><br>    Note: This workaround is only available in Shorewall-perl.<br></pre>
-<p><strong>2008-01-25 Shorewall 4.0.8</strong></p>
-<p><strong></strong></p>
-<pre>Problems corrected in Shorewall-perl 4.0.8.<br><br>1)  Mark tests (such as in the TEST column of tcrules or the MARK<br>    column of the rules file) were ignoring the value 0. As part of<br>    this fix, the default mask generated by entries in these columns<br>    has been changed from 0xFF to 0xFFFF for compatibility with<br>    Shorewall-shell.<br><br>2)  The compilation date recorded in the firewall.conf file produced by<br>    Shorewall-perl was previously mangled.<br><br>3)  The ability to specify a DEST IP range (round-robin) in a DNAT rule<br>    has been restored. In versions 4.0.5 - 4.0.7, an IP range was<br>    incorrectly flagged as an error.<br><br>Problems corrected in Shorewall-shell 4.0.8.<br><br>1)  Shorewall-shell now properly parses comma separated SOURCE (formerly<br>    SUBNET) values in the masq configuration file.  Previously, the comma<br>    separated list was not split up into its components, resulting in an<br>    invalid address being passed to the iptables command.<br><br>    Example:<br><br>        # /etc/shorewall/masq<br>        #INTERFACE  SUBNET                   ADDRESS  PROTO  PORT(S)  IPSEC<br>        eth0        192.168.2.1,192.168.2.3<br><br>Known Problems Remaining.<br><br>1)  The 'refresh' command doesn't refresh the mangle table. So changes<br>    made to /etc/shorewall/providers and/or /etc/shorewall/tcrules may<br>    not be reflected in the running ruleset.<br><br>Other changes in 4.0.8.<br><br>None.<br></pre>
-<hr style="width: 100%; height: 2px;"><strong>2007-12-26 Shorewall 4.0.7</strong>
-<pre>Problems corrected in Shorewall-perl 4.0.7</pre>
-<pre>1)&nbsp; If any of the following files was missing, a harmless Perl warning<br>&nbsp;&nbsp;&nbsp; was issued:</pre>
-<pre>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; accounting<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; maclist<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; masq<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; nat<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; netmap<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; rfc1918<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; routestopped<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; tunnels</pre>
-<pre>&nbsp;&nbsp;&nbsp; This problem was experienced mostly by Debian users and users of<br>&nbsp;&nbsp;&nbsp; Debian derivatives such as Ubuntu.</pre>
-<pre>2)&nbsp; The iptables utility doesn't retry operations that fail due to<br>&nbsp;&nbsp;&nbsp; resource shortage. Beginning with this release, Shorewall reruns<br>&nbsp;&nbsp;&nbsp; iptables when such a failure occurs.</pre>
-<pre>3)&nbsp; Previously, Shorewall-perl did not accept log levels in upper case<br>&nbsp;&nbsp;&nbsp; (e.g., INFO). Beginning with 4.0.7, log levels are treated in a<br>&nbsp;&nbsp;&nbsp; case-insensitive manner by Shorewall-perl.</pre>
-<pre>4)&nbsp; The column headers in macro files were not aligned. This has been<br>&nbsp;&nbsp;&nbsp; corrected, along with some inaccuracies in the macro.template file.</pre>
-<pre>5)&nbsp; The shorewall.conf files in the Samples did not contain some<br>&nbsp;&nbsp;&nbsp; recently-defined options. They are now up to date.</pre>
-<pre>6)&nbsp; The names of the Jabber macros were shuffled. They are now named<br>&nbsp;&nbsp;&nbsp; correctly.</pre>
-<pre>7)&nbsp; If ADD_IP_ALIASES=Yes, an alias was incorrectly added when the<br>&nbsp;&nbsp;&nbsp; specified INTERFACE ended with ":" (e.g., eth0:).</pre>
-<pre>8)&nbsp; Shorewall-shell generated an incorrect iptables rule from the<br>&nbsp;&nbsp;&nbsp; following:</pre>
-<pre>&nbsp;&nbsp;&nbsp; /etc/shorewall/rules:</pre>
-<pre>&nbsp;&nbsp;&nbsp; ACCEPT&nbsp;&nbsp;&nbsp;&nbsp; loc:eth0:~00-02-02-02-02-02&nbsp; ...</pre>
-<pre>&nbsp;&nbsp;&nbsp; /etc/shorewall/tcrules:</pre>
-<pre>&nbsp;&nbsp;&nbsp; xxxx&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; eth0:~00-02-02-02-02-02 ...</pre>
-<pre>Known Problems Remaining.</pre>
-<pre>1)&nbsp; The 'refresh' command doesn't refresh the mangle table. So changes<br>&nbsp;&nbsp;&nbsp; made to /etc/shorewall/providers and/or /etc/shorewall/tcrules may<br>&nbsp;&nbsp;&nbsp; not be reflected in the running ruleset.</pre>
-<pre>Other changes in 4.0.7</pre>
-<pre>1)&nbsp; If the program named in SHOREWALL_SHELL doesn't exist or is not<br>&nbsp;&nbsp;&nbsp; executable, Shorewall and Shorewall-lite now both fall back to<br>&nbsp;&nbsp;&nbsp; /bin/sh after issuing a warning message. Previously, both<br>&nbsp;&nbsp;&nbsp; terminated with a fatal error.</pre>
-<pre>2)&nbsp; The error message has been improved when a non-root user attempts<br>&nbsp;&nbsp;&nbsp; "shorewall show capabilities".</pre>
-<pre>3)&nbsp; Shorewall-perl now generates fatal error conditions when there are<br>&nbsp;&nbsp;&nbsp; no IPv4 zones defined and when there are no interfaces defined.<hr></pre>
-<p><strong>2007-12-26 Shorewall 4.1.3</strong></p>
-<pre>Problems corrected in Shorewall 4.1.3.</pre>
-<pre>1)&nbsp; If NFLOG or ULOG was specified with parameters, the resulting<br>&nbsp;&nbsp;&nbsp; iptables-restore input contained elements that were incorrectly<br>&nbsp;&nbsp;&nbsp; up-cased.</pre>
-<pre>2)&nbsp; If STARTUP_LOG is specified without LOG_VERBOSITY, /sbin/shorewall<br>&nbsp;&nbsp;&nbsp; produces an error.</pre>
-<pre>3)&nbsp; If LOG_VERBOSITY is specified without STARTUP_LOG, run-time error<br>&nbsp;&nbsp;&nbsp; messages are produced.</pre>
-<pre>4)&nbsp; Shorewall-shell was mishandling the entries in /etc/shorewall/rules<br>&nbsp;&nbsp;&nbsp; and in /etc/shorewall/tcrules where both a SOURCE interface and MAC<br>&nbsp;&nbsp;&nbsp; address were specified.</pre>
-<pre>&nbsp;&nbsp;&nbsp; Example:</pre>
-<pre>&nbsp;&nbsp;&nbsp; ACCEPT&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; net:eth0:~01-02-03-04-05-06&nbsp;&nbsp;&nbsp; $FW&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp;&nbsp; 22</pre>
-<pre>Other changes in Shorewall 4.1.3.</pre>
-<pre>1)&nbsp; If the program named in SHOREWALL_SHELL doesn't exist or is not<br>&nbsp;&nbsp;&nbsp; executable, Shorewall and Shorewall-lite now both fall back to<br>&nbsp;&nbsp;&nbsp; /bin/sh after issuing a warning message. Previously, both<br>&nbsp;&nbsp;&nbsp; terminated with a fatal error.</pre>
-<pre>2)&nbsp; The error message has been improved when a non-root user attempts<br>&nbsp;&nbsp;&nbsp; "shorewall show capabilities".</pre>
-<pre>3)&nbsp; Shorewall-perl now generates fatal error conditions when there are<br>&nbsp;&nbsp;&nbsp; no IPv4 zones defined and when there are no interfaces defined.</pre>
-<pre>4)&nbsp; Shorewall now unconditionally uses tc filter rules to classify<br>&nbsp;&nbsp;&nbsp; traffic by MARK value. Previously, Shorewall used the CLASSIFY<br>&nbsp;&nbsp;&nbsp; target in the POSTROUTING chain if it was available.</pre>
-<pre>5)&nbsp; The Shorewall-common installer (install.sh) now works on Windows<br>&nbsp;&nbsp;&nbsp; under Cygwin.</pre>
-<pre>&nbsp;&nbsp;&nbsp; To install Shorewall-perl under Cygwin:</pre>
-<pre>&nbsp;&nbsp;&nbsp; $ tar -xf shorewall-perl-4.1.3.tar.bz2<br>&nbsp;&nbsp;&nbsp; $ tar -xf shorewall-common-4.1.3.tar.bz2<br>&nbsp;&nbsp;&nbsp; $ cd shorewall-perl-4.1.3<br>&nbsp;&nbsp;&nbsp; $ ./install.sh<br>&nbsp;&nbsp;&nbsp; $ cd ../shorewall-common-4.1.3<br>&nbsp;&nbsp;&nbsp; $ USER=&lt;your user id&gt; GROUP=None ./install.sh<br>&nbsp;&nbsp;&nbsp; <br>&nbsp;&nbsp;&nbsp; The 'shorewall' program is installed in /bin/ (a.k.a, /usr/bin/).<hr></pre>
-<p><strong>2007-11-23 Shorewall 4.0.6</strong></p>
-<pre>Problems corrected in Shorewall-perl 4.0.6.<br><br>1)  In a DNAT or REDIRECT rule, if no serverport was given and the DEST<br>    PORT(S) list contained a service name containing a hyphen ("-") then<br>    an ERROR was generated.<br><br>    Example -- Rules file:<br><br>        DNAT    net     loc:$WINDOWS_IP tcp     https,pptp,ms-wbt-server,4125<br><br>    Results in:<br><br>        ERROR: Invalid port range (ms:wbt:server) : rules (line 49)<br><br>    Problem was introduced in Shorewall 4.0.5 and does not occur in<br>    earlier releases.<br><br>2)  If a long destination port list needed to be broken at a port pair,<br>    the generated rule contained an extra comma which resulted in an<br>    iptables-restore failure.<br><br>3)  Several problems involving port ranges and port lists in REDIRECT<br>    rules have been corrected.<br><br>4)  Shorewall-perl no longer requires an address in the GATEWAY column<br>    of /etc/shorewall/tunnels. If the column is left empty (or contains<br>    '-') then 0.0.0.0/0 is assumed.<br><br>5)  Previously with Shorewall-perl, redirecting both STDOUT and STDERR<br>    to the same file descriptor resulted in scrambled output between<br>    the two. The error messages were often in the middle of the<br>    regular output far ahead of the point where the error occurred.<br><br>    This problem was possible in the Debian Shorewall init script<br>    (/etc/init.d/shorewall) which redirects output to the<br>    Debian-specific /var/log/shorewall-init.log file in this way:<br><br>        $SRWL $SRWL_OPTS start &gt;&gt; $INITLOG 2&gt;&amp;1 &amp;&amp; ...<br><br>6)  With both compilers, when HIGH_ROUTE_MARKS=Yes, unpredictable<br>    results could occur when marking in the PREROUTING or OUTPUT<br>    chains. When a rule specified a mark value &gt; 255, the compilers<br>    were using the '--or-mark' operator rather than the '--set-mark'<br>    operator. Consequently, when a packet matched more than one<br>    rule, the resulting routing mark was the logical product of the<br>    mark values in the matching rules rather than the mark value from<br>    the last matching rule.<br><br>    Example:<br><br>        0x100   192.168.1.44    0.0.0.0/0<br>        0x200   0.0.0.0/0       0.0.0.0/0       tcp     25<br><br>    A TCP packet from 192.168.1.44 with destination port 25 would have<br>    a  mark value of 0x300 rather than the expected value of 0x200.<br><br>7)  Previously, a 'start -f' on Shorewall Lite would produce the<br>    following distressing output before starting the firewall:<br><br>    make: *** No rule to make target `/firewall', needed by<br>    `/var/lib/shorewall-lite/restore'.  Stop.<br><br>    Furthermore, the Makefile for both Shorewall and Shorewall Lite<br>    failed to take into account the /etc/shorewall/vardir file.<br><br>    This has been corrected. As part of the fix, both /sbin/shorewall<br>    and /sbin/shorewall-lite support a "show vardir" command that<br>    displays the VARDIR setting.<br><br>8)  Shorewall-perl was previously ignoring the USER/GROUP column of the<br>    tcrules file.<br><br>9)  Supplying the name of a built-in chain in the 'refresh' command<br>    caused entries in the chain to be duplicated. Since this is a<br>    feature of iptables-restore with the '-n' option, built-in chains<br>    in the 'refresh' list will now be rejected.<br><br>Known Problems Remaining.<br><br>1)  The 'refresh' command doesn't refresh the mangle table. So changes<br>    made to /etc/shorewall/providers and/or /etc/shorewall/tcrules may<br>    not be reflected in the running ruleset.<br><br>Other changes in Shorewall 4.0.6.<br><br>1)  Shorewall-perl now uses the '--physdev-is-bridged' option when it<br>    is available. This option will suppress messages like the following:<br><br>    kernel: physdev match: using --physdev-out in the OUTPUT, FORWARD and<br>    POSTROUTING chains for non-bridged traffic is not supported<br>    anymore.<br><br>    This change only affects users who use bport/bport4 zones in a<br>    briged configuration and requires that capabilities files be<br>    regenerated using Shorewall-common or Shorewall-lite 4.0.6.<br><br>2)  Shorewall-perl now allows you to embed Shell or Perl scripts in<br>    all configuration files except /etc/shorewall/params and<br>    /etc/shorewall/shorewall.conf (As always, you can continue to<br>    include arbitrary shell code in /etc/shorewall/params).<br><br>    To embed a one-line script, use one of the following:<br><br>        SHELL &lt;shell script&gt;<br>        PERL &lt;perl script&gt;<br><br>    For multi-line scripts, use:<br><br>        BEGIN SHELL<br>        &lt;shell script&gt;<br>        END SHELL<br><br>        BEGIN PERL<br>        &lt;perl script&gt;<br>        END PERL<br><br>    For SHELL scripts, the output from the script is processed as if it<br>    were part of the file.<br><br>    Example 1 (Shell): To generate SMTP/ACCEPT rules from zones a b c d<br>    and e to the firewall:<br><br>        Either:<br><br>            BEGIN SHELL <br>            for z in a b c d e; do<br>                echo SMTP/ACCEPT $z fw tcp 25<br>            done<br>            END SHELL<br><br>        or<br><br>            SHELL for z in a b c d e; do echo SMTP/ACCEPT $z fw tcp 25; done<br><br>    Either is equivalent to:<br><br>        SMTP/ACCEPT a fw tcp 25<br>        SMTP/ACCEPT b fw tcp 25<br>        SMTP/ACCEPT c fw tcp 25<br>        SMTP/ACCEPT d fw tcp 25<br>        SMTP/ACCEPT e fw tcp 25<br><br>    With a Perl script, if you want to output text to be processed as<br>    if it were part of the file, then pass the text to the shorewall()<br>    function.<br><br>    Example 2 (Perl): To generate SMTP/ACCEPT rules from zones a b c d<br>    and e to the firewall:<br><br>          BEGIN PERL <br>          for ( qw/a b c d e/ ) { <br>              shorewall "SMTP/ACCEPT $_ fw tcp 25";<br>          }<br>          END PERL<br><br>    PERL scripts have access to any context accumulated in earlier PERL<br>    scripts. All such embedded Perl, as well as conventional Perl<br>    extension scripts are placed in the Shorewall::User package. That<br>    way, your global variables and functions won't conflict with any of<br>    Shorewall's.<br><br>    To allow you to load Perl modules and initialize any global state,<br>    a new 'compile' compile-time extension script has been added. It is<br>    called early in the compilation process.<br><br>    For additional information, see<br><br>    - http://www.shorewall.net/configuration_file_basics.html#Embedded<br><br>3)  To complement Embedded Perl scripts, Shorewall 4.0.6 allows Perl<br>    scripts to create filter chains using<br>    Shorewall::Chains::new_manual_chain() and then use the chain as a<br>    target in subsequent entries in /etc/shorewall/rules.<br><br>    See http://www.shorewall.net/ManualChains.html for information.<br><br>4)  The 'hits' command now accepts a -t option which limits the report<br>    to those log records generated today.<br><br>5)  A DONT_LOAD option has been added to shorewall.conf. If there are<br>    kernel modules that you don't wish to have loaded, you can list<br>    them in this entry as a comma-separated list.<br><br>    Example:<br><br>        DONT_LOAD=nf_conntrack_sip,nf_nat_sip<br><br>6)  Shorewall-perl now supports the --random option of the iptables<br>    SNAT, MASQUERADE, DNAT and REDIRECT targets. Please note that<br>    iptables support for this option is currently broken for the DNAT<br>    and REDIRECT targets; I've sent a patch to the Netfilter team.<br><br>    For MASQUERADE, simply place the word 'random' in the ADDRESS<br>    column. This causes Netfilter to randomize the source port seen by<br>    the remote host.<br><br>     Example:<br><br>        #INTERFACE      SOURCE  ADDRESS<br>        eth0            eth1    random    <br><br>    For SNAT, follow the port list by ":random".<br><br>    Example:<br><br>        #INTERFACE      SOURCE  ADDRESS<br>        eth0            eth1    206.124.146.179:10000-10999:random<br><br>    For DNAT, follow the port list by ":random".<br><br>    Example:<br><br>        #ACTION SOURCE  DEST                            PROTO   DEST<br>        #                                               PORT(S)<br>        DNAT    net     loc:192.168.1.4:40-50:random    tcp     22<br><br>    For REDIRECT, you must use the fully-qualified form of the DEST:<br><br>        #ACTION   SOURCE        DEST                    PROTO   DEST<br>        #                                               PORT(S)<br>        REDIRECT        net     $FW::40-50:random       tcp     22<br><br>    Note that ':random' is only effective with SNAT, DNAT and REDIRECT<br>    when a port range is specified in the ADDRESS/DEST column. It is<br>    ignored by iptables/iptables-restore otherwise.<br></pre>
-<hr>
-<p><strong>2007-10-22 Shorewall 4.0.5</strong></p>
-<pre>Problems corrected in Shorewall 4.0.5.<br><br>1)  Previously, Shorewall-perl misprocessed $FW::&lt;port&gt; in the DEST<br>    column of a REDIRECT rule, generating an error. '$FW::&lt;port&gt;' now<br>    produces the same effect as '&lt;port&gt;'.<br><br>2)  If the PROTOCOL (PROTO) column contained 'TCP' or 'UDP' and SOURCE<br>    PORT(S) or DEST PORT(S) were given, then Shorewall-perl rejected<br>    the entry with the error:<br><br>    ERROR: SOURCE/DEST PORT(S) not allowed with PROTO TCP : /etc/shorewall/rules <br><br>    The rule was accepted if 'tcp' or 'udp' was used instead.<br><br>3)  Shorewall-shell now removes any default bindings of ipsets before<br>    attempting to reload them. Previously, default bindings were not<br>    removed with the result that the ipsets could not be destroyed.<br><br>Other changes in Shorewall 4.0.5.<br><br>1)  Two new options have been added to /etc/shorewall/hosts<br>    (Shorewall-perl only).<br><br>    broadcast: Permits limited broadcast (destination 255.255.255.255)<br>               to the zone.<br><br>    destonly: Normally used with the Multi-cast range. Specifies that<br>              traffic will be sent to the specified net(s) but that <br>              no traffic will be received from the net(s).<br><br>    Example:<br><br>    wifi        eth1:192.168.3.0/24             broadcast<br>    wifi        eth1:224.0.0.0/4                destonly<br><br>    In that example, limited broadcasts from the firewall with a source<br>    IP in the 192.168.3.0/24 range will be acccepted as will multicasts<br>    (with any source address).<br><br>2)  A MULTICAST option has been added to shorewall.conf. This option<br>    will normally be set to 'No' (the default). It should be set to <br>    'Yes' under the following circumstances:<br><br>    a) You have an interface that has parallel zones defined via<br>       /etc/shorewall/hosts.<br>    b) You want to forward multicast packets to two or more of those<br>       parallel zones.<br><br>    In such cases, you will configure a 'destonly' network on each <br>    zone receiving multicasts.<br><br>    The MULTICAST option is only recognized by Shorewall-perl and is<br>    ignored by Shorewall-shell.<br><br>3)  As announced in the Shorewall 4.0.4 release notes, Shorewall-perl<br>    no longer supports the 'detectnets' option. Specifying that option<br>    now results in the following message:<br><br>    WARNING: Support for the 'detectnets' option has been removed<br><br>    It is suggested that 'detectnets' be replaced by<br>    'routefilter,logmartians'. That will produce the same filtering<br>    effect as 'detectnets' while eliminating 1-2 rules per connection.<br><br>    One user has asked how to retain the output of 'shorewall show<br>    zones' if the 'detectnets' option is removed. While I don't advise<br>    doing so, you can reproduce the current 'shorewall show' behavior<br>    as follows.<br><br>    Suppose that you have a zone named 'wifi' that produces the<br>    following output with 'detectnets':<br><br>    wifi (ipv4)<br>      eth1:192.168.3.0/24<br> <br>    You can reproduce this behavior as follows:<br><br>    /etc/shorewall/interfaces:<br><br>    -   eth1    detect  ...<br><br>    /etc/shorewall/hosts:<br><br>    wifi        eth1:192.168.3.0/24     broadcast<br><br>    If you send multicast to the 'wifi' zone, you also need this entry<br>    in your hosts file:<br><br>    wifi        eth1:224.0.0.0/4                destonly<br><br>4)  (Shorewall-perl only) The server port in a DNAT or REDIRECT rule<br>    may now be specified as a service name from<br>    /etc/services. Additionally:<br><br>    a) A port-range may be specified as the service port expressed in<br>       the format &lt;low port&gt;-&lt;high port&gt;. Connections are assigned to<br>       server ports in round-robin fashion.<br><br>    b) The compiler only permits a server port to be specified if the<br>       protocol is tcp or udp.<br><br>    c) The compiler ensures that the server IP address is valid (note<br>       that it is still not permitted to specify the server address as a<br>       DNS name).<br><br>5)  (Shorewall-perl only) Users are complaining that when they migrate<br>    to Shorewall-perl, they have to restrict their port lists to 15<br>    ports. In this release, we relax that restriction on destination<br>    port lists. Since the SOURCE PORT(s) column in the configuration<br>    files is rarely used, we have no plans to relax the restriction in<br>    that column.<br><br>6)  There have been several cases where iptables-restore has failed<br>    while executing a COMMIT command in the .iptables_restore_input<br>    file. This gives neither the user nor Shorewall support much to go<br>    on when analyzing the problem. As a new debugging aid, the meaning<br>    of 'trace' and 'debug' have been changed.<br><br>    Traditionally, /sbin/shorewall and /sbin/shorewall-lite have<br>    allowed either 'trace' or 'debug' as the first run-line<br>    parameter. Prior to 4.0.5, the two words produced the same effect.<br><br>    Beginning with Shorewall 4.0.5, the two words have different<br>    effects when Shorewall-perl is used.<br><br>    trace - Like the previous behavior.<br><br>            In the Shorewall-perl compiler, generate a stack trace<br>            on WARNING and ERROR messages.<br><br>            In the generated script, sets the shell's -x option to<br>            trace execution of the script.<br><br>    debug - Ignored by the Shorewall-perl compiler.<br><br>            In the generated script, causes the commands in<br>            .iptables_restore_input to be executed as discrete iptables<br>            commands. The failing command can thus be identified and a<br>            diagnosis of the cause can be made.<br><br>    Users of Shorewall-lite will see the following change when using a<br>    script that was compiled with Shorewall-perl 4.0.5 or later.<br><br>    trace - In the generated script, sets the shell's -x option to<br>            trace execution of the script.<br><br>    debug - In the generated script, causes the commands in<br>            .iptables_restore_input to be executed as discrete iptables<br>            commands. The failing command can thus be identified and a<br>            diagnosis of the cause can be made.<br><br>    In all other cases, 'debug' and 'trace' remain synonymous. In<br>    particular, users of Shorewall-shell will see no change in<br>    behavior.<br><br>    WARNING: The 'debug' feature in Shorewall-perl is strictly for<br>    problem analysis. When 'debug' is used:<br><br>    a) The firewall is made 'wide open' before the rules are applied.<br>    b) The routestopped file is not consulted and the rules are applied<br>       in the canonical iptables-restore order (ASCIIbetical by chain).<br>       So if you need critical hosts to be always available during<br>       start/restart, you may not be able to use 'debug'.<br><br>7)  /usr/share/shorewall-perl/buildports.pl,<br>    /usr/share/shorewall-perl/FallbackPorts.pm and <br>    /usr/share/shorewall-perl/Shorewall/Ports.pm have been removed.<br><br>    Shorewall now resolves protocol and port names as using Perl's<br>    interface to the the standard C library APIs getprotobyname() and<br>    getservbyname().<br><br>    Note 1: <br><br>           The protocol names 'tcp', 'TCP', 'udp', 'UDP', 'all', 'ALL',<br>           'icmp' and 'ICMP' are still resolved by Shorewall-perl<br>           itself.<br><br>    Note 2:<br><br>           Those of you running Shorewall-perl under Cygwin may wish to<br>           install "real" /etc/protocols and /etc/services files<br>           in place of the symbolic links installed by Cygwin.<br><br>8)  The contents of the Shorewall::*::$VERSION variables are now a<br>    only of interest for Perl programs that are using the modules and<br>    specifying a minimum version (e.g., "use Shorewall::Config<br>    4.0.5;"). Each module continues to carry a separate version which<br>    indicates the release of Shorewall-perl when the module was last<br>    modified</pre>
-<hr>
-<p><strong>2007-10-02 Shorewall 3.4.7</strong></p>
-<pre>Problems Corrected in Shorewall 3.4.7<br><br>1)  A bug prevented proper handling of PREROUTING marks when<br>    HIGH_ROUTE_MARKS=No and the track option was specified in<br>    /etc/shorewall/providers.<br><br>2) Previously, if the following sequence of routing rules was<br>   specified, then the first rule would always be omitted.<br><br>   #SOURCE    DEST      PROVIDER     PRIORITY<br>   $SRC_A     $DESTIP1  ISP1         1000<br>   $SRC_A     $DESTIP2  SOMEISP      1000<br>   $SRC_A     -         ISP2         1000<br><br>   The reason for this omission was that Shorewall uses a<br>   delete-before-add approach and attempting to delete the third rule<br>   resulted in the deletion of the first one instead. <br><br>   This problem occurred with both compilers.<br><br>3) When using Shorewall-shell, provider numbers were not recognized in<br>   the PROVIDER column of /etc/shorewall/route_rules.</pre>
-<hr>
-<p><strong>2007-09-28 Shorewall 4.0.4</strong></p>
-<pre>Problems Corrected in Shorewall 4.0.4<br><br>1)  If no interface had the 'blacklist' option, then when using<br>    Shorewall-perl, the 'start' and 'restart' command failed:<br><br>        ERROR: No filter chain found with name blacklst<br><br>    New Shorewall-perl 4.0.3 packages were released that corrected this<br>    problem; it is included here for completeness.<br><br>2)  If no interface had the 'blacklist' option, then when using<br>    Shorewall-perl, the generated script would issue this harmless<br>    message during 'shorewall refresh':<br><br>        chainlist_reload: Not found<br><br>3)  If /bin/sh was a light-weight shell such as ash or dash, then<br>    'shorewall refresh' failed.<br><br>4)  During start/restart, the script generated by Shorewall-perl was<br>    clearing the proxy_arp flag on all interfaces; that is not the<br>    documented behavior.<br><br>5)  If the module-init-tools package was not installed and<br>    /etc/shorewall/modules did not exist or was non-empty, then<br>    Shorewall-perl would fail with the message:<br><br>       ERROR: Can't run lsmod : /etc/shorewall/modules (line 0)<br><br>6)  Shorewall-perl now makes a compile-time check to insure that<br>    iptables-restore exists and is executable. This check is made when<br>    the compiler is being run by root and the -e option is not<br>    given.<br><br>    Note that iptables-restore must reside in the same directory as the<br>    iptables executable specified by IPTABLES in shorewall.conf or<br>    located by the PATH in the event that IPTABLES is not specified.<br><br>7)  When using Shorewall-perl, if an action was invoked with more than<br>    10 different combinations of log-levels/tags, some of those<br>    invocations would have incorrect logging.<br><br>8)  Previously, when 'shorewall restore' was executed, the<br>    iptables-restore utility was always located using the PATH setting<br>    rather than the IPTABLES setting.<br><br>    With Shorewall-perl, the IPTABLES setting is now used to locate<br>    this utility during 'restore' as it is during the processing of<br>    other commands.<br><br>9)  Although the shorewall.conf manpage indicates that the value<br>    'internal' is allowed for TC_ENABLED, that value was previously<br>    rejected ('Internal' was accepted).<br><br>10) The meaning of the 'loose' provider option was accidentally reversed<br>    in Shorewall-perl. Rather than causing certain routing rules to be<br>    omitted when specified, it actually caused them to be added (these<br>    rules were omitted when the option was NOT specified).<br><br>11) If the 'bridge' option was specified on an interface but there were<br>    no bport zones, then traffic originating on the firewall was not<br>    passed through the accounting chain.<br><br>12) In commands such as:<br><br>       shorewall compile &lt;directory&gt;<br>       shorewall restart &lt;directory&gt;<br>       shorewall check &lt;directory&gt;<br><br>    if the name of the &lt;directory&gt; contained a period ("."), then<br>    Shorewall-perl would incorrectly substitute the current working<br>    directory for the name.<br><br>13) Previously, if the following sequence of routing rules was<br>    specified, then the first rule would always be omitted.<br><br>    #SOURCE    DEST      PROVIDER     PRIORITY<br>    $SRC_A     $DESTIP1  ISP1         1000<br>    $SRC_A     $DESTIP2  SOMEISP      1000<br>    $SRC_A     -         ISP2         1000<br><br>    The reason for this omission was that Shorewall uses a<br>    delete-before-add approach and attempting to delete the third rule<br>    resulted in the deletion of the first one instead. <br><br>    This problem occurred with both compilers.<br><br>14) When using Shorewall-shell, provider numbers were not recognized in<br>    the PROVIDER column of /etc/shorewall/route_rules.<br><br>15) An off-by-one problem in Shorewall-perl caused the value 255 to be<br>    rejected in the MARK column of /etc/shorewall/tcclasses.<br><br>16) When HIGH_ROUTE_MARKS=Yes, marks with values &gt; 255 must be a<br>    multiple of 256. That restriction was being enforced by<br>    Shorewall-shell but not by Shorewall-perl. Shorewall-perl now also<br>    enforces this restriction.<br><br>17) Using REDIRECT with a parameterized macro (e.g., DNS/REDIRECT)<br>    failed with an "Unknown interface" error when using Shorewall-perl.<br><br>Other Changes in Shorewall 4.0.4<br><br>1)  The detection of 'Repeat Match' has been improved. 'Repeat Match'<br>    is not a match at all but rather is a feature of recent versions of<br>    iptables that allows a particular match to be used multiple times<br>    within a single rule.<br><br>    Example:<br><br>      -A foo -m physdev --physdev-in eth0 -m physdev --physdev-out ...<br><br>    When using Shorewall-shell, the availability of 'Repeat Match' can<br>    speed up compilation very slightly.<br><br>2)  Apparently recent Fedora releases are broken. The<br>    following sequence of commands demonstrates the problem:<br><br>    ip rule add from 1.1.1.1 to 10.0.0.0/8 priority 1000 table 5<br>    ip rule add from 1.1.1.1 to 0.0.0.0/0 priority 1000 table main<br>    ip rule del from 1.1.1.1 to 0.0.0.0/0 priority 1000<br><br>    The third command should fail but doesn't; instead, it incorrectly<br>    removes the rule added by the first command.<br>    To work around this issue, you can set DELETE_THEN_ADD=No in<br>    shorewall.conf which prevents Shorewall from deleting ip rules<br>    before attempting to add a similar rule.<br><br>3)  When using Shorewall-perl, the following message is now issued if<br>    the 'detectnets' option is specified in /etc/shorewall/interfaces:<br><br>    WARNING: Support for the 'detectnets' option will be removed from<br>    Shorewall-perl in version 4.0.5; better to use 'routefilter' and<br>    'logmartians<br><br>    The 'detect' options has always been rather silly. On input, it<br>    duplicates the function of 'routefilter'. On output, it is a no-op<br>    since traffic that doesn't match a route out of an interface won't<br>    be sent through that interface (duh!).<br><br>    Beginning with Shorewall 4.0.5, the warning message will read:<br><br>    WARNING: Support for the 'detectnets' option has been removed</pre>
-<hr>
-<p><strong>2007-09-01 Shorewall 4.0.3</strong></p>
-<pre>Problems Corrected in 4.0.3<br><br>1) Using the LOG target in the rules file could result in two LOG<br>   rules being generated by Shorewall-shell. Additionally, using an IP<br>   address range in a rule that performed logging could result in an<br>   invalid iptables command.<br><br>2)  Shorewall now loads the act_police kernel module needed by traffic<br>    shaping.<br><br>3)  Previously, "shorewall show -f capabilities" and "shorecap" omitted<br>    the "TCPMSS Match" capability. This made it appear to a compiler<br>    using a capabilities file that the TCPMSS Match capability was not<br>    available.<br><br>4)  Previously, Shorewall would truncate long log prefixes to 29<br>    characters. This resulted in there being no space between the log<br>    prefix and the IN= part of the message.<br><br>    Example: fw2net:LOG:HTTPSoutIN= OUT=eth0<br><br>    Beginning with this release, Shorewall will truncate the prefix to<br>    28 bytes and add a trailing space.<br><br>    Example: fw2net:LOG:HTTPSou IN= OUT=eth0<br><br>5)  Previously, if:<br><br>    - FASTACCEPT=No<br>    - The policy from Z1 to Z2 was CONTINUE<br>    - Neither Z1 nor Z2 had parent zones<br>    - There were no Z1-&gt;Z2 rules<br><br>    then connections from Z2-&gt;Z1 would fail even if there were<br>    rules/policies allowing them. This has been<br>    corrected.<br><br>6)  The 'shorewall add' and 'shorewall delete' command would fail when:<br><br>    - The running configuration was compiled with Shorewall-perl.<br>    - The name of the interface specified in the command contained an<br>      embedded special character such as '.' or '-'.<br><br>    This problem was the result of the change in Shorewall 4.0.2 that<br>    removed the legacy mapping of interface names when embedding such<br>    names in a Netfilter chain name. To correct the problem, the<br>    pre-4.0.2 name mapping is restored when DYNAMIC_ZONES=Yes.<br><br>5)  A bug in Shorewall-shell prevented proper handling of PREROUTING<br>    marks when HIGH_ROUTE_MARKS=No and the track option was specified<br>    in /etc/shorewall/providers.<br><br>6)  With Shorewall-perl, if EXPORTPARAMS=Yes then INCLUDE directives in<br>    the params file would fail at script execution time with "INCLUDE:<br>    not found". This has been corrected.<br><br>7)  Shorewall-perl was mis-sorting the zone list when zones were nested<br>    more than one deep.<br><br>8)  Stale references to http://www.shorewall.net/Documentation.htm have<br>    been removed from the config files (including samples). That URL<br>    has been replaced by the online manpages.<br><br>Other Changes in 4.0.3<br><br>1)  A script generated by Shorewall-perl now tries to modify/restore<br>    /etc/iproute2/rt_tables only if the file is writable. This prevents<br>    run-time errors when /etc is mounted read-only.<br>  <br>    A new KEEP_RT_TABLES option has been added to shorewall.conf. When<br>    set to Yes, this option prevents Shorewall from altering the<br>    /etc/iproute2/rt_tables database. The KEEP_RT_TABLES option is only<br>    recognized by Shorewall-perl and is ignored by Shorewall-shell.<br><br>2)  Shorewall-perl now requires the FindBin Perl module.<br><br>3)  When an optional provider is not available, a script generated by<br>    Shorewall-perl will no longer add the corresponding<br>    routing rules.<br><br>4)  A new 'isusable' extension script has been added. This script<br>    allows you to extend the availability test that Shorewall performs<br>    on optional providers.<br><br>    Here's an example that uses ping to ensure that the default<br>    gateways through eth0 and eth1 are reachable:<br><br>    case $1 in<br>        eth0)<br>            ping -c 4 -I eth0 206.124.146.254 &gt; /dev/null 2&gt;&amp;1<br>            return<br>           ;;<br>        eth1)<br>            ping -c 4 -I eth1 192.168.12.254 &gt; /dev/null 2&gt;&amp;1<br>            return<br>            ;;<br>        *)<br>            # Assume we don't need to do any additional testing<br>            # for this interface beyond Shorewall's<br>            return 0<br>            ;;<br>    esac<br><br>    Additional information is available at<br>    http://www.shorewall.net/shorewall_extension_scripts.htm.<br><br>5)  Processing of the message log in the 'show log', 'logwatch' and<br>    'dump' commands has been speeded up thanks to a suggestion by<br>    Andrew Suffield.<br><br>6)  Beginning with Shorewall 4.0, the shorewall 'stop', and 'clear'<br>    commands were processed by the generated script from the<br>    last successful 'start', 'restart' or 'refresh' command. This had<br>    the side effect that updates to the /etc/shorewall/routestopped<br>    file did not take effect until one of those three commands was<br>    successfully processed.<br><br>    Beginning with Shorewall 4.0.3, the old 3.x behavior is restored as<br>    the default and the 4.0 behavior is enabled using the '-f' command<br>    option.<br><br>    Example: shorewall stop -f<br><br>    is only recognized by Shorewall-perl and causes Shorewall to set<br>    the MSS field in forwarded TCP SYN packets going in or out the<br>    interface to the value that you specify.<br><br>    Example:<br><br>    #ZONE       INTERFACE       BROADCAST       OPTIONS<br>    vpn         ppp0            -               mss=1400<br><br>    The mss option only affects incoming traffic that has not been<br>    decrypted by IPSEC and outgoing traffic that will not subsequently<br>    be encrypted by IPSEC. The MSS for IPSEC traffic is managed by the<br>    'mss' option in /etc/shorewall/zones.<br><br>8)  Shorewall now detects the presence of the 'hashlimit match'<br>    capability. There is no builtin support yet for hashlimit but<br>    detection allows extension scripts for user-supplied actions to<br>    determine if the capability exists.<br><br>    With Shorewall-shell, $HASHLIMIT_MATCH will be non-empty if the<br>    capability exists.<br><br>    With Shorewall-perl, $capabilities{HASHLIMIT_MATCH} will be true in<br>    a boolean context if the capability exists. Shorewall-perl users<br>    may also code the following in their extension script:<br><br>    use Shorewall::Config;<br><br>    require_capability( 'HASHLIMIT_MATCH',      #Capability<br>                        'My hashlimit action' , #Feature requiring <br>                                                #capability<br>                        's' );                  #Feature is singular<br>                                                #(if plural, pass the<br>                                                  empty string)<br><br>    That call would procduce the following fatal error if the<br>    capability isn't available:<br><br>    ERROR: My hashlimit action requires the Hashlimit match capability<br>           in your kernel and iptables<br><br>9)  NFQUEUE support has been added to Shorewall-perl.<br><br>    NFQUEUE may appear in actions, macros, rules and as a policy.<br>    When NFQUEUE is used by itself, queue number zero is assumed. To<br>    specify a queue number, follow NFQUEUE by a slash ("/") and the<br>    queue number.<br><br>    Examples (/etc/shorewall/rules):<br><br>    NFQUEUE             loc     net     tcp #Queue number 0<br>    NFQUEUE/22          loc     net     udp #Queue number 22<br>    NFQUEUE/22:info     loc     net     gre #With logging<br><br>    An NFQUEUE_DEFAULT option has been added to shorewall.conf for<br>    specifying the default action to use with NFQUEUE policies.<br><br>    Use of NFQUEUE requires the NFQUEUE Target capability in your<br>    kernel/iptables. If you intend to use NFQUEUE with Shorewall-lite,<br>    then you must install Shorewall-lite 4.0.3 in order to build a<br>    capabilities file that includes NFQUEUE Target. If your<br>    capabilities file was generated by a Shorewall/Shorewall-lite<br>    version earlier that 4.0.3, you will receive a warning during<br>    compilation.<br><br>10) The 'refresh' command can now refresh chains other than 'blacklst'.<br><br>    The syntax of the command is now:<br><br>        shorewall refresh [ &lt;chain&gt; ... ]<br><br>    If no &lt;chain&gt; is given then 'blacklst' is assumed. Otherwise, the<br>    Shorewall-perl compiler compiles a script whose 'refresh' command<br>    refreshes the listed &lt;chain&gt;(s).<br><br>    The listed chains are assumed to be in the filter table. You can<br>    refresh chains in other tables by prefixing the chain name with the<br>    table name followed by ":" (e.g., nat:net_dnat). Chain names which<br>    follow are assumed to be in that table until the end of the list or<br>    until an entry in the list names another table.<br><br>    This feature requires Shorewall-perl 4.0.3 as well as<br>    Shorewall-common 4.0.3.</pre>
-<hr>
-<p><strong>2007-08-19 Shorewall 3.4.6</strong></p>
-<pre>Problems Corrected in 3.4.6.<br><br>1)  If the "Mangle FORWARD Chain" capability was supported, entries in<br>    the /etc/shorewall/ecn file would cause invalid iptables<br>    commands to be generated.<br><br>2)  Certain errors occurring during<br>    start/restart/safe-start/safe-restart/try processing could cause<br>    the lockfile to be left behind. This resulted in a 60-second delay<br>    the next time one of these commands was run.<br><br>3)  It was not previously possible to define traffic shaping on a<br>    bridge port; the generated script complained that the<br>    interface was not up and configured.<br><br>4)  Previously, using a port list in the DEST PORT(S) column of the<br>    rules file or in an action file caused an invalid iptables command<br>    to be generated.<br><br>5)  Using the LOG target in the rules file could result in two LOG<br>    rules being generated. Additionally, using an IP address range in a<br>    rule that performed logging could result in an invalid iptables<br>    command.<br><br>6)  Shorewall now loads the act_police kernel module needed by traffic<br>    shaping.<br><br>7)  Previously, "shorewall show -f capabilities" and "shorecap" omitted<br>    the "TCPMSS Match" capability. This made it appear to a compiler<br>    using a capabilities file that the TCPMSS Match capability was not<br>    available.<br><br>8)  Previously, Shorewall would truncate long log prefixes to 29<br>    characters. This resulted in there being no space between the log<br>    prefix and the IN= part of the message.<br><br>    Example: fw2net:LOG:HTTPSoutIN= OUT=eth0<br><br>    Beginning with this release, Shorewall will truncate the prefix to<br>    28 bytes and add a trailing space.<br><br>    Example: fw2net:LOG:HTTPSou IN= OUT=eth0<br><br>9)  Previously, if:<br><br>    - FASTACCEPT=No<br>    - The policy from Z1 to Z2 was CONTINUE<br>    - Z1 and Z2 were orphans (neither had parent zones)<br>    - There were no Z1-&gt;Z2 rules<br><br>    then connections from Z2-&gt;Z1 would fail even if there were<br>    rules/policies allowing them. This has been<br>    corrected. <br>    <br>Other changes in 3.4.6.<br><br>1)  Processing of the message log in the 'show log', 'logwatch' and<br>    'dump' commands has been speeded up thanks to a suggestion by<br>    Andrew Suffield.</pre>
-<hr>
-<p><strong>2007-08-10 Shorewall 4.0.2</strong></p>
-<pre>Problems corrected in 4.0.2<br><br>1)  The Shorewall-perl compiler was still generating invalid<br>    iptables-restore input from entries in /etc/shorewall/ecn.<br><br>2)  When using Shorewall-perl, unless an interface was specified as<br>    'optional' in the interfaces file, the 'restore' command would<br>    fail if the routes through the interface or the addresses on the<br>    interface could not be detected.<br><br>    Route detection occurs when the interface is named in the SOURCE<br>    column of the masq file. Address detection occurs when<br>    DETECT_DNAT_IPADDRS=Yes and the interface is the SOURCE for a DNAT<br>    or REDIRECT rule or when 'maclist' is specified for the interface.<br>   <br>    Since the 'restore' command doesn't use the detected information,<br>    detection is now skipped if the command is 'restore'.<br><br>3)  It was not previously possible to define traffic shaping on a<br>    bridge port; the generated script complained that the<br>    interface was not up and configured.<br><br>4)  When Shorewall-shell was not installed, certain options in<br>    /etc/shorewall/interfaces and /etc/shorewall/hosts would cause the<br>    'add' and 'delete' commands to fail with a missing library error.<br><br>          OPTION               FILE<br>          maclist              interfaces,hosts<br>          proxyarp             interfaces<br><br>5)  The /var/lib/shorewall/zones file was being overwritten during<br>    processing of the 'refresh' command by a script generated with<br>    Shorewall-perl. The result was that hosts previously added to<br>    dynamic zones could not be deleted after the 'refresh'.<br><br>6)  If the file named as the output file in a Shorewall-perl 'compile'<br>    command was a symbolic link, the generated error message<br>    erroneously stated that the file's parent directory was a symbolic<br>    link.<br><br>    As part of this change, cosmetic changes were made to a number of<br>    other error messages.<br><br>7)  Some intra-zone rules were missing when a zone involved multiple<br>    interfaces or when a zone included both IPSEC and non-IPSEC<br>    networks.<br><br>8)  Shorewall was not previously loading the xt_multiport kernel<br>    module.<br><br>9)  The Russian and French translations no longer have English headings<br>    on notes, cautions, etc..<br><br>10) Previously, using a port list in the DEST PORT(S) column of the<br>    rules file or in an action file could cause an invalid iptables<br>    command to be generated by Shorewall-shell.<br><br>11) If there were no bridges in a configuration, Shorewall-perl would<br>    ignore the CHAIN column in /etc/shorewall/accounting.<br><br>Other changes in 4.0.2<br><br>1)  Shorewall-perl now detects when a port range is included in a list<br>    of ports and iptables/kernel support for Extended Multi-port Match<br>    is not available. This avoids an iptables-restore failure at<br>    run-time.<br><br>2)  Most chains created by Shorewall-shell have names that can be<br>    embedded within shell variable names. This is a workaround for<br>    limitations in the shell programming language which has no<br>    equivalent to Perl hashes. Often chain names must have the name of<br>    a network interface encoded in them. Given that interface names can<br>    contain characters that are invalid in a shell variable name,<br>    Shorewall-shell performs a name mapping which was carried forward to<br>    Shorewall-perl:<br><br>    - Trailing '+' is dropped.<br>    - The characters ".", "-", "%' and "@" are translated to "_".<br><br>    This mapping has been elminated in the 4.0.2 release of Shorewall-<br>    perl. So where before you would see chain "eth0_0_in", you may now<br>    see the same chain named "eth0.0_in". Similarly, a chain previously<br>    named "ppp_fwd" may now be called "ppp+_fwd".<br><br>3)  Shorewall-perl now uses the contents of the BROADCAST column in<br>    /etc/shorewall/interfaces when the Address Type match capability is<br>    not available.</pre>
-<hr>
-<p><strong>2007-07-30 Shorewall 4.0.1</strong></p>
-<pre>Problems corrected in 4.0.1.<br><br>1)  The Shorewall Lite installer was producing an empty shorewall-lite<br>    manpage. Since the installer runs as part of creating the RPM, the<br>    RPM also suffered from this problem. The 4.0.0 Shorewall-lite <br>    packages were re-uploaded with this problem corrected.<br><br>2)  The Shorewall Lite uninstaller incorrectly removed /sbin/shorewall<br>    rather than /sbin/shorewall-lite.<br><br>3)  Both the Shorewall and Shorewall Lite uninstallers did a "shorewall<br>    clear" if Shorewall [Lite] was running. Now, the Shorewall Lite<br>    uninstaller correctly does "shorewall-lite clear" and both<br>    uninstallers only perform the 'clear' operation if the other<br>    product is not installed. This prevents the removal of one of the<br>    two products from clearing the firewall configuration established<br>    by the other one.<br><br>4)  The 'ipsec' OPTION in /etc/shorewall/hosts was mis-handled by<br>    Shorewall-perl. If the zone type was changed to 'ipsec' or<br>    'ipsec4' and the 'ipsec' option removed from the hosts file entry,<br>    the configuration worked properly.<br><br>5)  If a CLASSID was specified in a tcrule and TC_ENABLED=No, then<br>    Shorewall-perl produced the following:<br><br>    Compiling...<br>    Use of uninitialized value in string ne at /usr/share/shorewall-perl/Shorewall/Tc.pm line 285, &lt;$currentfile&gt; line 18.<br>       ERROR: Class Id n:m is not associated with device eth0 : /etc/shorewall/tcrules (line 18)<br><br>6)  If IPTABLES was not specified in shorewall.conf, Shorewall-perl was<br>    locating the binary using the PATH environmental variable rather<br>    than the PATH setting in shorewall.conf.  If no PATH was available<br>    when Shorewall-perl was run and IPTABLES was not set in<br>    shorewall.conf, the following messages were issued:<br><br>    Use of uninitialized value in split at /usr/share/shorewall-perl/Shorewall/Config.pm line 1054.<br>       ERROR: Can't find iptables executable<br>       ERROR: Shorewall restart failed<br><br>7)  If the "Mangle FORWARD Chain" capability was supported, entries in<br>    the /etc/shorewall/ecn file would cause invalid iptables commands<br>    to be generated. This problem occurred with both compilers.<br><br>8)  Shorewall now starts at reboot after an upgrade from shorewall &lt;<br>    4.0.0. Previously, Shorewall was not started automatically at<br>    reboot after an upgrade using the RPMs.<br><br>9)  Shorewall-perl was generating invalid iptables-restore input when a<br>    log level was specified with the dropBcast and allowBcast builtin<br>    actions and when a log level followed by '!' was used with any<br>    builtin actions.<br><br>10) Shorewall-perl was incorrectly rejecting 'min' as a valid unit of<br>    time in rate-limiting specifications.<br><br>11) Certain errors occurring during<br>    start/restart/safe-start/safe-restart/try processing could cause<br>    the lockfile to be left behind. This resulted in a 60-second delay<br>    the next time one of these commands was run.<br><br>Other changes in Shorewall 4.0.1.<br><br>1)  A new EXPAND_POLICIES option is added to shorewall.conf. The<br>    option is recognized by Shorewall-perl and is ignored by<br>    Shorewall-shell.<br><br>    Normally, when the SOURCE or DEST columns in shorewall-policy(5)<br>    contains 'all', a single policy chain is created and the policy is<br>    enforced in that chain. For example, if the policy entry is<br><br>             #SOURCE DEST POLICY LOG<br>             #                   LEVEL<br>             net     all  DROP   info<br><br>    then the chain name is 'net2all' which is also the chain named in<br>    Shorewall log messages generated as a result of the policy. If<br>    EXPAND_POLICIES=Yes, then Shorewall-perl will create a separate<br>    chain for each pair of zones covered by the policy. This makes the<br>    resulting log messages easier to interpret since the chain in the<br>    messages will have a name of the form 'a2b' where 'a' is the SOURCE<br>    zone and 'b' is the DEST zone. See<br>    http://linuxman.wikispaces.com/PPPPPPS for more information.<br><br>2)  The Shorewall-perl dependency on the "Address Type Match"<br>    capability has been relaxed. This allows Shorewall 4.0.1 to be used<br>    on releases like RHEL4 that don't support that capability.<br><br>3)  Shorewall-perl now detects dead policy file entries that result<br>    when an entry is masked by an earlier entry. Example:<br><br>         all     all      REJECT    info<br>         loc     net      ACCEPT<br><br>4)  Recent kernels are apparently hard to configure and we have been<br>    seeing a lot of problem reports where the root cause is the lack of<br>    state match support in the kernel. This problem is difficult to<br>    diagnose when using Shorewall-perl so the generated shell program<br>    now checks specifically for this problem and terminates with an<br>    error if the capability doesn't exist.</pre>
-<hr style="width: 100%; height: 2px;">
-<p><strong>2007-07-20 Shorewall 4.0.0</strong></p>
-<pre>----------------------------------------------------------------------------<br>                   R E L E A S E  H I G H L I G H T S<br>----------------------------------------------------------------------------<br>1) This is the first Shorewall release that fully integrates the new<br>   Shorewall-perl compiler. See the "New Features" section below.<br><br>2) You are now offered a choice as to which compiler(s) you install. In<br>   4.0.0, there are the following packages:<br><br>   - Shorewall-common ( common files )<br>   - Shorewall-shell ( the shell-based compiler )<br>   - Shorewall-perl (the Perl-based compiler )<br><br>   You must install at least one of the compiler packages (you may<br>   install them both) along with Shorewall-common.<br><br>   YOU DO NOT NEED TO UNINSTALL ANY OF YOUR CURRENT PACKAGES.<br><br>   See the Migration Considerations below for further information.<br><br>3) The facilities for supporting bridge/firewalls under earlier<br>   releases are deprecated and their documentation is omitted from the<br>   4.0 distribution. New bridge support is implemented in the<br>   Shorewall-perl compiler. This support utilizes the reduced-function<br>   physdev match support available in Linux kernel 2.6.20 and later.<br><br>Problems corrected in 4.0.0 Final.<br><br>1)  The shorewall-lite install.sh may now be run multiple times from<br>    the same directory. Previously, the manpages were gzipped in-place<br>    which made it impossible to rerun the script.<br><br>2)  If shorewall.conf contained SHOREWALL_COMPILER=shell (which it can<br>    on Shorewall 3.4.2-4 systems) and the shorewall-shell RPM was<br>    removed, subsequent "shorewall [re]start" operations failed. When<br>    shorewall-shell is removed, the shorewall.conf file is modified to<br>    specify SHOREWALL_COMPILER= and the original is saved in<br>    shorewall.conf.rpmsave.<br><br>3)  The contents of the LOG LEVEL column in /etc/shorewall/policy are<br>    now validated at compile time by Shorewall-perl.<br><br>Other changes in Shorewall 4.0.0 Final.<br><br>1)  The Perl modules in /usr/share/shorewall-perl/Shorewall/ have been<br>    consolidated somewhat, leading to slightly faster compilation.<br><br>Migration Considerations:<br><br>1)  Beginning with Shorewall 4.0.0, there is no single 'shorewall'<br>    package. Rather there are two compiler packages (shorewall-shell<br>    and shorewall-perl) and a set of base files (shorewall-common)<br>    which are required by either compiler package.<br><br>    Although the names of the packages are changing, you can upgrade<br>    without having to uninstall/reinstall.<br><br>    To repeat: YOU DO NOT NEED TO UNINSTALL ANY EXISTING PACKAGE.<br><br>    If you attempt to upgrade using the shorewall-common RPM, you get<br>    this result:<br>    gateway:~ # rpm -Uvh shorewall-common-4.0.0.noarch.rpm <br>    error: Failed dependencies:<br>        shorewall_compiler is needed by shorewall-common-4.0.0-1.noarch<br>    gateway:~ #<br><br>    You must either:<br><br>        rpm -Uvh shorewall-shell-4.0.0.noarch.rpm \<br>            shorewall-common-4.0.0.noarch.rpm<br><br>    or<br><br>        rpm -Uvh shorewall-shell-4.0.0.noarch.rpm \<br>            shorewall-perl-4.0.0.noarch.rpm \<br>            shorewall-common-4.0.0.noarch.rpm<br><br>    If you don't want to use shorewall-perl exclusively then use the<br>    second command above then<br><br>        rpm -e shorewall-shell<br> <br>    If you are upgrading using the tarball, you must install <br>    shorewall-shell and/or shorewall-perl before you upgrade<br>    using shorewall-common. Otherwise, the install.sh script fails with:<br><br>         ERROR: No Shorewall compiler is installed<br><br>    The shorewall-shell and shorewall-perl packages are installed from<br>    the tarball in the expected way; untar the package, and run the<br>    install.sh script.<br><br>    Example 1: You have 'shorewall' installed and you want to continue<br>    to use the shorewall-shell compiler.<br><br>        tar -jxf shorewall-common-4.0.0.tar.bz2<br>        tar -jxf shorewall-shell-4.0.0.tar.bz2<br><br>        cd shorewall-shell-4.0.0<br>        ./install.sh<br>        cd ../shorewall-common-4.0.0<br>        ./install.sh<br>        shorewall check<br>        shorewall restart<br><br>    Example 2: You have shorewall 3.4.4 and shorewall-perl 4.0.0-Beta7<br>    installed and you want to upgrade to 4.0. You do not need the<br>    shell-based compiler.<br><br>        tar -jxf shorewall-common-4.0.0.tar.bz2<br>        tar -jxf shorewall-perl-4.0.0.tar.bz2<br><br>        cd shorewall-perl-4.0.0<br>        ./install.sh<br>        cd ../shorewall-common-4.0.0<br>        ./install.sh<br>        shorewall check<br>        shorewall restart<br><br>        Be sure to modify shorewall.conf if it still has<br>        SHOREWALL_COMPILER=shell.<br><br>2)  The ROUTE_FILTER and LOG_MARTIANS options in shorewall.conf work<br>    slightly differently in Shorewall 4.0.0. In prior releases, leaving<br>    these options empty was equivalent to setting them to 'No' which<br>    caused the corresponding flag in /proc to be reset for all<br>    interfaces. Beginning in Shorewall 4.0.0, leaving these options<br>    empty causes Shorewall to leave the flags in /proc as they are. You<br>    must set the option to 'No' in order to obtain the old behavior.<br><br>3)  The -f option is no longer the default when Shorewall is started at<br>    boot time (usually via /etc/init.d/shorewall). With Shorewall-perl,<br>    "shorewall start" is nearly as fast as "shorewall restore" and<br>    "shorewall start" uses the current configuration which avoids<br>    confusion.<br><br>    If you plan on continuing to use Shorewall-shell and you want to<br>    use the "-f" option at boot time, then you must add the following<br>    to /etc/sysconfig/shorewall or /etc/default/shorewall:<br><br>       OPTIONS="-f"<br><br>    If you currently have neither of those files, you will need to<br>    create one of them. <br><br>4)  This issue will only affect you if you use Shorewall Lite and have<br>    modified /usr/share/configpath to specify a different LITEDIR.<br><br>    The implementation of LITEDIR has always been<br>    unsatisfactory. Furthermore, there have been other cases where<br>    people have asked to be able to designate the state directory<br>    (default /var/lib/shorewall[-lite]).<br><br>    To meet these objectives:<br><br>    a)  The LITEDIR variable has been eliminated in<br>        /usr/share/shorewall[-lite]/configpath.<br><br>    b)  A new file /etc/shorewall[-lite]/vardir has been added. This<br>        file is not created by default but may be added as needed. It<br>        is expected to contain a single variable assignment:<br><br>           VARDIR=&lt;directory&gt;<br><br>        Example:<br><br>           VARDIR=/root/shorewall<br>    <br>    To change VARDIR, copy the old directory to the new one before you<br>    restart Shorewall[-lite].<br><br>    To use this feature with Shorewall-lite, all packages involved<br>    (compiler, shorewall-common and shorewall-lite) must be version<br>    4.0.0-RC2 or later.<br><br>----------------------------------------------------------------------------<br>                         N E W  F E A T U R E S<br>----------------------------------------------------------------------------<br>1)  Shorewall-perl<br><br>    This Shorewall package includes a complete rewrite of the compiler<br>    in Perl.<br><br>    I decided to make Shorewall-perl a separate package for several reasons:<br><br>    a) Embedded applications are unlikely to adopt Shorewall-perl; even<br>       Mini-Perl has a substantial disk and RAM footprint.<br><br>    b) Because of the gross incompatibilities between the new compiler and the<br>       old (see below), migration to the new compiler must be voluntary.<br>    ------------------------------------------------------------------------<br>                      T H E   G O O D   N E W S:<br>    ------------------------------------------------------------------------<br>    a) The compiler has a small disk footprint.<br>    b) The compiler is very fast.<br>    c) The compiler generates a firewall script that uses iptables-restore;<br>       so the script is very fast.<br>    d) The new compiler does a much better job of validating the<br>       configuration and catches many errors that resulted in run-time<br>       failures with the old compiler.<br>    e) Use of the Shorewall-perl is optional! The old slow clunky<br>       Bourne-shell compiler is still available.<br>    ------------------------------------------------------------------------<br>                      T H E   B A D   N E W S:<br>    ------------------------------------------------------------------------<br>    There are a number of incompatibilities between the Perl-based compiler<br>    and the Bourne-shell one.<br><br>    a) The Perl-based compiler requires the following capabilities in your<br>       kernel and iptables.<br><br>       - addrtype match<br>       - multiport match<br><br>       These capabilities are in current distributions.<br><br>    b) Now that Netfilter has features to deal reasonably with port lists,<br>       I see no reason to duplicate those features in Shorewall. The<br>       Bourne-shell compiler goes to great pain (in some cases) to<br>       break very long port lists ( &gt; 15 where port ranges in lists<br>       count as two ports) into individual rules. In the new compiler, I'm<br>       avoiding the ugliness required to do that. The new compiler just<br>       generates an error if your list is too long. It will also produce<br>       an error if you insert a port range into a port list and you don't<br>       have extended multiport support.<br><br>    c) The old BRIDGING=Yes support has been replaced by new bridge<br>       support that uses the reduced 'physdev match' capabilities found<br>       in kernel 2.6.20 and later. This new implementation may be used<br>       where it is desired to control traffic through a bridge.<br><br>       The new implementation includes the following features:<br><br>       a)  A new "Bridge Port" zone type is defined. Specify 'bport' or<br>           'bport4' in the TYPE column of /etc/shorewall/zones.<br><br>           Bridge Port zones should be a sub-zone of a regular ipv4 zone<br>           that represents all hosts attached to the bridge.<br><br>       b)  A new 'bridge' option is defined for entries in      <br>           /etc/shorewall/interfaces. Bridges should have this option<br>           specified, even if you don't want to filter traffic going<br>           through the bridge.<br><br>       c)  Bridge ports must now be defined in<br>           /etc/shorewall/interfaces. The INTERFACE column contains<br>           both the bridge name and the port name separated by a colon<br>           (e.g., "br0:eth1"). No OPTIONS are allowed for bridge<br>           ports. The bridge must be defined before its ports and must<br>           have the 'bridge' option.<br><br>       Bridge Port (BP) zones have a number of limitations:<br><br>       a)  Each BP zone may only be associated with ports on a single<br>           bridge.<br><br>       b)  BP zones may not be associated with interfaces that are not<br>           bridge ports.<br><br>       c)  You may not have policies or rules where the DEST is a BP<br>           zone but the source is not a BP zone. If you need such<br>           rules, you must use the BP zone's parent zone as the DEST<br>           zone.<br><br>       Example (Bridge br0 with ports eth1 and tap0):<br><br>       /etc/shorewall/zones:<br><br>        fw      firewall<br>        net     ipv4<br>        loc     ipv4<br>        lan:loc bport<br>        vpn:loc bport<br><br>       /etc/shorewall/interfaces:<br><br>        net     eth0    -       ...<br>        loc     br0     -       ...<br>        lan     eth1<br>        vpn     tap0<br><br>       When using the /etc/shorewall/hosts file to define a bport4<br>       zone, you specify only the port name:<br><br>       Example:<br><br>       /etc/shorewall/zones:<br><br>        fw      firewall<br>        net     ipv4<br>        loc     ipv4<br>        lan:loc bport<br>        vpn:loc bport<br><br>       /etc/shorewall/hosts<br><br>        lan     eth1:192.168.2.0/24     ...<br><br>       The structure of the accounting rules changes slightly when<br>       there are bridges defined in the Shorewall<br>       configuration. Because of the restrictions imposed by Netfilter<br>       in kernel 2.6.21 and later, output accounting rules must be<br>       segregated from forwarding and input rules.<br><br>       To accomplish this separation, Shorewall-perl creates two<br>       accounting chains:<br><br>       - accounting - for input and forwarded traffic.<br>       - accountout - for output traffic.<br><br>       If the CHAIN column contains '-', then:<br><br>       - If the SOURCE column in a rule includes the name of the<br>         firewall zone (e.g., $FW), then the rule is add only<br>         to the accountout chain.<br><br>       - Otherwise, if the DEST in the rule is any or all or 0.0.0.0/0,<br>         then the rule is added to both accounting and accountout.<br><br>       - Otherwise, the rule is added to accounting only.<br><br>       See http://www.shorewall.net/bridge-Shorewall-perl.html for<br>       additional information about the new bridge support.     <br><br>    d) The BROADCAST column in the interfaces file is essentially unused;<br>       if you enter anything in this column but '-' or 'detect', you will<br>       receive a warning.<br><br>    e) Because the compiler is written in Perl, some of your extension<br>       scripts from earlier versions will no longer work because<br>       Shorewall-perl runs those extension scripts at compile-time rather<br>       than at run-time. <br><br>       Compile-time scripts are:<br><br>           initdone<br>           maclog<br>           All per-chain scripts including those associated with actions.<br><br>       Compile-time extension scripts are executed using the Perl 'eval<br>       `cat &lt;file&gt;`' mechanism. Be sure that each script returns a<br>       'true' value; otherwise, the compiler will assume that the<br>       script failed and will abort the compilation.<br><br>       All scripts will need to begin with the following line:<br><br>           use Shorewall::Chains;<br><br>       For more complex scripts, you may need to 'use' other Shorewall<br>       Perl modules -- browse /usr/share/shorewall-perl/Shorewall/ to<br>       see what's available.<br><br>       When a script is invoked, the $chainref scalar variable will hold a<br>       reference to a chain table entry. <br><br>           $chainref-&gt;{name}  contains the name of the chain<br>           $chainref-&gt;{table} holds the table name<br>       <br>           To add a rule to the chain:<br><br>              add_rule( $chainref, &lt;the rule&gt; );<br><br>           Where<br><br>              &lt;the rule&gt; is a scalar argument holding the rule text. Do<br>              not include "-A &lt;chain name&gt;"<br><br>           Example:<br><br>              add_rule( $chainref, '-j ACCEPT' );<br><br>           To insert a rule into the chain:<br><br>              insert_rule( $chainref, &lt;rulenum&gt;, &lt;the rule&gt; );<br><br>           The log_rule_limit function works like it does in the shell<br>           compiler with two exceptions:<br><br>              - You pass the chain reference rather than the name of<br>                the chain.<br>              - The commands are 'add' and 'insert' rather than '-A'<br>                and '-I'.<br>              - There is only a single "pass as-is to iptables"<br>                argument (so you must quote that part).<br><br>           Example:<br><br>              log_rule_limit(<br>                             'info' , <br>                              $chainref ,            <br>                              $chainref-&gt;{name},<br>                              'DROP' , <br>                              '',      #Limit<br>                              '' ,     #Log tag<br>                              'add',   #Command<br>                              '-p tcp' #Pass as-is<br>                             );<br><br>       Note that in the 'initdone' script, there is no default chain<br>       ($chainref). You can objtain a reference to a standard chain by:<br><br>           my $chainref = $chain_table{&lt;table&gt;}{&lt;chain name&gt;};<br><br>       Example:<br><br>           my $chainref = $chain_table{'filter'}{'INPUT'};<br><br>       The continue script is eliminated. That script was designed to<br>       allow you to add special rules during [re]start. Shorewall-perl<br>       doesn't need such rules.<br><br>       See http://www.shorewall.net/shorewall_extension_scripts.htm<br>       for further information about extension scripts under<br>       Shorewall-perl.<br><br>    f) The 'refresh' command now works like 'restart' with the<br>       following exceptions:<br><br>       - The refresh command is rejected if Shorewall is not running.<br>       - The refresh command only rebuilds the 'blacklst' chain.<br>       - A directory name may not be specified in the refresh command.<br><br>    g) The /etc/shorewall/tos file now has zone-independent SOURCE and<br>       DEST columns as do all other files except the rules and policy<br>       files.<br><br>       The SOURCE column may be one of the following:<br><br>           [all:]&lt;address&gt;[,...]<br>           [all:]&lt;interface&gt;[:&lt;address&gt;[,...]]<br>           $FW[:&lt;address&gt;[,...]]<br><br>       The DEST column may be one of the following:<br>       <br>           [all:]&lt;address&gt;[,...]<br>           [all:]&lt;interface&gt;[:&lt;address&gt;[,...]]<br><br>       This is a permanent change. The old zone-based rules have never<br>       worked right and this is a good time to replace them. I've tried<br>       to make the new syntax cover the most common cases without<br>       requiring change to existing files. In particular, it will<br>       handle the tos file released with Shorewall 1.4 and earlier.<br><br>    h) Shorewall is now out of the ipset load/reload business. With<br>       scripts generated by the Perl-based Compiler, the Netfilter<br>       ruleset is never cleared. That means that there is no<br>       opportunity for Shorewall to load/reload your ipsets since that<br>       cannot be done while there are any current rules using ipsets.<br><br>       So:<br><br>        i)   Your ipsets must be loaded before Shorewall starts. You<br>             are free to try to do that with the following code in<br>             /etc/shorewall/start:<br><br>             if [ "$COMMAND" = start ]; then<br>                ipset -U :all: :all:<br>                ipset -F<br>                ipset -X<br>                ipset -R &lt; /my/ipset/contents<br>             fi<br><br>             The file '/my/ipset/contents' (not its real name of<br>             course) will normally be produced using the ipset -S<br>             command.<br><br>             The above will work most of the time but will fail in a<br>             'shorewall stop' - 'shorewall start' sequence if you<br>             use ipsets in your routestopped file (see below).<br><br>        ii)  Your ipsets may not be reloaded until Shorewall is stopped<br>             or cleared.<br><br>        iii) If you specify ipsets in your routestopped file then<br>             Shorewall must be cleared in order to reload your ipsets.<br><br>       As a consequence, scripts generated by the Perl-based compiler<br>       will ignore /etc/shorewall/ipsets and will issue a warning if<br>       you set SAVE_IPSETS=Yes in shorewall.conf.<br><br>    i) Because the configuration files (with the exception of<br>       /etc/shorewall/params) are now processed by the Perl-based<br>       compiler rather than by the shell, only the basic forms of Shell<br>       expansion ($variable and ${variable}) are supported. The more<br>       exotic forms such as ${variable:=default} are not<br>       supported. Both variables defined in /etc/shorewall/params and<br>       environmental variables (exported by the shell) can be used in<br>       configuration files.<br><br>    j) USE_ACTIONS=No is not supported. That option is intended to<br>       minimize Shorewall's footprint in embedded applications. As a<br>       consequence, Default Macros are not supported.<br><br>    k) DELAYBLACKLISTLOAD=Yes is not supported. The entire ruleset is<br>       atomically loaded with one execution of iptables-restore.<br><br>    l) MAPOLDACTIONS=Yes is not supported. People should have converted<br>       to using macros by now.<br><br>    m) The pre Shorewall-3.0 format of the zones file is not supported;<br>       neither is the /etc/shorewall/ipsec file.<br><br>    n) BLACKLISTNEWONLY=No is not permitted with FASTACCEPT=Yes. This<br>       combination doesn't work in previous versions of Shorewall so<br>       the Perl-based compiler simply rejects it.<br><br>    o) Shorewall-perl has a single rule generator that is used for all<br>       rule-oriented files. So it is important that the syntax is<br>       consistent between files.<br>       <br>       With shorewall-shell, there is a special syntax in the SOURCE<br>       column of /etc/shorewall/masq to designate "all traffic entering<br>       the firewall on this interface except...".<br><br>       Example:<br><br>       #INTERFACE       SOURCE                  ADDRESSES<br>       eth0             eth1!192.168.4.9        ...<br><br>       Shorewall-perl uses syntax that is consistent with the rest of<br>       Shorewall:<br><br>       #INTERFACE       SOURCE                  ADDRESSES<br>       eth0             eth1:!192.168.4.9       ...<br><br>    p) The 'allowoutUPnP' built-in action is no longer supported. The<br>       Netfilter team have removed support for '-m owner --owner-cmd'<br>       which that action depended on. <br><br>    q) The treatment of the following interface options has changed under<br>       Shorewall-perl.<br><br>       - arp_filter<br>       - routefilter<br>       - logmartians<br>       - proxy_arp<br>       - sourceroute<br><br>       With the Shorewall-shell compiler, Shorewall resets these options<br>       on all interfaces then sets the option on those interfaces<br>       for which the option is defined in /etc/shorewall/interfaces.<br><br>       Under Shorewall-perl, these options can be specified with the value<br>       0 or 1 (e.g., proxy_arp=0). If no value is specified, the value 1<br>       is assumed. Shorewall will modify only the setting of those<br>       interfaces for which the option is specified and will set the<br>       option to the given value.<br><br>       A fatal compilation error is also generated if you specify one of<br>       these options with a wildcard interface (one ending with '+').<br><br>    r) The LOG_MARTIANS and ROUTE_FILTER options are now tri-valued in<br>       Shorewall-perl.<br><br>        Yes -  Same as before<br>        No  -  Same as before except that it applies regardless of<br>               whether any interfaces have the logmartians/routefilter<br>               option<br>        Keep - Shorewall ignores the option entirely (which is the<br>        default).<br><br>    s)  Shorewall-perl support nn 'optional' option has been added to<br>        /etc/shorewall/interfaces. This option is recognized by<br>        Shorewall-perl but not by Shorewall-shell. When 'optional' is<br>        specified for an interface, Shorewall will be silent when:<br><br>        - a /proc/sys/net/ipv4/conf/ entry for the interface cannot be<br>          modified (including for proxy ARP).<br><br>        - The first address of the interface cannot be obtained.<br><br>        I specify 'optional' on interfaces to Xen virtual machines that<br>        may or may not be running when Shorewall is [re]started.<br><br>        CAUTION: Use 'optional' at your own risk. If you [re]start<br>        Shorewall when an 'optional' interface is not available and then<br>        do a 'shorewall save', subsequent 'shorewall restore' and<br>        'shorewall -f start' operations will instantiate a ruleset that<br>        does not support that interface, even if it is available at the<br>        time of the restore/start.<br><br>     t) Shorewall-perl validates all IP addresses and addresses ranges<br>        in rules. DNS names are resolved and an error is issued for any<br>        name that cannot be resolved.<br>     u) Shorewall-perl checks configuration files for the presense of<br>        characters that can cause problems if they are allowed into the<br>        generated firewall script:<br><br>        - Double Quotes. These are prohibited except in the<br>          shorewall.conf and params files.<br><br>        - Single Quotes. These are prohibited except in the<br>          shorewall.conf and params files and in COMMENT lines.<br><br>        - Single back quotes. These are prohibited except in the <br>          shorewall.conf and params files.<br><br>        - Backslash. Probibited except as the last character on a line<br>          to denote line continuation.<br><br>     v) Under Shorewall-perl, macros may invoke other macros with the<br>        restriction that such macros may not be invoked within an action<br>        body.<br><br>        When marcros are invoked recursively, the parameter passed to an<br>        invocation are automatically propagated to lower level macros.<br><br>         Macro invocations may be nested to a maximum level of 5.<br>    ------------------------------------------------------------------------<br>                      P R E R E Q U I S I T E S<br>    ------------------------------------------------------------------------<br>    - Perl (I use Perl 5.8.8 but other versions should work fine)<br>    - Perl Cwd Module<br>    - Perl File::Basename Module<br>    - Perl File::Temp Module<br>    - Perl Getopt::Long Module<br>    ------------------------------------------------------------------------<br>               U S I N G   T H E   N E W   C O M P I L E R<br>    If you only install one compiler, then that compiler will be used.<br><br>    If you install both compilers, then the compiler actually used depends<br>    on the SHOREWALL_COMPILER setting in shorewall.conf.<br><br>    The value of this new option can be either 'perl' or 'shell'.<br><br>    If you add 'SHOREWALL_COMPILER=perl' to /etc/shorewall/shorewall.conf<br>    then by default, the new compiler will be used on the system. If you<br>    add it to shorewall.conf in a separate directory (such as a<br>    Shorewall-lite export directory) then the new compiler will only be<br>    used when you compile from that directory.<br><br>    If you only install one compiler, it is suggested that you do not set<br>    SHOREWALL_COMPILER.<br><br>    You can also select the compiler to use on the command line using the<br>    'C option:<br><br>       '-C shell' means use the shell compiler<br>       '-C perl' means use the perl compiler<br><br>    The -C option overrides the setting in shorewall.conf. <br><br>    Example:<br><br>        shorewall restart -C perl<br><br>2)  Thanks to Paul Gear, an IPPServer macro has been added. Be sure to<br>    read the comments in the macro file before trying to use this<br>    macro.<br><br>3)  Eariler generations of Shorewall Lite required that remote root<br>    login via ssh be enabled in order to use the 'load' and 'reload'<br>    commands.<br><br>    Beginning with this release, you may define an alternative means<br>    for accessing the remote firewall system.<br><br>    Two new options have been added to shorewall.conf:<br><br>        RSH_COMMAND<br>        RCP_COMMAND<br><br>    The default values for these are as follows:<br><br>        RSH_COMMAND: ssh ${root}@${system} ${command}<br>        RCP_COMMAND: scp ${files} ${root}@${system}:${destination}<br><br>    Shell variables that will be set when the commands are envoked are<br>    as follows:<br><br>       root  - root user. Normally 'root' but may be overridden using<br>               the '-r' option.<br><br>       system - The name/IP address of the remote firewall system.<br><br>       command - For RSH_COMMAND, the command to be executed on the <br>                 firewall system.<br><br>       files   - For RCP_COMMAND, a space-separated list of files to<br>                 be copied to the remote firewall system.<br><br>       destination - The directory on the remote system that the files <br>                     are to be copied into. <br><br>4)  The accounting, masq, rules and tos files now have a 'MARK' column<br>    similar to the column of the same name in the tcrules file. This<br>    column allows filtering by MARK and CONNMARK value (CONNMARK is<br>    only accepted under Shorewall Perl).<br><br>5)  SOURCE and DEST are now reserved zone names to avoid problems with<br>    bi-directional macro definitions which use these as names as key<br>    words.<br><br>6)  The "shorewall show zones" command now flags zone members that have<br>    been added using "shorewall add" by preceding them with a plus sign<br>    ("+").<br><br>    Example:<br><br>    Shorewall 3.9.4 Zones at gateway - Mon May 14 07:48:16 PDT 2007<br><br>    fw (firewall)<br>    net (ipv4)<br>        eth0:0.0.0.0/0<br>    loc (ipv4)<br>        br0:0.0.0.0/0<br>        eth4:0.0.0.0/0<br>        eth5:0.0.0.0/0<br>        +eth1:0.0.0.0/0<br>    dmz (ipv4)<br>        eth3:0.0.0.0/0<br>    vpn (ipv4)<br>        tun+:0.0.0.0/0<br><br>    In the above output, "eth1:0.0.0.0/0" was dynamically added to the<br>    'loc' zone. As part of this change, "shorewall delete" will only<br>    delete entries that have been added dynamically. In earlier<br>    versions, any entry could be deleted although the ruleset was only<br>    changed by deleting entries that had been added dynamically.<br><br>7)  The 'shorewall version' command now lists the version of the<br>    installed compiler(s) if the -a option is used:<br><br>    gateway:/bulk/backup # shorewall version -a<br>    4.0.0-Beta1<br>    Shorewall-shell 4.0.0-Beta1<br>    Shorewall-perl 4.0.0-Beta1<br>    gateway:/bulk/backup #<br><br>8)  The Perl compiler is externalized. Both the compiler.pl program<br>    and the Perl Module interface are documented.<br><br>    The compiler program is /usr/share/shorewall-perl/compiler.pl:<br><br>        compiler.pl [ &lt;option&gt; ... ] [ &lt;filename&gt; ]<br><br>    If a &lt;filename&gt; is given, then the configuration will be compiled<br>    output placed in the named file. If &lt;filename&gt; is not given, then<br>    the configuration will simply be syntax checked.<br><br>    Options are:<br><br>    -v &lt;verbosity&gt;<br>    --verbosity=&lt;verbosity&gt;<br>    <br>        The &lt;verbosity&gt; is a number between 0 and 2 and corresponds to<br>        the VERBOSITY setting in shorewall.conf. This setting controls<br>        the verbosity of the compiler itself.<br><br>    -e<br>    --export<br><br>        If given, the configuration will be compiled for export to<br>        another system.<br><br>    -d &lt;directory&gt;<br>    --directory=&lt;directory&gt;<br><br>        If this option is omitted, the configuration in /etc/shorewall<br>        is compiled/checked. Otherwise, the configuration in the named<br>        directory will be compiled/checked.<br><br>    -t<br>    --timestamp<br><br>        If given, each progress message issued by the compiler and by<br>        the compiled program will be timestamped.<br><br>    --debug<br><br>        If given, when a warning or error message is issued, it is <br>        supplimented with a stack trace. Requires the Carp Perl<br>        module.<br><br>    Example (compiles the configuration in the current directory <br>             generating a script named 'firewall' and using VERBOSITY<br>             2).<br><br>       /usr/share/shorewall-perl/compiler.pl -v 2 -d . firewall<br><br>    Note: For compatibility with the Shorewall 3.4.2 and 3.4.3<br>    releases, options not passed on the run-line get their values from<br>    environmental variables:<br><br>           Option                 Variable<br><br>           --verbosity            VERBOSE<br>           --export               EXPORT<br>           --directory            SHOREWALL_DIR<br>           --timestamp            TIMESTAMP<br><br>    The Perl Module is externalized as follows:<br><br>        use lib '/usr/share/shorewall-perl';<br>        use Shorewall::Compiler;<br>        <br>            compiler $filename, $directory, $verbose, $options<br><br>    The arguments to the compiler function are as follows:<br><br>        $filename -   Name of the compiled script to be created.<br>                      If the arguments evaluates to false, the<br>                      configuration is syntax checked<br>                      <br>        $directory -  The directory containing the configuration.<br>                      If passed as '', then /etc/shorewall/ is assumed.<br><br>        $verbose -    The verbosity level (0-2).<br><br>        $options -    A bitmap of options. Shorewall::Compiler<br>                      exports two constants to help building this<br>                      argument:<br><br>                        EXPORT    = 0x01<br>                        TIMESTAMP = 0x02<br><br>    The compiler raises an exception with 'die' if it encounters an<br>    error; $@ contains the 'ERROR' messages describing the problem.<br>    <br>    The compiler function can be called repeatedly with different<br>    inputs.<br><br>9)  When TC_ENABLED=Internal, Shorewall-perl now validates classids in<br>    the MARK/CLASSIFY column of /etc/shorewall/tcrules against the<br>    classes generated by /etc/shorewall/tcclasses.<br><br>10) During installation, Shorewall generates the Perl module<br>    /usr/share/shorewall-perl/Shorewall/Ports.pm, using your<br>    /etc/protocols and /etc/services as input.<br><br>    To re-generate the module from those two files:<br><br>        1. Backup your current /usr/share/shorewall-perl/Shorewall/Ports.pm<br>           file.<br>        2. /usr/share/shorewall-perl/buildports.pl &gt; \<br>           /usr/share/shorewall-perl/Shorewall/Ports.pm<br><br>    Note: If the buildports.pl program fails to run to a successful<br>    completion during installation, a fallback version of<br>    module will be installed. That fallback module was generated from<br>    the /etc/protocols and /etc/services shipped with Ubuntu Feisty<br>    Fawn.<br><br>    Even if the buildports.pl program runs successfully, the fallback<br>    module is also installed as<br>    /usr/share/shorewall-perl/Shorewall/FallbackPorts.pm. So if you<br>    encounter problems with the generated module, simply copy the<br>    fallback module to /usr/share/shorewall-perl/Shorewall/Ports.pm.<br><br>11) Tuomo Soini has contributed bi-directional macros for various<br>    tunnel types:<br><br>          IPsecah<br>          GRE<br>          IPsec<br>          IPIP<br>          IPsecnat<br>          L2TP<br><br>12) The -f option is no longer the default when Shorewall is started at<br>    boot time (usually via /etc/init.d/shorewall). With Shorewall-perl,<br>    "shorewall start" is nearly as fast as "shorewall restore" and<br>    "shorewall start" uses the current configuration which avoids<br>    confusion.<br><br><br>    To re-generate the module from those two files:<br><br>        1. Backup your current /usr/share/shorewall-perl/Shorewall/Ports.pm<br>           file.<br>        2. /usr/share/shorewall-perl/buildports.pl &gt; \<br>           /usr/share/shorewall-perl/Shorewall/Ports.pm<br><br>    Note: If the buildports.pl program fails to run to a successful<br>    completion during installation, a fallback version of<br>    module will be installed. That fallback module was generated from<br>    the /etc/protocols and /etc/services shipped with Ubuntu Feisty<br>    Fawn.<br><br>    Even if the buildports.pl program runs successfully, the fallback<br>    module is also installed as<br>    /usr/share/shorewall-perl/Shorewall/FallbackPorts.pm. So if you<br>    encounter problems with the generated module, simply copy the<br>    fallback module to /usr/share/shorewall-perl/Shorewall/Ports.pm.<br><br>11) Tuomo Soini has contributed bi-directional macros for various<br>    tunnel types:<br><br>          IPsecah<br>          GRE<br>          IPsec<br>          IPIP<br>          IPsecnat<br>          L2TP<br><br>12) The -f option is no longer the default when Shorewall is started at<br>    boot time (usually via /etc/init.d/shorewall). With Shorewall-perl,<br>    "shorewall start" is nearly as fast as "shorewall restore" and<br>    "shorewall start" uses the current configuration which avoids<br>    confusion.<br><br>13) The implementation of LITEDIR has always been<br>    unsatisfactory. Furthermore, there have been other cases where<br>    people have asked to be able to designate the state directory<br>    (default /var/lib/shorewall[-lite]).<br><br>    To meet these objectives:<br><br>    a)  The LITEDIR variable has been eliminated in<br>        /usr/share/shorewall[-lite]/configpath.<br><br>    b)  A new file /etc/shorewall[-lite]/vardir has been added. This<br>        file is not created by default but may be added as needed. It<br>        is expected to contain a single variable assignment:<br><br>           VARDIR=&lt;directory&gt;<br><br>        Example:<br><br>           VARDIR=/root/shorewall<br>    <br>    To change VARDIR, copy the old directory to the new one before you<br>    restart Shorewall[-lite].<br><br>    To use this feature with Shorewall-lite, all packages involved<br>    (compiler, shorewall-common and shorewall-lite) must be version<br>    4.0.0-RC2 or later.</pre>
-<hr>
-<p><strong>2007-07-15 Shorewall 3.4.5</strong></p>
-<pre>Problems Corrected in 3.4.5.<br><br>1)  DYNAMIC_ZONES=Yes can now coexist with Shorewall-perl's 'bport'<br>    zones. Those zones themselves may not be dynamically modified but<br>    the presence of bport zones no longer causes the 'shorewall add'<br>    command to fail.<br><br>2)  Shorewall's internal traffic shaper once again works when the 'sed'<br>    utility is provided by the Busybox package.<br><br>3)  Version 3.4.4 erroneously accepted the values On, Off, on, off, ON<br>    and OFF for the IP_FORWARDING option. These values were treated<br>    like 'Keep'. The listed values are now once again flagged as an<br>    error.<br><br>4)  If 'routeback' and 'detectnets' were specified on an interface,<br>    limited broadcasts (to 255.255.255.255) and multicasts were dropped<br>    when forwarded through the interface. This could cause<br>    broadcast-based and multicast applications to fail when running<br>    through a bridge with 'detectnets'.<br><br>5)  The 'hits' command works once again.<br><br>6)  IPSECFILE=ipsec (either explicitly or defaulted) works<br>    now. Previously, processing of the ipsec file was bypassed; often<br>    with a confusing "missing file" message.<br><br>7)  If DETECT_DNAT_IPADDRS=Yes in shorewall.conf but you did't have conntrack<br>    match support, then the generated script was missing 'done's.<br><br>Other changes in 3.4.5.<br><br>1)  When a Shorewall release includes detection of an additional<br>    capability, existing capabilities files become out of<br>    date. Previously, this condition was not detected.<br><br>    Beginning with this release, each generated capabilities file<br>    contains a CAPVERSION specification which defines the capabilities<br>    version of the file. If the CAPVERSION in a capabilities file is<br>    less than the current CAPVERSION, then Shorewall will issue the<br>    following message:<br><br>    WARNING: &lt;file&gt; is out of date -- it does not contain all of<br>    the capabilities defined by Shorewall version &lt;version&gt;<br><br>    where<br><br>        &lt;file&gt;    is the name of the capabilities file.<br>        &lt;version&gt; is the current Shorewall version.<br><br>    Existing capabilities files contain no CAPVERSION. When such a file<br>    is read, Shorewall will issue this message:<br><br>    WARNING: &lt;file&gt; may be not contain all of the capabilities defined<br>    by Shorewall version &lt;version&gt;<br><br>2)  When a directory is specified in a command such as 'start' or<br>    'compile', Shorewall now reads the shorewall.conf file (if any) in<br>    that directory before deciding which compiler to use. So if<br>    SHOREWALL_COMPILER is not specified in<br>    /etc/shorewall/shorewall.conf and the -C option was not specified<br>    on the run-line, then if Shorewall-perl is installed, the additional<br>    shorewall.conf file is read to see if it specifies a<br>    SHOREWALL_COMPILER.<br><br>3)  The 'save' command now uses iptables-save from the same directory<br>    containing iptables. Previously, iptables-save was located via the<br>    PATH setting.</pre>
-<hr>
-<p><strong>2007-06-17 Shorewall 3.4.4</strong></p>
-<pre>Problems corrected in 3.4.4:<br><br>1)  The commands "shorewall add &lt;interface&gt; &lt;zone&gt;" and "shorewall<br>    delete &lt;interface&gt; &lt;zone&gt;" no longer produce spurious error<br>    messages.<br><br>2)  The command "shorewall delete &lt;interface&gt; &lt;zone&gt;" now actually deletes<br>    entries when it successfully completes.  Previously, it would appear<br>    to remove an entry, even when removing that entry should fail. <br><br>3)  Setting HIGH_ROUTE_MARKS=No no longer causes TC_EXPERT flagging.<br><br>4)  When run as root, the 'shorewall load' and 'shorewall reload'<br>    commands would fail if the LOGFILE setting in<br>    /etc/shorewall/shorewall.conf specified a non-existant file.<br><br>5)  Entries in /etc/shorewall/tcrules that specify both a source and<br>    destination port fail with the following diagnostic:<br><br>    iptables v1.3.3: multiport can only have one option<br><br>6)  Previously, Shorewall-lite did not allow DHCP traffic through an<br>    interface when the interface was a bridge with 'dhcp' specified<br>    unless there was a bridge on the administrative system with the<br>    same name.<br><br>7)  SOURCE and DEST are now flagged as invalid zone name to avoid<br>    problems with macros that use those names as keywords.<br><br>8)  Previously, Shorewall could *increase* the MSS under some<br>    circumstances. This possibility is now eliminated, provided that<br>    the system has TCPMSS match support (be sure to update your<br>    capabilities files!).<br><br>9)  Firewall zone names other than 'fw' no longer cause a error when<br>    IPSECFILE is not set or is set to 'ipsec'.<br><br>10) The 'proxyarp' option on an interface was previously ignored when<br>    the /etc/shorewall/proxyarp file was empty.<br><br>11) Previously, if action 'a' was defined then the following <br>    rule generated an error:<br><br>         a:        z1   z2      ...<br><br>    The trailing ":" is now ignored.<br><br>12) Previously, if a RATE/LIMIT was specified on a REJECT rule, the<br>    generated error messages referred to the rule as a DROP rule.<br><br>13) The 'nolock' keyword was previously ignored on several<br>    /sbin/shorewall[-lite] commands. <br><br>Other changes in 3.4.4:<br><br>1)  The accounting, masq, rules and tos files now have a 'MARK' column<br>    similar to the column of the same name in the tcrules file. This<br>    column allows filtering by MARK value.<br><br>2)  The "shorewall show zones" command now flags zone members that have<br>    been added using "shorewall add" by preceding them with a plus sign<br>    ("+").<br><br>    Example:<br><br>    Shorewall 3.9.4 Zones at gateway - Mon May 14 07:48:16 PDT 2007<br><br>    fw (firewall)<br>    net (ipv4)<br>        eth0:0.0.0.0/0<br>    loc (ipv4)<br>        br0:0.0.0.0/0<br>        eth4:0.0.0.0/0<br>        eth5:0.0.0.0/0<br>        +eth1:0.0.0.0/0<br>    dmz (ipv4)<br>        eth3:0.0.0.0/0<br>    vpn (ipv4)<br>        tun+:0.0.0.0/0<br><br>    In the above output, "eth1:0.0.0.0/0" was dynamically added to the<br>    'loc' zone. As part of this change, "shorewall delete" will only<br>    delete entries that have been added dynamically. In earlier<br>    versions, any entry could be deleted although the ruleset was only<br>    changed by deleting entries that had been added dynamically.<br><br>3)  Eariler generations of Shorewall Lite required that remote root<br>    login via ssh be enabled in order to use the 'load' and 'reload'<br>    commands.<br><br>    Beginning with this release, you may define an alternative means<br>    for accessing the remote firewall system.<br><br>    Two new options have been added to shorewall.conf:<br><br>        RSH_COMMAND<br>        RCP_COMMAND<br><br>    The default values for these are as follows:<br><br>        RSH_COMMAND: ssh ${root}@${system} ${command}<br>        RCP_COMMAND: scp ${files} ${root}@${system}:${destination}<br><br>    Shell variables that will be set when the commands are envoked are<br>    as follows:<br><br>       root  - root user. Normally 'root' but may be overridden using<br>               the '-r' option.<br><br>       system - The name/IP address of the remote firewall system.<br><br>       command - For RSH_COMMAND, the command to be executed on the <br>                 firewall system.<br><br>       files   - For RCP_COMMAND, a space-separated list of files to<br>                 be copied to the remote firewall system.<br><br>       destination - The directory on the remote system that the files <br>                     are to be copied into. <br><br>4)  You may now select the compiler to use on the command line using<br>    the '-C' option. This option is available on the following<br>    commands:<br><br>        check<br>        compile<br>        export<br>        load<br>        reload<br>        restart<br>        start<br>        try<br>        safe-start<br>        save-restart<br><br>     Example:<br><br>        shorewall try -C perl .</pre>
-<hr>
-<p><strong>2007-06-12 New Host for www.shorewall.net and
-ftp.shorewall.net</strong></p>
-<pre>I'm pleased to announce that Ty Christiansen and the folks at Master Mind<br>Productions (http://mastermindpro.com) have volunteered to host<br>www.shorewall.net and ftp.shorewall.net.<br><br>The new site is up and running and I've just changed DNS to point to the new<br>server. Let me know if you experience any problems.<br><br>Please join me in thanking Ty and Master Mind for their support of the<br>Shorewall project.</pre>
-<hr>
-<p><strong>2007-04-30 Shorewall 3.4.3</strong></p>
-<p><code>Problems corrected in Shorewall 3.4.3</code></p>
-<pre><code>1) The shorecap program was not loading modules correctly.</code></pre>
-<pre><code>2) The CHAIN variable is now set correctly before the 'maclog' script</code></pre>
-<pre><code>   is invoked.</code></pre>
-<pre><code></code></pre>
-<pre><code>3) The 'shorewall load' and 'shorewall reload' commands redundently</code></pre>
-<pre><code>   re-generated the capabilities file when it resided in the export</code></pre>
-<pre><code>   directory.</code></pre>
-<pre><code></code></pre>
-<pre><code>4) Setting LOGFILE to the value of a shell variable from the params</code></pre>
-<pre><code>   file now works.</code></pre>
-<pre><code></code></pre>
-<pre><code>5) The 'shorewall-lite restore' command can fail with a 'startup not</code></pre>
-<pre><code>   enabled' error.</code></pre>
-<pre><code></code></pre>
-<pre><code>6) When ROUTE_FILTER=Yes in shorewall.conf, Shorewall no longer clears</code></pre>
-<pre><code>   the rp_filter flag for all interfaces.</code></pre>
-<pre><code></code></pre>
-<pre><code>7) When LOG_MARTIANS=Yes in shorewall.conf, Shorewall no longer clears</code></pre>
-<pre><code>   the log_martians flag for all interfaces.</code></pre>
-<pre><code></code></pre>
-<pre><code>8) The 'shorewall add' and 'shorewall delete' commands no longer fail</code></pre>
-<pre><code>   with the message 'ERROR: Only one firewall zone may be defined'.</code></pre>
-<pre><code></code></pre>
-<pre><code>9) It was previously impossible to disable martian logging.</code></pre>
-<pre><code></code></pre>
-<pre><code>10) IP addresses (aliases) added by ADD_IP_ALIASES and ADD_SNAT_ALIASES</code></pre>
-<pre><code>    are now correctly deleted when Shorewall stops.</code></pre>
-<pre><code></code></pre>
-<pre><code>11) The 'shorewall add' and 'shorewall delete' commands no longer fail</code></pre>
-<pre><code>    with the error 'Only one firewall zone may be defined'.</code></pre>
-<pre><code></code></pre>
-<pre><code>12) The special 'detect' value now works correctly in the ADDRESSES</code></pre>
-<pre><code>    column of /etc/shorewall/masq.</code></pre>
-<pre><code></code></pre>
-<pre><code>Other changes in Shorewall 3.4.3</code></pre>
-<pre><code></code></pre>
-<pre><code>1) A LOCKFILE option has been added to shorewall.conf. This file is</code></pre>
-<pre><code>   used to serialize updates to the active firewall configuration.</code></pre>
-<pre><code>   If not specified, the defaults are:</code></pre>
-<blockquote>
-  <p><code>Shorewall - /var/lib/shorewall/lock</code></p>
-  <p><code>Shorewall Lite - /var/lib/shorewall-lite/lock</code></p>
-</blockquote>
-<!-- Shorewall Release 3.0.5 -->
-<hr>
-<p><span style="font-weight: bold;">2007-04-08 Shorewall 3.2.10<br>
-</span><span style="font-weight: bold;"></span></p>
-<pre>Problems Corrected in 3.2.10<br><br>1)  Previously, if a 'start' or 'restart' command failed during the<br>    compilation step, /sbin/shorewall erroneously returned an exit<br>    status of zero.<br><br>2)  If IMPLICIT_CONTINUE=Yes was in effect, then sub-zones received the<br>    implicit CONTINUE policy for their intra-zone traffic (rather than<br>    the implicit ACCEPT policy for such traffic). This could cause<br>    intra-zone traffic to be rejected by rules in one of the parent<br>    zones.<br><br>3) The "shorewall-[lite] [re]start and stop" commands reset the<br>   proxy_arp flag on all interfaces on the system making it impossible<br>   to control proxy arp manually with Shorewall installed. With this<br>   change, shorewall will only clear proxy arp if there were entries in<br>   /etc/shorewall/proxyarp the last time that Shorewall was<br>   [re]started.<br>   <br>4)  The /usr/share/shorewall[-lite]/modules file has been updated for<br>    kernel 2.6.20.<br><br>5)  The /proc/net/ip_conntrack pseudo-file has been inexplicably<br>    renamed /proc/net/nf_conntrack in kernel 2.6.20. The lib.cli<br>    library has been updated to look for both files.<br><br>6)  Tunnels of type 'ipsecnat' failed to work properly due to a missing<br>    rule.<br><br>7)  The 'shorecap' program was not loading modules correctly. <br><span
- style="font-family: sans-serif;"><span style="font-weight: bold;"></span></span></pre>
-<hr style="width: 100%; height: 2px;">
-<span style="font-family: sans-serif;"><span style="font-weight: bold;"></span></span><span
- style="font-weight: bold;">2007-04-01 Shorewall 3.4.2<br>
-</span><span style="font-weight: bold;"></span>
-<pre>Problems corrected in Shorewall 3.4.2<br><br>1)  The /usr/share/shorewall[-lite]/modules file has been updated for<br>    kernel 2.6.20.<br><br>2)  The /proc/net/ip_conntrack pseudo-file has been inexplicably<br>    renamed /proc/net/nf_conntrack in kernel 2.6.20. The lib.cli<br>    library has been updated to look for both files.<br><br>3)  Shoreall 3.4 was not consistent with respect to its treatment of<br>    log level 'none' and 'none!' and built-in actions. In particular,<br>    specifying 'none' with the Limit action produced a run-time error.<br>    Shorewall now correctly suppresses generation of log messages when<br>    a log level of 'none' or 'none!' is given to a built-in action.<br><br>4)  Tunnels of type 'ipsecnat' would sometimes fail to work because of<br>    a missing rule.<br></pre>
-<span style="font-weight: bold;"></span>
-<hr style="width: 100%; height: 2px;"><span style="font-weight: bold;">2007-03-15
-Shorewall 3.4.1<br>
-</span><span style="font-weight: bold;"></span>
-<pre>Problems Corrected in 3.4.1<br><br>1)  The "shorewall-[lite] [re]start and stop" commands reset the<br>    proxy_arp flag on all interfaces on the system making it impossible<br>    to control proxy arp manually with Shorewall installed. There was a<br>     partial fix included in 3.4.0; unfortunately, it did not correct the<br>    problem completely. Shorewall 3.4.1 includes the rest of the change <br>    necessarey to only clear proxy arp if there were entries in<br>    /etc/shorewall/proxyarp the last time that Shorewall was<br>    [re]started.<br><br>2)  If the log-prefix in a log message exceeded 29 characters, <br>    'shorewall restart' fails with 'truncate: command not found' and a<br>    possible segmentation fault in iptables.<br><br>3)  Log messages specifying a log tag had two spaces appended to the<br>    log prefix. This could cause mysterious "log-prefix truncated"<br>    messages. <br><br>4)  When nested zones were defined in the /etc/shorewall/zones file and<br>    IMPLICIT_CONTINUE=Yes was given in /etc/shorewall/shorewall.conf,<br>    shell error messages ( usually '&lt;zone&gt;: not found' ) during<br>    compilation resulted.<br><br>5)  Use of CONTINUE policies lead to startup errors with a message<br>    such as the following:<br><br>       Applying Policies...<br>       iptables v1.3.7: Couldn't load target<br>       `CONTINUE':/usr/local/lib/iptables/libipt_CONTINUE.so: cannot open<br>       shared object file: No such file or directory<br><br>       Try `iptables -h' or 'iptables --help' for more information.<br>       <br>          ERROR: Command "/sbin/iptables -A net2c148 -j CONTINUE"<br>          Failed<br><br>6)  If there were hosts defined as 'critical' in<br>    /etc/shorewall/routestopped then problems occured in two cases:<br><br>    i) On a Shorewall Lite system when 'shorewall stop' or 'shorewall<br>    clear' was issued.<br><br>    ii) On Shorewall or Shorewall lite system when 'start' or 'restart'<br>    failed during execution of the compiled script and there was no saved<br>    configuration ('shorewall[-lite] save' has not been issued).<br><br>    The symptoms were that the following shell messages were issued and<br>    the 'critical' hosts were not enabled:<br><br>      /var/lib/shorewall/.start: line nnn: source_ip_range: command not found<br>      /var/lib/shorewall/.start: line nnm: dest_ip_range: command not found<br><br>Other changes in 3.4.1<br><br>1)  Several changes are included which allow testing of experimental<br>    versions of Shorewall on systems with 3.4.1 and later 3.4 releases<br>    installed. Among these changes is the detection and reporting of<br>    "Address Type Match" which may be used in future 3.4 releases.<br>    These changes have no effect on normal Shorewall operation. </pre>
-<span style="font-weight: bold;"></span>
-<hr style="width: 100%; height: 2px;"><span style="font-weight: bold;">2007-03-10
-Shorewall 3.4.0<br>
-</span><span style="font-weight: bold;"></span>
-<pre>Shorewall 3.4.0<br><br>Release Highlights<br><br>1)  Shorewall can now be tailored to reduce its footprint on embedded<br>    systems. As part of this change, actions are now completely<br>    optional.<br><br>    See http://www.shorewall.net/Modularization.html for details.<br><br>2)  Exclusion is now possible in /etc/shorewall/hosts. This is required<br>    for bridge/firewalls under kernel 2.6.20 and later.<br><br>    See http://www.shorewall.net/NewBridge.html.<br><br>3)  Shorewall and Shorewall Lite now include man pages. There is a <br>    man page for shorewall(8), one for shorewall-lite(8) and one for<br>    each configuration file. As part of this change, all documentation<br>    has been removed from Shorewall configuration files. This should<br>    make it easier from users to upgrade from one release to the next<br>    since the configuration files will only change when column is added<br>    or renamed.<br><br>    See http://www.shorewall.net/manpages/Manpages.html<br><br>4)  Shorewall now remembers the changes that it has made to routing as<br>    a result of entries in /etc/shorewall/providers and<br>    /etc/shorewall/route_rules and reverses those changes when<br>    appropriate.<br><br>Problems Corrected in 3.4.0 Final.<br><br>1)  In the rules file, following the action with "!" is supposed to<br>    exempt the rule from being suppressed by OPTIMIZE=1. That feature<br>    was not working.<br><br>2)  If both a macro body and a macro invocation contained an entry in the<br>    SOURCE or DEST column, then compilation failed with the error:<br><br>           merge_macro_source_dest: command not found<br><br>3)  An obscure bug in rule activation having to do with the new<br>    exclusion feature in /etc/shorewall/hosts has been corrected.<br><br>4) The "shorewall-[lite] [re]start and stop" commands reset the<br>   proxy_arp flag on all interfaces on the system making it impossible<br>   to control proxy arp manually with Shorewall installed. With this<br>   change, shorewall will only clear proxy arp if there were entries in<br>   /etc/shorewall/proxyarp the last time that Shorewall was<br>   [re]started.<br><br>New Features in Shorewall 3.4:<br><br>1)  In order to accomodate small embedded applications, Shorewall 3.4<br>    is now modularized. In addition to the base files, there are<br>    loadable "libraries" that may be included or omitted from an<br>    embedded system as required.<br><br>    Loadable Shorewall libraries reside in /usr/share/shorewall/ and<br>    have names that begin with "lib.". The following libraries are<br>    included in Shorewall 3.4:<br><br>    - lib.accounting. Must be available if you include entries in<br>      /etc/shorewall/accounting.<br><br>    - lib.actions. Must be available if you do not specify<br>      USE_ACTIONS=No in /etc/shorewall/shorewall.conf.<br><br>    - lib.base. The base Shorewall library required by all programs,<br>      including compiled firewall scripts. This library is also<br>      released as part of Shorewall Lite and is installed in<br>      /usr/share/shorewall-lite/.<br><br>    - lib.cli. Library containing the code common to /sbin/shorewall,<br>      /sbin/shorewall-lite. This library is also released as part of<br>      Shorewall Lite and is installed in /usr/share/shorewall-lite/.<br><br>    - lib.config. Library containing the code that is common to<br>      /usr/share/shorewall/compiler and /usr/share/shorewall/firewall. <br><br>    - lib.dynamiczones. Must be available if you specify<br>      DYNAMIC_ZONES=Yes in shorewall.conf.<br><br>    - lib.maclist. Must be available if you specify the 'maclist'<br>      option in /etc/shorewall/interfaces or /etc/shorewall/hosts.<br><br>    - lib.nat. Must be available if you have entries in<br>      /etc/shorewall/masq, /etc/shorewall/nat or /etc/shorewall/netmap<br>      or if you use DNAT or REDIRECT rules.<br><br>    - lib.providers. Must be available if you have entries in<br>      /etc/shorewall/providers.<br><br>    - lib.proxyarp. Must be available if you have entries in<br>      /etc/shorewall/proxyarp or if you specify the 'proxyarp' option<br>      in /etc/shorewall/interfaces.<br><br>    - lib.tc. Must be available if you have entries in<br>      /etc/shorewall/tcdevices and /etc/shorewall/tcclasses.<br><br>    - lib.tcrules. Must be available if you have entries in<br>      /etc/shorewall/tcrules.<br><br>    - lib.tunnels. Must be available if you have entries in<br>      /etc/shorewall/tunnels.<br><br>    Embedded applications can further decrease the size of the Shorewall<br>    footprint by:<br><br>    - Omitting the macro files.<br>    - Omitting all unused extension scripts.<br><br>    See http://www.shorewall.net/Modularization.html for additional<br>    details.<br><br>2)  As hinted in the previous bullet, there is a new USE_ACTIONS option<br>    in /etc/shorewall/shorewall.conf. Shorewall actions can be very<br>    powerful but they also require a lot of code to implement. Embedded<br>    applications can omit that code by setting<br>    USE_ACTIONS=No. Shorewall will ignore all action-related files<br>    including /usr/share/shorewall/actions.std and<br>    /etc/shorewall/actions. Builtin actions will still be available for<br>    use in rules and macros.<br><br>    The 'Limit' action has been converted to a builtin so that Limit is<br>    available even when USE_ACTIONS=No.<br><br>    See the next item for more information.<br><br>3)  Prior to Shorewall 3.4, default actions were specified in<br>    /usr/share/shorewall/actions.std or in /etc/shorewall/actions.<br><br>    This approach has two drawbacks:<br><br>    a) All DROP policies must use the same default action and all<br>       REJECT policies must use the same default action.<br><br>    b) Now that we have modularized action processing (see the New<br>       Features section below), we need a way to define default rules<br>       for a policy that does not involve actions.<br><br>    The solution is two-fold:<br><br>    - Four new options have been added to the<br>      /etc/shorewall/shorewall.conf file that allow specifying the<br>       default action for DROP, REJECT, ACCEPT and QUEUE.<br><br>       The options are DROP_DEFAULT, REJECT_DEFAULT, ACCEPT_DEFAULT and<br>       QUEUE_DEFAULT.<br><br>       DROP_DEFAULT describes the rules to be applied before a<br>       connection request is dropped by a DROP policy; REJECT_DEFAULT<br>       describes the rules to be applied if a connection request is<br>       rejected by a REJECT policy. The other two are similar for<br>       ACCEPT and QUEUE policies.<br><br>       The value assigned to these may be:<br><br>        a) The name of an action.<br>        b) The name of a macro<br>        c) 'None' or 'none'<br><br>       The default values are:<br><br>        DROP_DEFAULT="Drop"<br>        REJECT_DEFAULT="Reject"<br>        ACCEPT_DEFAULT=none<br>        QUEUE_DEFAULT=none<br><br>       If USE_ACTIONS=Yes, then these values refer to action.Drop and<br>       action.Reject respectively. If USE_ACTIONS=No, then these values<br>       refer to macro.Drop and macro.Reject.<br><br>       If you set the value of either option to "None" then no default<br>       action will be used and the default action or macro (if any)<br>       must be specified in /etc/shorewall/policy<br><br>    - The POLICY column in /etc/shorewall/policy has been extended.<br><br>       In /etc/shorewall/policy, when the POLICY is DROP, REJECT,<br>       ACCEPT or QUEUE then the policy may be followed by ":" and one<br>       of the following:<br><br>        a) The word "None" or "none". This causes any default<br>           action defined in /etc/shorewall/shorewall.conf<br>           to be omitted for this policy.<br>        b) The name of an action (requires that USE_ACTIONS=Yes<br>           in shorewall.conf). That action will be invoked<br>           before the policy is enforced.<br>        c) The name of a macro. The rules in that macro will<br>           be applied before the policy is enforced. This<br>           does not require USE_ACTIONS=Yes.&lt;<br>br&gt;<br>    Example:<br><br>        #SOURCE         DEST            POLICY          LOG<br>        #                                               LEVEL<br>        loc             net             ACCEPT<br>        net             all             DROP:MyDrop     info<br>        #<br>        # THE FOLLOWING POLICY MUST BE LAST<br>        #<br>        all             all             REJECT:MyReject info<br><br>4)  For users whose kernel and iptables have Extended MARK Target<br>    support, it is now possible to logically AND or OR a value into the<br>    current packet mark by preceding the mark value (and optional mask)<br>    with an ampersand ("&amp;") or vertical bar ("|") respectively.<br><br>    Example: To logically OR the value 4 into the mark value for<br>    packets from 192.168.1.1:<br><br>    #MARK   SOURCE<br>    |4      192.168.1.1<br><br>5)  Previously, zone names were restricted to five characters in<br>    length. That limit derives from the --log-prefix in Netfilter log<br>    messages which must be 29 bytes or less in length. With the<br>    standard Shorewall LOGFORMAT, that leaves 11 characters for the<br>    chain name; given that many chain names are of the form<br>    &lt;zone1&gt;2&lt;zone2&gt;, that gives a maximum zone name length of 5.<br><br>    Beginning with this release, the maximum length of a zone name is<br>    dependent on the LOGFORMAT (the maximum length may never be less<br>    than 5 but it may be greater than 5). For example, setting<br>    LOGFORMAT="FW:%s:%s:" will allow zone names of up to 8 characters.<br><br>6)  Netfilter provides support for attachment of comments to Netfilter<br>    rules. Comments can be up to 255 bytes in length and are visible<br>    using the "shorewall show &lt;chain&gt;", "shorewall show nat",<br>    "shorewall show mangle" and "shorewall dump" commands. Comments are<br>    delimited by '/* ... */" in the output.<br><br>    Beginning with Shorewall 3.4, you may place COMMENT lines in the<br>    /etc/shorewall/rules, /etc/shorewall/tcrules, /etc/shorewall/nat<br>    and /etc/shorewall/masq files and in action files. The remainder of<br>    the line is treated as a comment and it will be attached as a<br>    Netfilter comment to the rule(s) generated by succeding entries<br>    in the file.<br><br>    Note: Do not prefix the comment with "#". Shorewall's two-pass<br>    compiler strips off "#" comments in the first pass and processes<br>    COMMENT lines in the second pass. Hence, by the time that COMMENT<br>    is processed, the "#" and everything following it has been removed<br>    (see example below).<br><br>    To stop the current comment from being attached to further<br>    rules, simply include COMMENT on a line by itself (so that the<br>    following rules will have no comment) or specify a new COMMENT.<br><br>    If you do not have Comment support in your iptables/kernel (see the<br>    output of "shorewall[-lite] show capabilities") then COMMENTS are<br>    ignored with this warning:<br><br>     COMMENT ignored --  requires comment support in iptables/Netfilter<br><br>    Example from my rules file:<br><br>            #SOURCE      SOURCE     DEST       PROTO DEST PORT(S)<br><br>            COMMENT Stop Microsoft Noise<br><br>            REJECT       loc        net        tcp   137,445<br>            REJECT       loc        net        udp   137:139<br><br>            COMMENT  # Stop comment from being attached to rules below<br><br>    The output of "shorewall show loc2net" includes (folded):<br><br>    0     0 reject     tcp  --  *      *       0.0.0.0/0<br>          0.0.0.0/0    multiport dports 137,445 /* Stop Microsoft Noise */<br>    0     0 reject     udp  --  *      *       0.0.0.0/0<br>          0.0.0.0/0    udp dpts:137:139 /* Stop Microsoft Noise */<br><br>7)  A new macro (macro.RDP) has been added for Microsoft Remote<br>    Desktop. This macro was contributed by Tuomo Soini.<br><br>8)  A new 'maclog' extension file has been added. This file is<br>    processed just before logging based on the setting of<br>    MACLIST_LOG_LEVEL is done. When the extension is invoked, the CHAIN<br>    variable will contain the name of the chain where rules should be<br>    inserted. Remember that if you have specified MACLIST_TABLE=mangle,<br>    then your run_iptables commands should include "-t mangle".<br><br>9)  The SUBNET column in /etc/shorewall/masq has been renamed SOURCE to<br>    more accurately describe the contents of the column.<br><br>10) Previously, it was not possible to use exclusion in<br>    /etc/shorewall/hosts. Beginning with this release, you may now use<br>    exclusion lists in entries in this file. Exclusion lists are<br>    discussed at:<br><br>       http://www.shorewall.net/configuration_file_basics.htm#Exclusion.<br><br>    Example:<br><br>        loc     eth0:192.168.1.0/24!192.168.1.4,192.168.1.16/28<br><br>    In that example, the 'loc' zone is defined to be the subnet<br>    192.168.1.0/24 interfacing via eth0 *except* for host 192.168.1.4<br>    and hosts in the sub-network 192.168.1.16/28.<br><br>11) New "shorewall[-lite] show ip" and "shorewall[-lite] show routing"<br>    commands have been added. The first produces the same output as "ip<br>    addr ls". The second produces a report about your routing rules and<br>    tables.<br><br>12) Beginning with this release, Shorewall and Shorewall Lite will<br>    share common change logs and release notes.<br><br>13) In Shorewall versions prior to 3.4, multiple jumps to a '2all'<br>    chain could be generated in succession.<br><br>    Example from an earlier shorewall version:<br><br>    gateway:~ # shorewall-lite show eth2_fwd<br>    Shorewall Lite 3.4.0-Beta1 Chains eth2_fwd at gateway - Thu Oct 19 08:54:37 PDT 2006<br><br>    Counters reset Thu Oct 19 08:34:47 PDT 2006<br><br>    Chain eth2_fwd (1 references)<br>     pkts bytes target     prot opt in     out     source            destination<br>        0     0 dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID,NEW<br>        0     0 wifi2all   all  --  *      eth0    0.0.0.0/0            0.0.0.0/0<br>        0     0 wifi2all   all  --  *      br0     0.0.0.0/0            0.0.0.0/0<br>        0     0 wifi2all   all  --  *      eth3    0.0.0.0/0            0.0.0.0/0<br>        0     0 wifi2all   all  --  *      tun+    0.0.0.0/0            0.0.0.0/0<br>    gateway:~ #<br><br>    This redundancy may be eliminated by setting OPTIMIZE=1 in shorewall.conf.<br><br>    gateway:~ # shorewall-lite show eth2_fwd<br>    Shorewall Lite 3.4.0-Beta1 Chains eth2_fwd at gateway - Thu Oct 19 09:15:24 PDT 2006<br><br>    Counters reset Thu Oct 19 09:15:19 PDT 2006<br><br>    Chain eth2_fwd (1 references)<br>     pkts bytes target     prot opt in     out     source               destination<br>        0     0 dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID,NEW<br>        0     0 wifi2all   all  --  *      *       0.0.0.0/0            0.0.0.0/0<br>    gateway:~ #<br><br>    Note that with OPTIMIZE=1, traffic destined for an<br>    interface/Address that falls outside of all defined zones may now<br>    be logged out of a '2all' chain rather than out of the FORWARD<br>    chain.<br><br>    The OPTIMIZE setting also controls the suppression of redundant<br>    wildcard rules (those specifying "all" in the SOURCE or DEST<br>    column). A wildcard rule is considered to be redundant when it<br>    has the same ACTION and Log Level as the applicable policy.<br><br>    Example:<br><br>        /etc/shorewall/policy<br><br>        #SOURCE         DEST            POLICY          LEVEL<br>        loc             net             ACCEPT<br><br>        /etc/shorewall/rules<br><br>        #ACTION         SOURCE          DEST    PROTO   DEST<br>        #                                               PORT(S)<br>        ...<br>        ACCEPT          all             all     icmp    8<br><br>    OPTIMIZE=0<br><br>    gateway:~ # shorewall show loc2net<br>    Shorewall Lite 3.4.0-Beta1 Chains loc2net at gateway - Thu Oct 26 07:55:03 PDT 2006<br><br>    Counters reset Thu Oct 26 07:54:58 PDT 2006&lt;<br>br&gt;<br>    Chain loc2net (1 references)<br>     pkts bytes target     prot opt in     out     source               destination<br>      ...<br>        0     0 DROP       all  --  *      *      !192.168.0.0/22       0.0.0.0/0<br>        0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp type 8<br>        0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0<br><br>    gateway:~<br><br>    OPTIMIZE=1<br><br>    gateway:~ # shorewall show loc2net<br>    Shorewall Lite 3.4.0-Beta1 Chains loc2net at gateway - Thu Oct 26 07:57:12 PDT 2006<br><br>    Counters reset Thu Oct 26 07:56:38 PDT 2006<br><br>    Chain loc2net (1 references)<br>     pkts bytes target     prot opt in     out     source               destination<br>      ...<br>        0     0 DROP       all  --  *      *      !192.168.0.0/22       0.0.0.0/0<br>        0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0<br><br>    gateway:~<br><br>    If you really want a rule that duplicates the policy, follow the<br>    action with "!":<br><br>        #ACTION         SOURCE          DEST    PROTO   DEST<br>        #                                               PORT(S)<br>        ...<br>        ACCEPT!         all             all     icmp    8<br><br>14) IP Address ranges are now allowed in the drop, reject, allow and<br>    logdrop shorewall[-lite] commands.<br><br>15) Previously, Shorewall has not attempted to undo the changes it has<br>    made to the firewall's routing as a result of entries in<br>    /etc/shorewall/providers and /etc/shorewall/routes. Beginning with<br>    this release, Shorewall will attempt to undo these changes.<br><br>    When Shorewall starts or is restarted and there are entries in<br>    /etc/shorewall/providers, Shorewall will capture the contents<br>    of /etc/shorewall/rt_tables and will restore that database when<br>    Shorewall is stopped or restarted. Similarly, the default route<br>    will be captured the first time that you [re]start Shorewall using<br>    this version and will be restored under the following conditions:<br><br>    a) shorewall stop<br>    b) shorewall clear<br>    c) shorewall restart or restore and there are no entries in<br>       /etc/shorewall/providers.<br><br>    Once the default route has been restored, Shorewall will delete<br>    the saved copy so that it will once again be captured at the next<br>    shorewall start or shorewall restore.<br><br>16) Shorewall no longer includes policy matches in its generated<br>    ruleset when no IPSEC zones or IPSEC networks are defined (IPSEC<br>    networks are defined using the 'ipsec' option in<br>    /etc/shorewall/hosts).<br><br>17) The Makefile installed in /usr/share/shorewall/configfiles/ is now<br>    the same one mentioned at<br>    http://www.shorewall.net/CompiledPrograms.html.<br><br>    Once the file is copied into an export directory, you modify the<br>    setting of the HOST variable to match the name of the remote<br>    firewall.<br><br>    The default target is the "firewall" script so "make" compiles the<br>    firewall script if any of the configuration files have<br>    changed. "make install" builds "firewall" if necessary then<br>    installs it on the remote firewall. "make capabilities" will<br>    generate the "capabilities" file. "make save" will save the running<br>    configuration on the remote firewall.<br><br>18) Shorewall and Shorewall Lite now include the following manpages. <br><br>              shorewall-accounting(5)<br>              shorewall-actions(5)<br>              shorewall-blacklist(5)<br>              shorewall.conf(5)<br>              shorewall-ecn(5)<br>              shorewall-exclusion(5)<br>              shorewall-hosts(5)<br>              shorewall-interfaces(5)<br>              shorewall-lite.conf(5)<br>              shorewall-lite(8)<br>              shorewall-maclist(5)<br>              shorewall-masq(5)<br>              shorewall-nat(5)<br>              shorewall-nesting(5)<br>              shorewall-netmap(5)<br>              shorewall-params(5)<br>              shorewall-policy(5)<br>              shorewall-providers(5)<br>              shorewall-proxyarp(5)<br>              shorewall-rfc1918(5)<br>              shorewall-route_rules(5)<br>              shorewall-routestopped(5)<br>              shorewall-rules(5)<br>              shorewall-tcclasses(5)<br>              shorewall-tcdevices(5)<br>              shorewall-tcrules(5)<br>              shorewall-template(5)<br>              shorewall-tos(5)<br>              shorewall-tunnels(5)<br>              shorewall(8)<br>              shorewall-zones(5)<br><br>    Now that the manpages are in place, command-specific help has been<br>    removed since it duplicates information in the man pages.<br><br>19) From the beginning, the Shorewall configuration files in<br>    /etc/shorewall/ have contained documentary comments. While these<br>    comments are useful, they present an upgrade problem. Beginning<br>    with this release, these comments are removed from the<br>    configuration files themselves and are replaced by the manpages<br>    described in the preceding release note entry.<br><br>20) Shorewall now uses tc fwmark filters to classify packets for<br>    traffic shaping when the DEVICE isn't an interface described in<br>    /etc/shorewall/interfaces. This is in preparation for the upcoming<br>    change to the way that --physdev-out works in iptables/Netfilter;<br>    that change is now scheduled for kernel 2.6.20.<br><br>21) If your kernel and iptables have extended multiport support, then<br>    Shorewall will use that support for the destination port when<br>    generating rules from entries in the /etc/shorewall/tcrules file.<br>22) The 'safe-start' and 'safe-restart' command have been<br>    improved. Both now accept an optional directory name; if supplied,<br>    Shorewall will look first in that directory for configuration<br>    files.<br><br>    The commands have also been enhanced to only restore the<br>    configuration once in the event of a failure. Previously, if there<br>    was a current 'save' command in effect, then that configuration<br>    would be restored on a failure and then the last-running<br>    configuration would be restored.<br><br>23) The 'try' command has been reimplemented with new semantics. <br><br>    If Shorewall is started then the firewall state is saved to a<br>    temporary saved configuration (/var/lib/shorewall/.try). Next, if<br>    Shorewall is currently started then a restart command is issued;<br>    otherwise, a start command is performed. if an error occurs during<br>    the  compliation phase  of  the  restart or start, the command<br>    terminates without changing the Shorewall state. If an error occurs<br>    during the restart phase, then a 'shorewall restore' is performed<br>    using the saved configuration. If an error occurs during the start<br>    phase, then Shorewall is  cleared. If the start/restart succeeds<br>    and a timeout is specified then a 'clear' or 'restore' is performed<br>    after timeout seconds. <br><br>24) The syntax of the 'export' command has been made slightly<br>    friendlier.<br><br>    The old syntax:<br><br>        export &lt;directory1&gt; [user@]system:[&lt;directory2&gt;]<br><br>    It is now:<br><br>        export &lt;directory1&gt; [user@]system[:&lt;directory2&gt;]<br><br>    In other words, if you don't need to specify &lt;directory2&gt;, you may<br>    omit the colon (":") following the system name.<br>    <br>    The old syntax is still accepted -- that is, you can still <br>    type:<br><br>        export firewall2:<br><br>    which is equivalent to<br><br>        export firewall2<br><br>25) Shorewall commands may be speeded up slightly by using a<br>    'capabilities' file. The 'capabilities' file was originally<br>    designed for use with Shorewall Lite and records the<br>    iptables/Netfilter features available on the target system.<br><br>    To generate a capabilities file, execute the following command as<br>    root:<br><br>      shorewall show -f capabilities &gt; /etc/shorewall/capabil<br>ities<br><br>    When you install a new kernel and/or iptables, be sure to generate<br>    a new capabilities file.<br>        <br>26) When syslogd is run with the -C option (which in some<br>    implementations causes syslogd to log to an in-memory circular<br>    buffer), /sbin/shorewall will now use the 'logread' command to read<br>    the log from that buffer. This is for combatibility with OpenWRT.<br><br>27) There is now a ":T" qualifier in /etc/shorewall/tcrules which<br>    causes the resulting rule to be inserted into the POSTROUTING<br>    chain.<br><br>28) The program /usr/share/shorewall/wait4ifup can be used to wait for<br>    a network device (such as a ppp device) to reach the UP state. <br>    <br>        /usr/share/shorewall/wait4ifup &lt;interface&gt; [ &lt;seconds&gt; ]<br><br>    The program will wait for up to &lt;seconds&gt; seconds for the <br>    named &lt;interface&gt; to reach the UP state. If &lt;seconds&gt; is not given,<br>    60 seconds is assumed.<br><br>    The exit status is zero if &lt;interface&gt; comes up within &lt;seconds&gt;<br>    seconds and non-zero otherwise.<br><br>29) Previously, 'ipsecnat' tunnels allowed AH traffic by default<br>    (unless 'isecnat:noah' was given). Given that AH is incompatible<br>    with nat-traversal, 'ipsecnat' now implies 'ipsecnat:noah'.<br><br>30) Shorewall now generates half as many rules as previously in the<br>    'blacklst' chain when BLACKLIST_LOGLEVEL is specified.<br><br>31) Beginning with Shorewall 3.4.0, if EXPORTPARAMS=No in<br>    shorewall.conf then Shorewall will not process<br>    /etc/shorewall/params when the compiled script is run. With<br>    EXPORTPARAMS=No, any shell variables needed at run-time must be set<br>    in /etc/shorewall/init.<br><br>    In a Shorewall/Shorewall Lite environment, this allows<br>    /etc/shorewall/params to be written to run exclusively<br>    on the administrative system while /etc/shorewall/init runs<br>    exclusively on the firewall system.<br><br>    So shell variables required at compile time may be set in<br>    /etc/shorewall/params and those required at run-time may be set in<br>    /etc/shorewall/init.<br><br>    Note 1: If you need shell variables values in your<br>    /etc/shorewall/stop or /etc/shorewall/stopped script, then you need<br>    to set their values in /etc/shorewall/stop. /etc/shorewall/init is<br>    not invoked during processing of the 'stop' and 'clear' commands.<br><br>    Note 2: EXPORTPARAMS was actually introduced in Shorewall version<br>    3.2.9. It is described here for the benefit of those who did not<br>    install that version.<br></pre>
-<span style="font-weight: bold;"></span>
-<hr style="width: 100%; height: 2px;"><span style="font-weight: bold;">Old
-News <a href="oldnews.html">here</a><br>
-</span>
-</body>
-</html>
diff --git a/web/Notices.html b/web/Notices.html
deleted file mode 100644
index f8d290385..000000000
--- a/web/Notices.html
+++ /dev/null
@@ -1,181 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
-<html>
-<head>
-  <meta http-equiv="CONTENT-TYPE" content="text/html; charset=UTF-8">
-  <title>Shorewall Notices</title>
-  <base target="_self">
-  <meta name="CREATED" content="20040920;15031500">
-  <meta name="CHANGED" content="$Id$">
-</head>
-<body dir="ltr" lang="en-US">
-<hr style="width: 100%; height: 2px;">
-<table style="text-align: left; width: 100%;" border="0" cellpadding="2"
- cellspacing="0">
-  <tbody>
-    <tr style="font-weight: bold;">
-      <td style="vertical-align: top;"><a href="#Shell-EOL">Attention
-Shorwall-shell Users</a><br>
-      </td>
-      <td style="vertical-align: top;"><a href="#Perl">Attention
-Shorewall-perl 4.2 Users</a><br>
-      </td>
-      <td style="vertical-align: top;"><a href="#Notice">Attention
-Users of Shorewall's Multi-ISP Feature</a><br>
-      </td>
-    </tr>
-    <tr>
-      <td style="vertical-align: top; font-weight: bold;"><a
- href="Notices.html#Notice1">Attention Users of BRIDGING=Yes</a></td>
-      <td style="vertical-align: top; font-weight: bold;"><a
- href="Notices.html#Kernel2.4">Attention Kernel 2.4 Users</a></td>
-      <td style="vertical-align: top;"><br>
-      </td>
-    </tr>
-  </tbody>
-</table>
-<hr><span style="font-weight: bold;">2009-08-03<br>
-</span>
-<h2><a name="Shell-EOL"></a>End-of-life for Shorewall-shell in
-Shorewall 4.4<br>
-</h2>
-The Shorewall 4.4 release in the fall of 2009 will not include
-Shorewall-shell. Because Shorewall 4.0 is included in Debian Lenny, the
-4.0 release of Shorewall-shell will continue to be supported until
-Debian Squeeze is released. The 4.2 release of Shorewall-shell will
-continue to be supported until Shorewall 4.6 is released in 2010.<br>
-<br>
-Shorewall-shell users are encouraged to<a href="Shorewall-perl.html">
-migrate to Shorewall-perl</a> at the earliest opportunity. Users who
-run Shorewall-shell on an embedded system that is too small to support
-Perl should consider switching to <a href="CompiledPrograms.html#Lite">Shorewall-lite</a>
-with Shorewall-perl installed on an administrative system (may be a
-Windows[tm] system running <a href="http://www.cygwin.com">Cygwin</a>[tm]).<br>
-<h2><span style="font-weight: bold;"><a name="Perl"></a>Attention
-Shorewall-perl 4.2 Users</span></h2>
-<h3>Shorewall-perl 4.2.8</h3>
-Shorewall-perl 4.2.8 was dead on arrival. The compiler did not rename
-the generated script file with the result that it was removed when the
-compiler terminated. This lead to:<br>
-<ol>
-  <li>It was not possible to start Shorewall or Shorewall6 for the
-first time after installing 4.2.8</li>
-  <li>Changes to the configuration were apparently ignored.</li>
-</ol>
-This problem was corrected in Shorewall-perl-4.2.8.1.<br>
-<h3>Shorewall-perl 4.2.6 and Earlier<br>
-</h3>
-On February 28, Klemens Rutz reported a problem that affects all<span
- style="font-family: monospace;"><span style="font-family: sans-serif;">
-</span></span>Shorewall-perl 4.2 versions prior to 4.2.6.1.<br>
-<span style="font-family: monospace;"><br>
-</span>The problem:<br>
-<ol>
-  <li>Only occurs when there are multiple non-firewall zones.</li>
-  <li>Results in the following interface options not being applied to
-forwarded traffic.</li>
-</ol>
-<div style="margin-left: 40px;">blacklist<br>
-dhcp<br>
-maclist (when MACLIST_TABLE=filter)<br>
-norfc1918<br>
-nosmurfs<br>
-tcpflags<br>
-</div>
-<br>
-User are encouraged to either:<br>
-<ul>
-  <li>Upgrade to Shorewall-perl-4.2.6.1 or later; or</li>
-  <li>Apply the patch found at:</li>
-</ul>
-<div style="margin-left: 40px;"><a class="moz-txt-link-freetext"
- href="http://www.shorewall.net/pub/shorewall/4.2/forward.patch">http://www.shorewall.net/pub/shorewall/4.2/forward.patch</a><br>
-<a class="moz-txt-link-freetext"
- href="ftp://ftp.shorewall.net/pub/shorewall/4.2/forward.patch">ftp://ftp.shorewall.net/pub/shorewall/4.2/forward.patch</a></div>
-<br>
-<div style="margin-left: 40px;">To apply the patch, execute this
-command:<br>
-</div>
-<div style="margin-left: 80px;">
-<pre> patch /usr/share/shorewall-perl/Shorewall/Rules.pm &lt; forward.patch</pre>
-</div>
-<div style="margin-left: 40px;">The patch may apply with fuzz and/or an
-offset, depending on your particular version.</div>
-<h2><a name="Notice">Attention Users of Shorewall's Multi-ISP
-Feature</a></h2>
-<p>A bug in Shorewall versions 3.2.0-3.2.10, 3.4.0-3.4.6 and
-Shorewall-shell
-4.0.0-4.0.2 prevents proper handling of PREROUTING marks when
-HIGH_ROUTE_MARKS=No and the <strong>track</strong> option is
-specified.
-Patches are available to correct this problem:</p>
-<p>Shorewall version 3.2.0-3.2.10, 3.4.0-3.4.3: <a
- href="http://www1.shorewall.net/pub/shorewall/3.2/shorewall-3.2.10/errata/patches/Shorewall/patch-3.2.10-2.diff">http://www1.shorewall.net/pub/shorewall/3.2/shorewall-3.2.10/errata/patches/Shorewall/patch-3.2.10-2.diff</a></p>
-<p>Shorewall version 3.4.4-3.4.6: <a
- href="http://www1.shorewall.net/pub/shorewall/3.4/shorewall-3.4.6/errata/patches/Shorewall/patch-3.4.6-1.diff">http://www1.shorewall.net/pub/shorewall/3.4/shorewall-3.4.66/errata/patches/Shorewall/patch-3.4.6-1.diff</a></p>
-<p>Shorewall-shell version 4.0.0-4.0.2: <a
- href="http://www1.shorewall.net/pub/shorewall/4.0/shorewall-4.0.2/errata/patches/Shorewall-shell/patch-shell-4.0.2-2.diff">http://www1.shorewall.net/pub/shorewall/4.0/shorewall-4.0.2/errata/patches/Shorewall-shell/patch-shell-4.0.2-2.diff</a></p>
-<p>Note that a patch may succeed with an offset when applied to a
-release
-other than the one for which it was specifically prepared. For example,
-when
-the patch for 3.2.0-3.2.10, 3.4.0-3.4.3 (which was prepared for release
-3.2.10) is applied to release 3.4.3, the following is the result:</p>
-<pre>root@wookie:~# <strong>cd /usr/share/shorewall</strong>
-root@wookie/usr/share/shorewall#: <strong>patch &lt; ~/shorewall/tags/3.2.10/Shorewall.updated/patch-3.2.10-2.diff</strong> <br>patching file compiler<br>Hunk #1 succeeded at 958 (offset -1669 lines).<br>root@wookie:/usr/share/shorewall#</pre>
-<h3>Update -- 7 November 2007</h3>
-<p>A second bug in Shorewall versions 3.2.0-3.2.11, 3.4.0-3.4.7 and
-4.0.0-4.0.5 can cause improper handing of PREROUTING and OUTPUT marks
-when
-HIGH_ROUTE_MARKS=Yes. Patches are also available to correct this
-problem:</p>
-<p>Shorewall version 3.2.3-3.2.11: <a
- href="http://www1.shorewall.net/pub/shorewall/3.2/shorewall-3.2.11/errata/patches/Shorewall/patch-3.2.11-1.diff">http://www1.shorewall.net/pub/shorewall/3.2/shorewall-3.2.11/errata/patches/Shorewall/patch-3.2.11-1.diff</a></p>
-<p>Shorewall version 3.4.0-3.4.7: <a
- href="http://www1.shorewall.net/pub/shorewall/3.4/shorewall-3.4.7/errata/patches/Shorewall/patch-3.4.7-1.diff">http://www1.shorewall.net/pub/shorewall/3.4/shorewall-3.4.7/errata/patches/Shorewall/patch-3.4.7-1.diff</a></p>
-<p>Shorewall version 4.0.0-4.0.5: <a
- href="http://www1.shorewall.net/pub/shorewall/4.0/shorewall-4.0.5/errata/patches/Shorewall-shell/patch-shell-4.0.5-1.diff">http://www1.shorewall.net/pub/shorewall/4.0/shorewall-4.0.5/errata/patches/Shorewall-shell/patch-shell-4.0.5-1.diff</a>
-and <a
- href="http://www1.shorewall.net/pub/shorewall/4.0/shorewall-4.0.5/errata/patches/Shorewall-perl/patch-perl-4.0.5-4.diff">http://www1.shorewall.net/pub/shorewall/4.0/shorewall-4.0.5/errata/patches/Shorewall-perl/patch-perl-4.0.5-4.diff</a>.</p>
-<hr>
-<h2><a name="Notice1">Attention Users of BRIDGING=Yes</a></h2>
-<p>In Linux Kernel version 2.6.20, the Netfilter team changed Physdev
-Match
-so that it is no longer capable of supporting BRIDGING=Yes. The
-solutions
-available to users are to either:</p>
-<ol>
-  <li>Switch to using the technique described at <a
- href="http://www.shorewall.net/3.0/NewBridge.html">http://www.shorewall.net/3.0/NewBridge.html</a>;
-or<br>
-  </li>
-  <li>Upgrade to Shorewall 4.0, migrate to using Shorewall-perl, and
-follow the instructions at <a
- href="http://www1.shorewall.net/bridge-Shorewall-perl.html">http://www1.shorewall.net/bridge-Shorewall-perl.html.</a>
-  </li>
-</ol>
-<p>The first approach allows you to switch back and forth between
-kernels
-older and newer than 2.6.20. The second approach is a better long-term
-solution.</p>
-<hr style="width: 100%; height: 2px;">
-<h2><a name="Kernel2.4"></a>Attention Users of Kernel 2.4</h2>
-The Shorewall developers do not test Shorewall running on Kernel 2.4
-and we make no representation about the functionality of Shorewall on
-that Kernel. Any failure of Shorewall on Kernel 2.4 will not be
-investigated by the Shorewall team.<br>
-<hr>
-Copyright © 2001-2009 Thomas M. Eastep<br>
-<br>
-Permission is granted to copy, distribute and/or modify this
-document
-under the terms of the GNU Free Documentation License, Version 1.2 or
-any
-later version published by the Free Software Foundation; with no
-Invariant
-Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of
-the
-license is included in the section entitled <span
- style="text-decoration: underline;">"</span><a href="GnuCopyright.htm"
- target="_self">GNU Free Documentation License</a>".
-</body>
-</html>
diff --git a/web/SeattleInTheSpring.html b/web/SeattleInTheSpring.html
deleted file mode 100644
index c3d0bc3f4..000000000
--- a/web/SeattleInTheSpring.html
+++ /dev/null
@@ -1,28 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
-<html>
-<head>
-  <meta name="generator"
- content="HTML Tidy for Linux (vers 1st April 2002), see www.w3.org">
-  <meta http-equiv="Content-Type"
- content="text/html; charset=windows-1252">
-  <title>Wintertime in Seattle</title>
-  <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
-  <meta name="ProgId" content="FrontPage.Editor.Document">
-</head>
-<body>
-<div style="text-align: center;"><br>
-<h1><b><span style="font-weight: bold;"></span></b></h1>
-<h1><b>Our Home</b></h1>
-<img style="width: 1057px; height: 600px;" alt="(Our House)"
- src="images/100_0269.jpg"><br>
-<br>
-</div>
-<p> </p>
-<p><font size="2">Updated 11/02/2008 - <a href="support.htm">Tom Eastep</a></font></p>
-<p><a href="copyright.htm"><font size="2">Copyright</font> <font
- size="2">2008 Thomas M. Eastep.</font></a></p>
-<br>
-<br>
-<br>
-</body>
-</html>
diff --git a/web/Shorewall_CA_html.html b/web/Shorewall_CA_html.html
deleted file mode 100644
index 1dc09bb64..000000000
--- a/web/Shorewall_CA_html.html
+++ /dev/null
@@ -1,104 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
-
-<html>
-  <head>
-    <meta name="generator" content=
-    "HTML Tidy for Linux (vers 1st April 2002), see www.w3.org">
-
-    <title>Shorewall Certificate Authority</title>
-    <meta http-equiv="content-type" content=
-    "text/html; charset=ISO-8859-1">
-    <meta name="author" content="Tom Eastep">
-  </head>
-
-  <body>
-    <h1 style="text-align: left;">Shorewall Certificate Authority
-    (CA) Certificate</h1>
-    <span style="font-weight: bold;">Tom Eastep<br>
-    <br>
-    </span>Copyright © 2001-2003 Thomas M. Eastep<br>
-    <br>
-    Permission is granted to copy, distribute and/or modify this
-    document under the terms of the GNU Free Documentation License,
-    Version 1.2 or any later version published by the Free Software
-    Foundation; with no Invariant Sections, with no Front-Cover,
-    and with no Back-Cover Texts. A copy of the license is included
-    in the section entitled “<a href=
-    "http://shorewall.net/GnuCopyright.htm">GNU Free Documentation
-    License</a>”.<br>
-    <br>
-    2003-12-31<br>
-    <hr style="width: 100%; height: 2px;">
-    Given that I develop and support Shorewall without asking for
-    any renumeration, I can hardly justify paying $200US+ a year to
-    a Certificate Authority such as Thawte (A Division of VeriSign)
-    for an X.509 certificate to prove that I am who I am. I have
-    therefore established my own Certificate Authority (CA) and
-    sign my own X.509 certificates. I use these certificates on my
-    list server (<a href=
-    "https://lists.shorewall.net">https://lists.shorewall.net</a>)
-    which hosts parts of this web site.<br>
-    <br>
-    X.509 certificates are the basis for the Secure Socket Layer
-    (SSL). As part of establishing an SSL session (URL
-    https://...), your browser verifies the X.509 certificate
-    supplied by the HTTPS server against the set of Certificate
-    Authority Certificates that were shipped with your browser. It
-    is expected that the server's certificate was issued by one of
-    the authorities whose identities are known to your browser.
-    <br>
-    <br>
-    This mechanism, while supposedly guaranteeing that when you
-    connect to https://www.foo.bar you are REALLY connecting to
-    www.foo.bar, means that the CAs literally have a license to
-    print money -- they are selling a string of bits (an X.509
-    certificate) for $200US+ per year!!!I <br>
-    <br>
-    I wish that I had decided to become a CA rather that designing
-    and writing Shorewall.<br>
-    <br>
-    What does this mean to you? It means that the X.509 certificate
-    that my server will present to your browser will not have been
-    signed by one of the authorities known to your browser. If you
-    try to connect to my server using SSL, your browser will frown
-    and give you a dialog box asking if you want to accept the
-    sleezy X.509 certificate being presented by my server. <br>
-    <br>
-    There are two things that you can do:<br>
-
-    <ol>
-      <li>You can accept the mail.shorewall.net certificate when
-      your browser asks -- your acceptence of the certificate can
-      be temporary (for that access only) or perminent.</li>
-
-      <li>You can download and install <a href="ca.crt">my
-      (self-signed) CA certificate.</a> This will make my
-      Certificate Authority known to your browser so that it will
-      accept any certificate signed by me.<br>
-      </li>
-    </ol>
-    What are the risks?<br>
-
-    <ol>
-      <li>If you install my CA certificate then you assume that I
-      am trustworthy and that Shorewall running on your firewall
-      won't redirect HTTPS requests intented to go to your bank's
-      server to one of my systems that will present your browser
-      with a bogus certificate claiming that my server is that of
-      your bank.</li>
-
-      <li>If you only accept my server's certificate when prompted
-      then the most that you have to loose is that when you connect
-      to https://mail.shorewall.net, the server you are connecting
-      to might not be mine.</li>
-    </ol>
-    I have my CA certificate loaded into all of my browsers but I
-    certainly won't be offended if you decline to load it into
-    yours... :-)<br>
-    <br>
-    <br>
-    <br>
-    <br>
-  </body>
-</html>
-
diff --git a/web/Shorewall_index_frame.htm b/web/Shorewall_index_frame.htm
deleted file mode 100644
index 12b239352..000000000
--- a/web/Shorewall_index_frame.htm
+++ /dev/null
@@ -1,55 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-<html>
-<head>
-  <meta http-equiv="CONTENT-TYPE" content="text/html; charset=UTF-8">
-  <title>Shorewall</title>
-  <base target="main">
-  <meta name="author" content="Cristian Rodriguez R.">
-  <title="default" media="screen"></title="default">
-</head>
-<body>
-<h4><a target="_top" href="index.htm">Home</a><br>
-<a href="Notices.html">Important Notices</a><br>
-<a href="download.htm">Download</a><br>
-<a href="Documentation.html">Documentation</a><br>
-<a href="support.htm">Support</a><br>
-<a href="shorewall_mirrors.htm">Mirrors</a><br>
-<a href="News.htm">News</a><br>
-<a target="_top"
- href="http://wiki.shorewall.net/wiki/ContributingToDevelopment">How
-to Contribute</a><br>
-<a target="_top" href="http://wiki.shorewall.net/">Trac Wiki</a><br>
-<a href="useful_links.html">Other Links</a><big>
-<br>
-</big></h4>
-<p style="text-align: left;" class="copyright"><small><a
- href="copyright.htm">Copyright©&nbsp;2001-2009</a></small><small><a
- href="copyright.htm"><br>
-Thomas&nbsp;M.&nbsp;Eastep</a></small></p>
-<small>
-</small>
-<div style="text-align: center;"><small><br>
-</small>
-<div style="text-align: left;"><small>Please&nbsp;report&nbsp;errors
-on&nbsp;this&nbsp;site&nbsp;to <a
- href="mailto:webmaster@shorewall.net?subject=Website%20Comments">the&nbsp;Webmaster</a></small>
-<br>
-</div>
-<br>
-<a target="_top"
- href="http://wiki.shorewall.net/wiki/LogoDesignCompetition"><img
- alt="Shorweall Logo" src="images/gareth-davies-logo3_88x31.png"
- style="border: 0px solid ; width: 88px; height: 31px;" align="middle"></a><br>
-<br>
-<br>
-<br>
-<a target="_top" href="http://sourceforge.net/projects/shorewall"><img
- src="http://sflogo.sourceforge.net/sflogo.php?group_id=22587&amp;type=11"
- alt="Get Shoreline Firewall (Shorewall) at SourceForge.net. Fast, secure and Free Open Source software downloads"
- border="0" height="30" width="120"></a>
-<br>
-<div style="text-align: left;"><br>
-</div>
-</div>
-</body>
-</html>
diff --git a/web/copyright.htm b/web/copyright.htm
deleted file mode 100644
index 3d32b6ba2..000000000
--- a/web/copyright.htm
+++ /dev/null
@@ -1,43 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
-<html>
-<head>
-  <meta name="generator"
- content="HTML Tidy for Linux (vers 1st April 2002), see www.w3.org">
-  <meta http-equiv="Content-Language" content="en-us">
-  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
-  <title>Copyright</title>
-</head>
-<body>
-<h1 style="text-align: center;">Copyright<br>
-</h1>
-<p align="left">Copyright © 2000-2009 Thomas M Eastep&nbsp; <br>
-</p>
-<p style="margin-left: 40px;" align="left">The <a target="_top"
- href="http://wiki.shorewall.net/wiki/LogoDesignCompetition">Shorewall
-Logo</a> is the work of Gareth Davies of <a target="_top"
- href="http://thusa.co.za/">Thusa</a> and is licensed under the
-Creative
-Commons
-Attribution-Share Alike 2.5 South Africa License. To view a copy of
-this
-licence, visit <a
- href="http://creativecommons.org/licenses/by-sa/2.5/za/">http://creativecommons.org/licenses/by-sa/2.5/za/
-</a>or send a
-letter to Creative Commons, 171 Second Street, Suite 300, San
-Francisco,
-California 94105, USA.<br>
-</p>
-<blockquote>
-  <p align="left">Permission is granted to copy, distribute and/or
-modify this document under the terms of the GNU Free Documentation
-License, Version 1.1 or any later version published by the Free
-Software Foundation; with no Invariant Sections, with no Front-Cover,
-and with no Back-Cover Texts. A copy of the license is included in the
-section entitled "<a href="GnuCopyright.htm">GNU Free Documentation
-License</a>".<br>
-&nbsp;</p>
-</blockquote>
-<br>
-<br>
-</body>
-</html>
diff --git a/web/download.htm b/web/download.htm
deleted file mode 100644
index 8a20bc12c..000000000
--- a/web/download.htm
+++ /dev/null
@@ -1,592 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
-<html>
-<head>
-  <meta http-equiv="CONTENT-TYPE" content="text/html; charset=UTF-8">
-  <title>Download</title>
-  <meta name="CREATED" content="20060304;10324500">
-  <meta name="CHANGEDBY" content="Tom Eastep">
-  <meta name="CHANGED" content="20060310;20345500">
-  <meta http-equiv="Content-Language" content="en-us">
-</head>
-<body dir="ltr" lang="en-US">
-<h1 align="left">Shorewall Download<br>
-</h1>
-<hr style="width: 100%; height: 2px;">
-<table style="text-align: left; width: 100%;" border="0" cellpadding="2"
- cellspacing="0">
-  <tbody>
-    <tr>
-      <td style="vertical-align: top; font-weight: bold;"><a
- href="#Distros">Package Information</a><a href="#Distros"><br>
-      </a> </td>
-      <td style="vertical-align: top; font-weight: bold;"><a
- href="#Distros">Distribution-specific Download Sites<br>
-      </a></td>
-      <td style="vertical-align: top;"><a href="#Sites"><span
- style="font-weight: bold;">Standard Download Sites</span></a><br>
-      </td>
-      <td style="vertical-align: top;"><a href="#Updates"><span
- style="font-weight: bold;">Finding Updates that Correct Known Problems</span></a><br>
-      </td>
-      <td style="vertical-align: top;"><a href="#SVN"><span
- style="font-weight: bold;">SVN</span><br>
-      </a></td>
-      <td style="vertical-align: top;"><a href="#Git"><span
- style="font-weight: bold;">Git</span><br>
-      </a></td>
-    </tr>
-  </tbody>
-</table>
-<p> </p>
-<hr><span style="font-weight: bold;">2009-06-28</span>
-<h2><a name="Which"></a>Package Information</h2>
-<p><b>Before trying to install, we strongly urge you to read and print
-a
-copy
-of the <a href="shorewall_quickstart_guide.htm">Shorewall QuickStart
-Guide</a> for the configuration that most closely matches your own.</b>
-</p>
-<p>The documentation in both XML and HTML formats is available for
-download
-from the Download Sites listed in the<a href="#Sites"> table below</a>.</p>
-<p><font color="#ff0000"><b>NOTICE: There are three current Shorewall
-Release
-Series:</b></font></p>
-<ul>
-  <li> The STABLE release series is 4.2.
-Choose this release if you value stability and good documentation. </li>
-  <li>The prior STABLE release series is 4.0. We release updates to
-this series to correct problems but usually don't make enhancements to
-it.&nbsp;</li>
-  <li>The DEVELOPMENT release series is 4.4 Beta
-(found in the
-'development' directory). Choose this release if you&nbsp; want to help
-shake out the bugs in the next stable release. <span
- style="font-weight: bold;"></span> <strong></strong></li>
-</ul>
-For additional information, see this article about the <a
- href="ReleaseModel.html">Shorewall Release Model</a>.
-<p>In Shorewall version <span style="font-weight: bold;">4.0.*</span>,
-there are four related
-packages:</p>
-<ul>
-  <li><span style="font-weight: bold;">Shorewall-shell</span> -- the
-legacy Shorewall configuration compiler
-written in Bourne Shell. Not recommended for new installations.<br>
-  </li>
-  <li><span style="font-weight: bold;">Shorewall-perl</span> -- an
-implementation of the Shorewall
-configuration compiler written in the Perl programming language. This
-compiler is much faster than Shorewall-shell and produces a firewall
-script that runs faster. It is the preferred compiler for new Shorewall
-installations.</li>
-  <li><span style="font-weight: bold;">Shorewall-common</span> -- A
-base package required by both
-Shorewall-shell and Shorewall-perl.</li>
-  <li><span style="font-weight: bold;">Shorewall-lite</span> -- a
-light-weight Shorewall version that will run
-compiled firewall scripts generated on a system with one of the
-compiler packages installed.</li>
-</ul>
-In Shorewall version <span style="font-weight: bold;">4.2.*</span>,
-there are two additional
-packages that provide IPv6 support:<br>
-<ul>
-  <li><span style="font-weight: bold;">Shorewall6</span> -- Provides
-/sbin/shorewall6 for controlling an IPv6
-firewall. Requires Shorewall-common and Shorewall-perl,&nbsp; 4.2.4 or
-later.<br>
-  </li>
-  <li><span style="font-weight: bold;">Shorewall6-lite</span> -- a
-light-weight Shorewall6 version that will
-run compiled firewall scripts generated on a system with Shorewall6
-installed.<br>
-  </li>
-</ul>
-In Shorewall version <span style="font-weight: bold;">4.4.*</span>,
-the Shorewall-common, Shorewall-shell and
-Shorewall-perl packages are discontinued and replaced with a single <span
- style="font-weight: bold;">Shorewall</span> package which combines the
-functions of Shorewall-common and Shorewall-perl. The shell-based
-compiler is retired. So with Shorewall 4.4 onward, there are four
-packages:<br>
-<ul>
-  <li><span style="font-weight: bold;">Shorewall </span>-- Includes
-everything needed to create an IPv4 firewall.</li>
-  <li><span style="font-weight: bold;">Shorewall6 </span>-- Requires
-the Shorewall package and adds the capability to create an IPv6
-firewall.</li>
-  <li><span style="font-weight: bold;">Shorewall-lite</span> -- a
-light-weight Shorewall version that will run
-compiled firewall scripts generated on a system with one of the
-compiler packages installed.</li>
-  <li><span style="font-weight: bold;">Shorewall6-lite</span> -- a
-light-weight Shorewall6 version that will
-run compiled firewall scripts generated on a system with Shorewall6
-installed.</li>
-</ul>
-To summarize:
-<ul>
-  <li>If you are installing <span style="font-weight: bold;">Shorewall
-4.2 or earlier</span>:<br>
-  </li>
-  <ul>
-    <li>On at least one system in your network, you must install one or
-both of the compilers (Shorewall-shell and/or Shorewall-perl; <span
- style="font-weight: bold;">Shorewall-perl is highly recommended</span>),
-the
-Shorewall-common package and possibly the Shorewall6 package.</li>
-    <li>If you only have a single firewall, then that system should be
-your firewall system.</li>
-    <li>If you have more than one firewall, you may wish to install one
-or both of the compilers on a single <em>administrative</em> system
-and install Shorewall-lite and/or Shorewall6-lite on the firewalls.
-Doing so will allow for
-centralized administration and configuration of the firewalls.</li>
-    <li>When RPM is used to install Shorewall, the compiler
-(shorewall-shell
-and/or shorewall-perl) and shorewall-common must be installed in a
-single execution of the
-rpm utility.</li>
-  </ul>
-  <li>If you are installing <span style="font-weight: bold;">Shorewall
-4.4 or later</span>:</li>
-  <ul>
-    <li>On at least one system in your network, you must install the
-Shorewall package. If you need IPv6 firewalls then you must also
-install the Shorewall6 package.</li>
-    <li>If you have a single firewall, then that system should be your
-firewall system.</li>
-    <li>If you have more than one firewall, you may wish to install
-Shorewall (and possibly Shorewall6) on a single <span
- style="font-style: italic;">administrative</span>
-system and install Shorewall-lite and/or Shorewall6-lite on the
-firewalls. Doing so will allow for centralized administration and
-configuration of the firewalls.<br>
-    </li>
-  </ul>
-</ul>
-<p>Here are the <a href="Install.htm">installation instructions</a>.</p>
-<h2><a name="Distros"></a>Distribution-specific Download Sites</h2>
-<p>Once you've printed the appropriate QuickStart Guide, download the
-appropriate Packages:</p>
-<ul>
-  <li>
-    <p style="margin-bottom: 0in;">Simon Matter provides RPMs tailored
-for <b>Redhat</b> and <b>Fedora</b>. You can <a
- href="http://www.invoca.ch/pub/packages/shorewall/">download them from
-his site</a>.</p>
-  </li>
-  <li>
-    <p style="margin-bottom: 0in;">Fabio Longarai provides a package
-for <b>OpenWRT</b> (Open firmware for Linksys® WRT54G). You can <a
- href="http://openwrt.homelinux.net/">download it from his site</a>. </p>
-<!-- Seems Unavailable
-    <LI><P STYLE="margin-bottom: 0in">Marc Zonzon provides an old
-    package for <B>OpenWRT</B> (Open firmware for Linksys&reg; WRT54G).
-    You can <A HREF="http://www.iut-lannion.fr/ZONZON/memos_index.php?part=Network&amp;section=WRTMemo&amp;subsec=shorewall">download
-    it from his site</A>.</P> -->
-  </li>
-  <li>
-    <p style="margin-bottom: 0in;">jMCg provides a package for <b>Arch
-Linux.</b> You can <a
- href="http://aur.archlinux.org/packages.php?do_Details=1&amp;ID=1563&amp;O=0&amp;L=0&amp;C=0&amp;K=shorewall&amp;SB=n&amp;PP=25&amp;do_MyPackages=0">download
-it from the Arch Linux site</a>. </p>
-  </li>
-  <li>
-    <p style="margin-bottom: 0in;">If you run a <b>SUSE,</b> <b>Linux
-PPC</b>, <b>Trustix</b> or <b>TurboLinux</b> distribution with a 2.4
-or 2.6 kernel, you can use the <a href="#Sites">standard RPM version</a>
-(note: the RPM
-should also work with other distributions that store init scripts in
-/etc/init.d and that include chkconfig or insserv). If you find that it
-works in other cases, let <a href="mailto:teastep@shorewall.net">me</a>
-know so that I can mention them here (Note: the standard RPM is known
-to work on Redhat, Fedora and Mandriva with issues ranging from trivial
-(Redhat and Fedora) to moderate (Mandriva)). See the <a
- href="Install.htm">Installation Instructions</a> if you have problems
-installing the RPM.</p>
-  </li>
-  <li>
-    <p style="margin-bottom: 0in;">If you run <a
- href="http://www.debian.org/"><b>Debian</b></a> and would like a .deb
-package, Shorewall is included in the <a
- href="http://packages.debian.org/stable/net/">Debian Stable Branch</a>,
-the <a href="http://packages.debian.org/testing/net/">Debian
-Testing Branch</a> and the <a
- href="http://packages.debian.org/unstable/net/">Debian
-Unstable Branch</a>. For new installations, it is highly recommended
-that you install the shorewall-common and shorewall-perl packages
-rather than the shorewall package.<br>
-    <br>
-Additionally, packages for the current Debian
-stable release are available from the package maintainer's <a
- href="http://people.connexer.com/%7Eroberto/debian/">personal page</a>.
-Those packages are almost always more up-to-date than the ones in the
-Debian Stable Branch.<br>
-    <br>
-    </p>
-  </li>
-  <li>If you run <a style="font-weight: bold;" href="Ubuntu">Ubuntu,</a>
-Benjamin Montgomery maintains a <a
- href="https://launchpad.net/%7Ebmonty/+archive/ppa">repository for
-Hardy Heron and Jaunty Jackalope</a>.<br>
-  </li>
-  <li>
-    <p style="margin-bottom: 0in;">If you run <a
- style="font-weight: bold;" href="http://leaf.sourceforge.net/">LEAF/Bering</a>
-or one if it's
-derivatives, you can download a .lrp file from the Leaf site.<br>
-    <br>
-From the LEAF Bering-uClibc Team: <br>
-    <br>
-    </p>
-    <div style="margin-left: 40px;">We try to provide the latest stable
-version shortly after release, but we also want to do some internal
-tests before making it available. So we may be behind sometimes. But
-better be sure that the new version is running on LEAF, than being too
-fast...<br>
-    <br>
-I know it's not obvious for newbies where to find the lrp on our pages.<br>
-    <br>
-shorewall.lrp is part of the packages page:<br>
-    <br>
-    <a
- href="http://leaf.sourceforge.net/bering-uclibc/index.php?module=pagemaster&amp;PAGE_user_op=view_page&amp;PAGE_id=3&amp;MMN_position=3:3">http://leaf.sourceforge.net/bering-uclibc/index.php?module=pagemaster&amp;PAGE_user_op=view_page&amp;PAGE_id=3&amp;MMN_position=3:3</a><br>
-    <br>
-which itself links to cvs:<br>
-    <br>
-    <a
- href="http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/leaf/bin/bering-uclibc/packages/shorwall.lrp?rev=HEAD&amp;content-type=application/octet-stream">http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/leaf/bin/bering-uclibc/packages/shorwall.lrp?rev=HEAD&amp;content-type=application/octet-stream</a><br>
-    <br>
-    </div>
-  </li>
-  <li>Shorewall packages for <a target="_top"
- href="http://www.slackware.com/"><span style="font-weight: bold;">Slackware</span></a>
-are available at <a target="_top"
- href="http://slackbuilds.org/result/?search=shorewall&amp;sv=">http://slackbuilds.org/result/?search=shorewall&amp;sv=</a>.<br>
-    <p><span style="font-weight: bold;"></span></p>
-  </li>
-  <li>
-    <p><span style="font-weight: bold;">Otherwise</span>, download the<span
- style="font-style: italic;"> </span>appropriate
-tarballs (.tgz or tar.bz2) from one of the standard download sites
-below.<br>
-    </p>
-  </li>
-</ul>
-<p>You will probably also want to download the HTML version of the
-documentation for easy reference.</p>
-<h2><a name="Sites"></a><b>Standard Download Sites</b></h2>
-<p style="margin-left: 0.42in;">Use the sites below to download the
-<b>tarball</b>, the <b>documentation</b> and the <b>standard RPM</b>
-for
-(<b>SUSE</b>, <b>Power PPC</b>, <b>Trustix</b> and <b>TurboLinux</b>).<br>
-<br>
-Packages are GPG signed, please <b>verify the integrity of the files</b>
-using our public key <a
- href="https://lists.shorewall.net/shorewall.gpg.key">https://lists.shorewall.net/shorewall.gpg.key</a>
-</p>
-<dl>
-  <dd>
-    <table border="0" cellpadding="2" cellspacing="0">
-      <tbody>
-        <tr>
-          <td>
-          <p><b>SERVER LOCATION</b></p>
-          </td>
-          <td>
-          <p><b>DOMAIN</b></p>
-          </td>
-          <td>
-          <p><b>HTTP</b></p>
-          </td>
-          <td>
-          <p><b>FTP</b></p>
-          </td>
-        </tr>
-        <tr>
-          <td>
-          <p>Slovak Republic</p>
-          </td>
-          <td>
-          <p>Shorewall.net</p>
-          </td>
-          <td>
-          <p><a href="http://slovakia.shorewall.net/pub/shorewall/">Browse</a></p>
-          </td>
-          <td>
-          <p><a href="ftp://slovakia.shorewall.net/mirror/shorewall/"
- target="_blank">Browse</a></p>
-          </td>
-        </tr>
-        <tr>
-          <td>
-          <p>Seattle, Washington, USA<span style="font-weight: bold;"></span><br>
-          </p>
-          </td>
-          <td>
-          <p>Shorewall.net</p>
-          </td>
-          <td>
-          <p><a href="http://www.shorewall.net/pub/shorewall/">Browse</a></p>
-          </td>
-          <td>
-          <p><a href="ftp://ftp.shorewall.net/pub/shorewall/"
- target="_blank">Browse</a></p>
-          </td>
-        </tr>
-        <tr>
-          <td>
-          <p>Frankfurt/Main, Germany</p>
-          </td>
-          <td>
-          <p>Shorewall.de</p>
-          </td>
-          <td>
-          <p><a href="http://www.shorewall.de/pub/shorewall/">Browse</a></p>
-          </td>
-          <td>
-          <p>N/A</p>
-          </td>
-        </tr>
-        <tr>
-          <td style="vertical-align: top;">Moscow, Russia<br>
-          </td>
-          <td style="vertical-align: top;">Shorewall.ru<br>
-          </td>
-          <td style="vertical-align: top;"><a
- href="http://shorewall.ru/pub/shorewall/">Browse</a><br>
-          </td>
-          <td style="vertical-align: top;"><a
- href="ftp://shorewall.ru/pub/shorewall/">Browse</a><br>
-          </td>
-        </tr>
-        <tr>
-          <td>
-          <p>Shoreline, Wa, USA</p>
-          </td>
-          <td>
-          <p>Shorewall.net</p>
-          </td>
-          <td>
-          <p><a href="http://www1.shorewall.net/pub/shorewall/">Browse</a></p>
-          </td>
-          <td>
-          <p><a href="ftp://ftp1.shorewall.net/pub/shorewall"
- target="_top">Browse</a></p>
-          </td>
-        </tr>
-        <tr>
-          <td>
-          <p>Australia<br>
-          </p>
-          </td>
-          <td>
-          <p>Shorewall.com.au</p>
-          </td>
-          <td>
-          <p><a href="http://www.shorewall.com.au/" target="_top">Browse</a></p>
-          </td>
-          <td>
-          <p>N/A</p>
-          </td>
-        </tr>
-        <tr valign="top">
-          <td>
-          <p>Argentina</p>
-          </td>
-          <td>
-          <p>Shorewall.net</p>
-          </td>
-          <td>
-          <p><a
- href="http://argentina.shorewall.net/pub/shorewall/shorewall">Browse</a></p>
-          </td>
-          <td>
-          <p>N/A<br>
-          </p>
-          </td>
-        </tr>
-        <tr>
-          <td style="vertical-align: top;">Chicago, Illinois, USA
-(Incomplete)<br>
-          </td>
-          <td style="vertical-align: top;">Sourceforge.net<br>
-          </td>
-          <td style="vertical-align: top;"><a
- href="http://sourceforge.net/project/showfiles.php?group_id=22587">Browse</a></td>
-          <td style="vertical-align: top;">N/A</td>
-        </tr>
-      </tbody>
-    </table>
-  </dd>
-</dl>
-<h2><a name="Updates"></a>Finding Updates that Correct Known Problems</h2>
-<p>Beginning with Shorewall 4.0.6, updated packages that include fixes
-to
-known problems are made available.</p>
-<p>Example:</p>
-<blockquote>
-  <pre>ftp&gt; cd pub/shorewall/4.0/shorewall-4.0.6<br>250 OK. Current directory is /pub/shorewall/4.0/shorewall-4.0.6<br>ftp&gt; ls<br>200 PORT command successful<br>150 Connecting to port 36018<br>drwxr-sr-x    4 1006     8            4096 Dec  1 08:16 .<br>drwxr-sr-x    9 1006     8            4096 Nov 23 08:22 ..<br>-rw-r--r--    1 1006     8             194 Nov 24 07:38 4.0.6-2.md5sums<br>-rw-r--r--    1 1006     8             218 Nov 24 07:38 4.0.6-2.sha1sums<br>-rw-r--r--    1 1006     8             841 Nov 26 13:26 4.0.6.md5sums<br>-rw-r--r--    1 1006     8             945 Nov 26 13:26 4.0.6.sha1sums<br>-rw-r--r--    1 1006     8             322 Nov 26 08:35 README.txt<br>drwxr-xr-x    4 1006     8            4096 Nov 23 08:21 <strong>base</strong><br>-rw-r--r--    1 1006     8            1570 Dec  1 08:16 <span
- style="font-weight: bold;">known_problems.txt</span><br>-rw-r--r--    1 1006     8          148363 Nov 23 08:22 patch-4.0.6<br>-rw-r--r--    1 1006     8            4238 Nov 24 16:49 <span
- style="font-weight: bold;">patch-perl-4.0.6.1</span><br>-rw-r--r--    1 1006     8            5249 Nov 29 07:38 <strong>patch-perl-4.0.6.2</strong><br>...<br><br>-rw-r--r--    1 1006     8          102295 Nov 24 07:38 shorewall-perl-4.0.6<strong>-2</strong>.noarch.rpm   &lt;=========<br>-rw-r--r--    1 1006     8           99884 Nov 24 07:38 shorewall-perl-4.0.6<strong>.2</strong>.tar.bz2      &lt;=========  <br>-rw-r--r--    1 1006     8             300 Nov 24 07:38 shorewall-perl-4.0.6<strong>.2</strong>.tar.bz2.asc  &lt;=========<br>-rw-r--r--    1 1006     8          124814 Nov 24 07:38 shorewall-perl-4.0.6<strong>.2</strong>.tgz          &lt;=========<br>-rw-r--r--    1 1006     8             300 Nov 24 07:38 shorewall-perl-4.0.6<strong>.2</strong>.tgz.asc      &lt;=========<br>-rw-r--r--    1 1006     8           59124 Nov 23 08:22 shorewall-shell-4.0.6-0base.noarch.rpm<br>-rw-r--r--    1 1006     8           76500 Nov 23 08:22 shorewall-shell-4.0.6.tar.bz2<br>-rw-r--r--    1 1006     8             300 Nov 23 08:22 shorewall-shell-4.0.6.tar.bz2.asc<br>-rw-r--r--    1 1006     8           95193 Nov 23 08:22 shorewall-shell-4.0.6.tgz<br>-rw-r--r--    1 1006     8             300 Nov 23 08:22 shorewall-shell-4.0.6.tgz.asc<br>drwxr-sr-x    2 1006     8            4096 Nov 26 08:33 <strong>superseded</strong><br>226-Options: -a -l <br>226 41 matches total<br>ftp</pre>
-</blockquote>
-<blockquote>
-  <p>The lines flagged with &lt;====== show that the Shorewall-perl
-package has been updated to include two bug fixes (note the "-2" and
-".2" in the file names). The base tarballs for the release are found in
-the <strong>base</strong>
-directory. The unified diff files <strong>patch-4.0.6.*</strong>
-may be applied sequentially to the base (4.0.6) Shorewall-perl release
-(from the <span style="font-weight: bold;">base</span> directory) to
-produce
-4.0.6.2. The obsoleted 4.0.6 Shorewall-perl packages may be found in
-the <strong>superseded</strong>
-directory. The <strong>known_problems.txt</strong> file indicates
-which problems are fixed in each updated package.</p>
-</blockquote>
-<h2><a name="SVN"></a><b>SVN</b></h2>
-<blockquote> The <a href="https://sourceforge.net/svn/?group_id=22587"
- target="_blank">SVN&nbsp;Repository at Sourceforge</a> is used as a
-safe-store for Shorewall releases.<br>
-  <br>
-You should download and use the latest SVN version only <b>at your own
-risk</b> -- <strong>please do not attempt to install Shorewall from
-the SVN components; you will end up with an incomplete and non-working
-installation. </strong>
-  <p>If you want to build your own packages from the SVN images, use
-the build script found in tools/build/buildshorewall.</p>
-  <p>If you are looking for bug fixes for the current release, see <a
- href="#Updates">above.</a><br>
-  <br>
-The following SVN projects are currently active:<br>
-  </p>
-</blockquote>
-<ol>
-  <li>
-    <blockquote>
-      <p><span style="font-weight: bold;">branches</span></p>
-      <p>This project contains sub-projects for each of the stable
-releases.</p>
-      <p>The current <strong>stable</strong> version is branch named
-x.y where x.y is the major version. Example: 3.4. <br>
-      </p>
-      <p>You can download it using the following commands: <br>
-      <br>
-&nbsp;&nbsp;&nbsp; <span style="font-weight: bold;">svn co
-https://shorewall.svn.sourceforge.net/svnroot/shorewall/branches/x.y/Shorewall</span></p>
-    </blockquote>
-  </li>
-  <li>
-    <blockquote> <b>Shorewall<br>
-      <br>
-      </b>This project contains the Shorewall code.<br>
-      <br>
-      <br>
-You can download it using the following commands: <br>
-      <br>
-&nbsp;&nbsp;&nbsp; <span style="font-weight: bold;">svn co
-https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk/Shorewall</span><br>
-      <span style="font-weight: bold;"></span></blockquote>
-  </li>
-  <li>
-    <blockquote> <span style="font-weight: bold;">manpages<br>
-      </span><br>
-Beginning with Shorewall 3,4,0, this project contains the man pages for
-Shorewall. 'trunk' is the current development version.<br>
-      <br>
-You can download it using the following commands: <br>
-      <br>
-&nbsp;&nbsp;&nbsp; <span style="font-weight: bold;">svn co
-https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk/manpages</span></blockquote>
-  </li>
-  <li>
-    <blockquote> <span style="font-weight: bold;">manpages-lite<br>
-      </span><br>
-Beginning with Shorewall 3.4.0, this project contains the man pages for
-Shorewall Lite. 'trunk'&nbsp; is the current development version.<br>
-      <br>
-You can download it using the following commands: <br>
-      <br>
-&nbsp;&nbsp;&nbsp; <span style="font-weight: bold;">svn co
-https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk/manpages-lite</span></blockquote>
-  </li>
-  <li>
-    <blockquote> <span style="font-weight: bold;">docs</span><br>
-      <b><br>
-      </b>This project contains the Shorewall documenation.<br>
-trunk is the current development version. <br>
-      <br>
-      <br>
-You can always get the current documentation in XML Docbook format
-using the following command: <br>
-      <br>
-&nbsp;&nbsp;&nbsp; <span style="font-weight: bold;">svn co
-https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk/docs</span></blockquote>
-  </li>
-  <li>
-    <blockquote> <b>web<br>
-      <br>
-      </b>The project contains the part of this Web site not included
-in the "docs" project. </blockquote>
-  </li>
-  <li>
-    <blockquote> <b>tools<br>
-      <br>
-      </b>This project includes the tools used by the Shorewall
-developers to build Shorewall releases and to publish content to the
-web sites.</blockquote>
-  </li>
-  <li>
-    <blockquote> <b>Samples<br>
-      <br>
-      </b>This project contains the sample configurations.</blockquote>
-  </li>
-  <li>
-    <blockquote> <b>Shorewall-lite<br>
-      <br>
-      </b>This project contains Shorewall Lite -- introduced in
-Shorewall version 3.2.0 RC1.<br>
-    </blockquote>
-  </li>
-  <li>
-    <blockquote><b>Shorewall6<br>
-      <br>
-      </b>This project contains Shorewall6 -- introduced in Shorewall
-version
-4.2.4.</blockquote>
-  </li>
-  <li>
-    <blockquote><b>Shorewall6-lite<br>
-      <br>
-      </b>This project contains Shorewall6 Lite -- introduced in
-Shorewall
-version 4.2.4.</blockquote>
-  </li>
-</ol>
-<h2><a name="Git"></a>Git</h2>
-Beginning with Shorewall 4.3, the Shorewall project is migrating from
-SVN to Git. You may browse the <a
- href="http://shorewall.git.sourceforge.net/git/gitweb.cgi?p=shorewall;a=tree">Shorewall
-Git repository at Sourceforge</a>.<br>
-<br>
-To create your own copy of the repository, use this command:<br>
-<br>
-<div style="margin-left: 40px;"><span style="font-weight: bold;">git&nbsp;clone&nbsp;git://shorewall.git.sourceforge.net/gitroot/shorewall</span><br>
-<br>
-</div>
-<hr style="width: 100%; height: 2px;">Copyright ©&nbsp; 2001-2009
-Thomas M. Eastep
-<p>Permission is granted to copy, distribute and/or modify this
-document
-under the terms of the GNU Free Documentation License, Version 1.2 or
-any
-later version published by the Free Software Foundation; with no
-Invariant
-Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of
-the
-license is included in the section entitled “<a href="GnuCopyright.htm"
- target="_self">GNU Free Documentation License</a>”.</p>
-</body>
-</html>
diff --git a/web/favicon.ico b/web/favicon.ico
deleted file mode 100644
index 81822ec99..000000000
Binary files a/web/favicon.ico and /dev/null differ
diff --git a/web/gnu_mailman.htm b/web/gnu_mailman.htm
deleted file mode 100644
index 0c4c85cee..000000000
--- a/web/gnu_mailman.htm
+++ /dev/null
@@ -1,91 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
-
-<html>
-  <head>
-    <meta name="generator" content=
-    "HTML Tidy for Linux (vers 1st April 2002), see www.w3.org">
-    <meta http-equiv="Content-Language" content="en-us">
-    <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
-    <meta name="ProgId" content="FrontPage.Editor.Document">
-    <meta http-equiv="Content-Type" content=
-    "text/html; charset=windows-1252">
-
-    <title>GNU Mailman</title>
-  </head>
-
-  <body>
-    <h1 style="text-align: left;">GNU Mailman/Postfix the Easy
-    Way&nbsp;</h1>
-    <span style="font-weight: bold;">Tom Eastep</span><br>
-
-    <h4><span style="font-weight: normal;">Copyright � 2001-2003
-    Thomas M. Eastep</span><br>
-    <br>
-    <span style="font-weight: normal;">Permission is granted to
-    copy, distribute and/or modify this document under the terms of
-    the GNU Free Documentation License, Version 1.2 or any later
-    version published by the Free Software Foundation; with no
-    Invariant Sections, with no Front-Cover, and with no Back-Cover
-    Texts. A copy of the license is included in the section
-    entitled �</span><a href=
-    "http://shorewall.net/GnuCopyright.htm" style=
-    "font-weight: normal;">GNU Free Documentation License</a><span
-    style="font-weight: normal;">�.</span><br style=
-    "font-weight: normal;">
-    <br style="font-weight: normal;">
-    <span style="font-weight: normal;">2003-12-31</span></h4>
-    <hr style="width: 100%; height: 2px;">
-
-    <h4>The following was posted on the Postfix mailing list on
-    5/4/2002 by Michael Tokarev as a suggested addition to the
-    Postfix FAQ.</h4>
-
-    <p>Q: Mailman does not work with Postfix, complaining about GID
-    mismatch<br>
-    <br>
-    A: Mailman uses a setgid wrapper that is designed to be used in
-    system-wide aliases file so that rest of mailman's mail
-    handling processes will run with proper uid/gid. Postfix has an
-    ability to run a command specified in an alias as owner of that
-    alias, thus mailman's wrapper is not needed here. The best
-    method to invoke mailman's mail handling via aliases is to use
-    separate alias file especially for mailman, and made it owned
-    by mailman and group mailman. Like:<br>
-    <br>
-    alias_maps = hash:/etc/postfix/aliases,
-    hash:/var/mailman/aliases<br>
-    <br>
-    Make sure that /var/mailman/aliases.db is owned by mailman user
-    (this may be done by executing postalias as mailman
-    userid).<br>
-    <br>
-    Next, instead of using mailman-suggested aliases entries with
-    wrapper, use the following:<br>
-    <br>
-    instead of<br>
-    mailinglist: /var/mailman/mail/wrapper post mailinglist<br>
-    mailinglist-admin: /var/mailman/mail/wrapper mailowner
-    mailinglist<br>
-    mailinglist-request: /var/mailman/mail/wrapper mailcmd
-    mailinglist<br>
-    ...<br>
-    <br>
-    use<br>
-    mailinglist: /var/mailman/scripts/post mailinglist<br>
-    mailinglist-admin: /var/mailman/scripts/mailowner
-    mailinglist<br>
-    mailinglist-request: /var/mailman/scripts/mailcmd
-    mailinglist<br>
-    ...</p>
-
-    <h4>The above tip works with Mailman 2.0; Mailman 2.1 has
-    adopted something very similar so that no workaround is
-    necessary. See the README.POSTFIX file included with
-    Mailman-2.1.<br>
-    </h4>
-    <br>
-    <br>
-    <br>
-  </body>
-</html>
-
diff --git a/web/images/100_0269.jpg b/web/images/100_0269.jpg
deleted file mode 100644
index 9e3a0c61c..000000000
Binary files a/web/images/100_0269.jpg and /dev/null differ
diff --git a/web/images/Blizzard-of-05-p1000205.jpg b/web/images/Blizzard-of-05-p1000205.jpg
deleted file mode 100644
index 7b3b4b9d0..000000000
Binary files a/web/images/Blizzard-of-05-p1000205.jpg and /dev/null differ
diff --git a/web/images/Blizzard-of-05-p1000206.jpg b/web/images/Blizzard-of-05-p1000206.jpg
deleted file mode 100644
index b86f9c1fc..000000000
Binary files a/web/images/Blizzard-of-05-p1000206.jpg and /dev/null differ
diff --git a/web/images/Blizzard-of-05-p1000207.jpg b/web/images/Blizzard-of-05-p1000207.jpg
deleted file mode 100644
index 929b0ae2a..000000000
Binary files a/web/images/Blizzard-of-05-p1000207.jpg and /dev/null differ
diff --git a/web/images/Blizzard-of-05-p1000208.jpg b/web/images/Blizzard-of-05-p1000208.jpg
deleted file mode 100644
index 515c0f801..000000000
Binary files a/web/images/Blizzard-of-05-p1000208.jpg and /dev/null differ
diff --git a/web/images/Blizzard-of-05-p1000209.jpg b/web/images/Blizzard-of-05-p1000209.jpg
deleted file mode 100644
index 85c6daf67..000000000
Binary files a/web/images/Blizzard-of-05-p1000209.jpg and /dev/null differ
diff --git a/web/images/Hiking1.jpg b/web/images/Hiking1.jpg
deleted file mode 100644
index b3f826ad3..000000000
Binary files a/web/images/Hiking1.jpg and /dev/null differ
diff --git a/web/images/Logo.png b/web/images/Logo.png
deleted file mode 100644
index 7189589ee..000000000
Binary files a/web/images/Logo.png and /dev/null differ
diff --git a/web/images/Logo1.gif b/web/images/Logo1.gif
deleted file mode 100644
index 34b1c43fb..000000000
Binary files a/web/images/Logo1.gif and /dev/null differ
diff --git a/web/images/Logo1.png b/web/images/Logo1.png
deleted file mode 100644
index 05f02a0c0..000000000
Binary files a/web/images/Logo1.png and /dev/null differ
diff --git a/web/images/Logo2.gif b/web/images/Logo2.gif
deleted file mode 100644
index 457199c50..000000000
Binary files a/web/images/Logo2.gif and /dev/null differ
diff --git a/web/images/Logo3.png b/web/images/Logo3.png
deleted file mode 100644
index c92a6f7b6..000000000
Binary files a/web/images/Logo3.png and /dev/null differ
diff --git a/web/images/MDKlinux.jpg b/web/images/MDKlinux.jpg
deleted file mode 100644
index 92888d12c..000000000
Binary files a/web/images/MDKlinux.jpg and /dev/null differ
diff --git a/web/images/ORE.jpg b/web/images/ORE.jpg
deleted file mode 100644
index fd7803d2d..000000000
Binary files a/web/images/ORE.jpg and /dev/null differ
diff --git a/web/images/P1000048.jpg b/web/images/P1000048.jpg
deleted file mode 100644
index 01e4ebd6f..000000000
Binary files a/web/images/P1000048.jpg and /dev/null differ
diff --git a/web/images/P1000049.jpg b/web/images/P1000049.jpg
deleted file mode 100644
index 4531f2b6a..000000000
Binary files a/web/images/P1000049.jpg and /dev/null differ
diff --git a/web/images/P1000050.jpg b/web/images/P1000050.jpg
deleted file mode 100644
index 16e9b0f72..000000000
Binary files a/web/images/P1000050.jpg and /dev/null differ
diff --git a/web/images/P1000244.JPG b/web/images/P1000244.JPG
deleted file mode 100644
index 37561f5bb..000000000
Binary files a/web/images/P1000244.JPG and /dev/null differ
diff --git a/web/images/ProtectedBy.png b/web/images/ProtectedBy.png
deleted file mode 100644
index b38a0a1cd..000000000
Binary files a/web/images/ProtectedBy.png and /dev/null differ
diff --git a/web/images/Proxmox.png b/web/images/Proxmox.png
deleted file mode 100644
index 4b6b8214e..000000000
Binary files a/web/images/Proxmox.png and /dev/null differ
diff --git a/web/images/SY00079.gif b/web/images/SY00079.gif
deleted file mode 100644
index 845bc5921..000000000
Binary files a/web/images/SY00079.gif and /dev/null differ
diff --git a/web/images/Shorewall_Banner.gif b/web/images/Shorewall_Banner.gif
deleted file mode 100644
index 8f64d0add..000000000
Binary files a/web/images/Shorewall_Banner.gif and /dev/null differ
diff --git a/web/images/Tom.jpg b/web/images/Tom.jpg
deleted file mode 100644
index 3d7e78192..000000000
Binary files a/web/images/Tom.jpg and /dev/null differ
diff --git a/web/images/TomNTarry.png b/web/images/TomNTarry.png
deleted file mode 100644
index a38a19111..000000000
Binary files a/web/images/TomNTarry.png and /dev/null differ
diff --git a/web/images/TotemCompletePlain.png b/web/images/TotemCompletePlain.png
deleted file mode 100644
index 956020075..000000000
Binary files a/web/images/TotemCompletePlain.png and /dev/null differ
diff --git a/web/images/TotemCompletePlain.svg b/web/images/TotemCompletePlain.svg
deleted file mode 100644
index 8990b91b6..000000000
--- a/web/images/TotemCompletePlain.svg
+++ /dev/null
@@ -1,2373 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<!-- Created with Inkscape (http://www.inkscape.org/) -->
-<svg
-   xmlns:dc="http://purl.org/dc/elements/1.1/"
-   xmlns:cc="http://creativecommons.org/ns#"
-   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
-   xmlns:svg="http://www.w3.org/2000/svg"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:xlink="http://www.w3.org/1999/xlink"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
-   version="1.0"
-   width="765"
-   height="1260"
-   id="svg2160"
-   style="display:inline"
-   sodipodi:version="0.32"
-   inkscape:version="0.46"
-   sodipodi:docname="TotemCompletePlain.svg"
-   inkscape:output_extension="org.inkscape.output.svg.inkscape">
-  <metadata
-     id="metadata2868">
-    <rdf:RDF>
-      <cc:Work
-         rdf:about="">
-        <dc:format>image/svg+xml</dc:format>
-        <dc:type
-           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
-      </cc:Work>
-    </rdf:RDF>
-  </metadata>
-  <sodipodi:namedview
-     inkscape:window-height="670"
-     inkscape:window-width="640"
-     inkscape:pageshadow="2"
-     inkscape:pageopacity="0.0"
-     guidetolerance="10.0"
-     gridtolerance="10.0"
-     objecttolerance="10.0"
-     borderopacity="1.0"
-     bordercolor="#666666"
-     pagecolor="#ffffff"
-     id="base"
-     showgrid="false"
-     inkscape:zoom="0.40889028"
-     inkscape:cx="384.75"
-     inkscape:cy="626.53502"
-     inkscape:window-x="429"
-     inkscape:window-y="35"
-     inkscape:current-layer="svg2160" />
-  <defs
-     id="defs2162">
-    <inkscape:perspective
-       sodipodi:type="inkscape:persp3d"
-       inkscape:vp_x="0 : 630 : 1"
-       inkscape:vp_y="0 : 1000 : 0"
-       inkscape:vp_z="765 : 630 : 1"
-       inkscape:persp3d-origin="382.5 : 420 : 1"
-       id="perspective2870" />
-    <linearGradient
-       id="linearGradient3625">
-      <stop
-         id="stop3627"
-         style="stop-color:#999999;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop3629"
-         style="stop-color:#656160;stop-opacity:1"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient3590">
-      <stop
-         id="stop3592"
-         style="stop-color:#7c7c7c;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop3594"
-         style="stop-color:#4a4a4a;stop-opacity:1"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient3582">
-      <stop
-         id="stop3584"
-         style="stop-color:#848484;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop3586"
-         style="stop-color:#4f4f4f;stop-opacity:1"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient3574">
-      <stop
-         id="stop3576"
-         style="stop-color:#7a7a7a;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop3578"
-         style="stop-color:#5a5a5a;stop-opacity:1"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient3566">
-      <stop
-         id="stop3568"
-         style="stop-color:#707070;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop3570"
-         style="stop-color:#5a5a5a;stop-opacity:1"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient14450">
-      <stop
-         id="stop14452"
-         style="stop-color:#ffffff;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop14454"
-         style="stop-color:#3f3f3f;stop-opacity:1"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient12482">
-      <stop
-         id="stop12484"
-         style="stop-color:#dddddd;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop12486"
-         style="stop-color:#494542;stop-opacity:1"
-         offset="1" />
-    </linearGradient>
-    <filter
-       id="filter13754">
-      <feGaussianBlur
-         inkscape:collect="always"
-         id="feGaussianBlur13756"
-         stdDeviation="1.7701034" />
-    </filter>
-    <filter
-       id="filter12781">
-      <feGaussianBlur
-         inkscape:collect="always"
-         id="feGaussianBlur12783"
-         stdDeviation="0.90251453" />
-    </filter>
-    <linearGradient
-       id="linearGradient7651">
-      <stop
-         id="stop7653"
-         style="stop-color:#e69d08;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop7655"
-         style="stop-color:#eeb318;stop-opacity:0.40000001"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient6488">
-      <stop
-         id="stop6490"
-         style="stop-color:#eec218;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop6492"
-         style="stop-color:#eec218;stop-opacity:0.2"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient6332">
-      <stop
-         id="stop6334"
-         style="stop-color:#eec218;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop6336"
-         style="stop-color:#e69500;stop-opacity:1"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient6314">
-      <stop
-         id="stop6316"
-         style="stop-color:#e69900;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop6318"
-         style="stop-color:#eec218;stop-opacity:0"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient4352">
-      <stop
-         id="stop4354"
-         style="stop-color:#e69500;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop4356"
-         style="stop-color:#eec219;stop-opacity:0.40000001"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient4747">
-      <stop
-         id="stop4749"
-         style="stop-color:#e69500;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop4751"
-         style="stop-color:#eec218;stop-opacity:0.40000001"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient4321">
-      <stop
-         id="stop4323"
-         style="stop-color:#e69d08;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop4325"
-         style="stop-color:#eebe1f;stop-opacity:0.94117647"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient4311">
-      <stop
-         id="stop4313"
-         style="stop-color:#e69d08;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop4315"
-         style="stop-color:#eec210;stop-opacity:1"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient3289">
-      <stop
-         id="stop3291"
-         style="stop-color:#e69900;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop3293"
-         style="stop-color:#eec210;stop-opacity:1"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient6174">
-      <stop
-         id="stop6176"
-         style="stop-color:#eebe18;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop6178"
-         style="stop-color:#e69900;stop-opacity:1"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient10183">
-      <stop
-         id="stop10185"
-         style="stop-color:#e69908;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop10187"
-         style="stop-color:#eec210;stop-opacity:1"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient6274">
-      <stop
-         id="stop6276"
-         style="stop-color:#e69908;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop6278"
-         style="stop-color:#eec210;stop-opacity:1"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient3238">
-      <stop
-         id="stop3240"
-         style="stop-color:#282828;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop3242"
-         style="stop-color:#bebebe;stop-opacity:1"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient3216">
-      <stop
-         id="stop3218"
-         style="stop-color:#eeb618;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop3220"
-         style="stop-color:#e6a108;stop-opacity:1"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient3204">
-      <stop
-         id="stop3206"
-         style="stop-color:#e6a100;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop3208"
-         style="stop-color:#eeba10;stop-opacity:1"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient3194">
-      <stop
-         id="stop3196"
-         style="stop-color:#e6a100;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop3198"
-         style="stop-color:#eeba10;stop-opacity:1"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient3307">
-      <stop
-         id="stop3309"
-         style="stop-color:#282828;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop3311"
-         style="stop-color:#bebebe;stop-opacity:1"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient3211">
-      <stop
-         id="stop3213"
-         style="stop-color:#202020;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop3219"
-         style="stop-color:#ffffff;stop-opacity:0.94117647"
-         offset="0.5" />
-      <stop
-         id="stop3215"
-         style="stop-color:#000000;stop-opacity:0.94117647"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient3174">
-      <stop
-         id="stop3176"
-         style="stop-color:#ffffff;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop3178"
-         style="stop-color:#000000;stop-opacity:1"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       id="linearGradient5099">
-      <stop
-         id="stop5101"
-         style="stop-color:#000000;stop-opacity:1"
-         offset="0" />
-      <stop
-         id="stop5103"
-         style="stop-color:#ffffff;stop-opacity:1"
-         offset="1" />
-    </linearGradient>
-    <linearGradient
-       x1="407.961"
-       y1="272.99841"
-       x2="549.90308"
-       y2="272.99841"
-       id="linearGradient3217"
-       xlink:href="#linearGradient3211"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="448.17624"
-       y1="303.31522"
-       x2="444.84506"
-       y2="279.95868"
-       id="linearGradient3313"
-       xlink:href="#linearGradient3307"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="431.43814"
-       y1="330.6962"
-       x2="454.0126"
-       y2="331.59512"
-       id="linearGradient3200"
-       xlink:href="#linearGradient3194"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="442.37518"
-       y1="330.6506"
-       x2="455.06134"
-       y2="330.6506"
-       id="linearGradient3210"
-       xlink:href="#linearGradient3204"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="464.39908"
-       y1="331.77496"
-       x2="477.38489"
-       y2="332.2244"
-       id="linearGradient3222"
-       xlink:href="#linearGradient3216"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="448.17624"
-       y1="303.31522"
-       x2="444.84506"
-       y2="279.95868"
-       id="linearGradient3230"
-       xlink:href="#linearGradient3307"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="482.36987"
-       y1="304.08746"
-       x2="478.23489"
-       y2="281.73093"
-       id="linearGradient3244"
-       xlink:href="#linearGradient3238"
-       gradientUnits="userSpaceOnUse" />
-    <radialGradient
-       cx="435.21771"
-       cy="332.45865"
-       r="29.268661"
-       fx="435.21771"
-       fy="332.45865"
-       id="radialGradient6282"
-       xlink:href="#linearGradient6274"
-       gradientUnits="userSpaceOnUse"
-       gradientTransform="matrix(0.7372316,-7.5958565e-2,0.127922,1.2415734,71.819209,-44.633546)" />
-    <radialGradient
-       cx="475.54245"
-       cy="338.79556"
-       r="28.530207"
-       fx="475.54245"
-       fy="338.79556"
-       id="radialGradient10189"
-       xlink:href="#linearGradient10183"
-       gradientUnits="userSpaceOnUse"
-       gradientTransform="matrix(0.5809229,8.1549164e-2,-0.1461905,1.0414014,251.65926,-51.854458)" />
-    <linearGradient
-       x1="352.92432"
-       y1="761.19879"
-       x2="357.80234"
-       y2="778.94739"
-       id="linearGradient9089"
-       xlink:href="#linearGradient6174"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="603.84027"
-       y1="708.44012"
-       x2="619.67914"
-       y2="768.00116"
-       id="linearGradient6338"
-       xlink:href="#linearGradient6332"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="603.84027"
-       y1="708.44012"
-       x2="619.67914"
-       y2="768.00116"
-       id="linearGradient6345"
-       xlink:href="#linearGradient6332"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="603.84027"
-       y1="708.44012"
-       x2="619.67914"
-       y2="768.00116"
-       id="linearGradient6354"
-       xlink:href="#linearGradient6332"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="603.84027"
-       y1="708.44012"
-       x2="619.67914"
-       y2="768.00116"
-       id="linearGradient6363"
-       xlink:href="#linearGradient6332"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="603.84027"
-       y1="708.44012"
-       x2="619.67914"
-       y2="768.00116"
-       id="linearGradient6372"
-       xlink:href="#linearGradient6332"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="603.84027"
-       y1="708.44012"
-       x2="619.67914"
-       y2="768.00116"
-       id="linearGradient6381"
-       xlink:href="#linearGradient6332"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="603.84027"
-       y1="708.44012"
-       x2="619.67914"
-       y2="768.00116"
-       id="linearGradient6390"
-       xlink:href="#linearGradient6332"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="603.84027"
-       y1="708.44012"
-       x2="619.67914"
-       y2="768.00116"
-       id="linearGradient6399"
-       xlink:href="#linearGradient6332"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="603.84027"
-       y1="708.44012"
-       x2="619.67914"
-       y2="768.00116"
-       id="linearGradient6408"
-       xlink:href="#linearGradient6332"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="603.84027"
-       y1="708.44012"
-       x2="619.67914"
-       y2="768.00116"
-       id="linearGradient6417"
-       xlink:href="#linearGradient6332"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="603.84027"
-       y1="708.44012"
-       x2="619.67914"
-       y2="768.00116"
-       id="linearGradient6426"
-       xlink:href="#linearGradient6332"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="603.84027"
-       y1="708.44012"
-       x2="619.67914"
-       y2="768.00116"
-       id="linearGradient6435"
-       xlink:href="#linearGradient6332"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="603.84027"
-       y1="708.44012"
-       x2="619.67914"
-       y2="768.00116"
-       id="linearGradient6444"
-       xlink:href="#linearGradient6332"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="603.84027"
-       y1="708.44012"
-       x2="619.67914"
-       y2="768.00116"
-       id="linearGradient6453"
-       xlink:href="#linearGradient6332"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="603.84027"
-       y1="708.44012"
-       x2="619.67914"
-       y2="768.00116"
-       id="linearGradient6462"
-       xlink:href="#linearGradient6332"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="603.84027"
-       y1="708.44012"
-       x2="619.67914"
-       y2="768.00116"
-       id="linearGradient6471"
-       xlink:href="#linearGradient6332"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="603.84027"
-       y1="708.44012"
-       x2="619.67914"
-       y2="768.00116"
-       id="linearGradient6480"
-       xlink:href="#linearGradient6332"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="634.50659"
-       y1="692.30896"
-       x2="648.67102"
-       y2="756.58545"
-       id="linearGradient6494"
-       xlink:href="#linearGradient6488"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="634.50659"
-       y1="692.30896"
-       x2="648.67102"
-       y2="756.58545"
-       id="linearGradient6501"
-       xlink:href="#linearGradient6488"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="634.50659"
-       y1="692.30896"
-       x2="648.67102"
-       y2="756.58545"
-       id="linearGradient6510"
-       xlink:href="#linearGradient6488"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="634.50659"
-       y1="692.30896"
-       x2="648.67102"
-       y2="756.58545"
-       id="linearGradient6519"
-       xlink:href="#linearGradient6488"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="634.50659"
-       y1="692.30896"
-       x2="648.67102"
-       y2="756.58545"
-       id="linearGradient6528"
-       xlink:href="#linearGradient6488"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="634.50659"
-       y1="692.30896"
-       x2="648.67102"
-       y2="756.58545"
-       id="linearGradient6537"
-       xlink:href="#linearGradient6488"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="634.50659"
-       y1="692.30896"
-       x2="648.67102"
-       y2="756.58545"
-       id="linearGradient6546"
-       xlink:href="#linearGradient6488"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="634.50659"
-       y1="692.30896"
-       x2="648.67102"
-       y2="756.58545"
-       id="linearGradient6555"
-       xlink:href="#linearGradient6488"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="634.50659"
-       y1="692.30896"
-       x2="648.67102"
-       y2="756.58545"
-       id="linearGradient6564"
-       xlink:href="#linearGradient6488"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="634.50659"
-       y1="692.30896"
-       x2="648.67102"
-       y2="756.58545"
-       id="linearGradient6573"
-       xlink:href="#linearGradient6488"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="634.50659"
-       y1="692.30896"
-       x2="648.67102"
-       y2="756.58545"
-       id="linearGradient6582"
-       xlink:href="#linearGradient6488"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="634.50659"
-       y1="692.30896"
-       x2="648.67102"
-       y2="756.58545"
-       id="linearGradient6591"
-       xlink:href="#linearGradient6488"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="634.50659"
-       y1="692.30896"
-       x2="648.67102"
-       y2="756.58545"
-       id="linearGradient6600"
-       xlink:href="#linearGradient6488"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="634.50659"
-       y1="692.30896"
-       x2="648.67102"
-       y2="756.58545"
-       id="linearGradient6609"
-       xlink:href="#linearGradient6488"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="634.50659"
-       y1="692.30896"
-       x2="648.67102"
-       y2="756.58545"
-       id="linearGradient6618"
-       xlink:href="#linearGradient6488"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="634.50659"
-       y1="692.30896"
-       x2="648.67102"
-       y2="756.58545"
-       id="linearGradient6627"
-       xlink:href="#linearGradient6488"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="634.50659"
-       y1="692.30896"
-       x2="648.67102"
-       y2="756.58545"
-       id="linearGradient6636"
-       xlink:href="#linearGradient6488"
-       gradientUnits="userSpaceOnUse" />
-    <filter
-       id="filter4785">
-      <feGaussianBlur
-         inkscape:collect="always"
-         id="feGaussianBlur4787"
-         stdDeviation="0.05753715" />
-    </filter>
-    <filter
-       id="filter4789">
-      <feGaussianBlur
-         inkscape:collect="always"
-         id="feGaussianBlur4791"
-         stdDeviation="0.05753715" />
-    </filter>
-    <filter
-       id="filter4793">
-      <feGaussianBlur
-         inkscape:collect="always"
-         id="feGaussianBlur4795"
-         stdDeviation="0.05753715" />
-    </filter>
-    <filter
-       id="filter4797">
-      <feGaussianBlur
-         inkscape:collect="always"
-         id="feGaussianBlur4799"
-         stdDeviation="0.05753715" />
-    </filter>
-    <filter
-       id="filter4801">
-      <feGaussianBlur
-         inkscape:collect="always"
-         id="feGaussianBlur4803"
-         stdDeviation="0.05753715" />
-    </filter>
-    <filter
-       id="filter4805">
-      <feGaussianBlur
-         inkscape:collect="always"
-         id="feGaussianBlur4807"
-         stdDeviation="0.05753715" />
-    </filter>
-    <filter
-       id="filter4809">
-      <feGaussianBlur
-         inkscape:collect="always"
-         id="feGaussianBlur4811"
-         stdDeviation="0.05753715" />
-    </filter>
-    <linearGradient
-       x1="514.94385"
-       y1="1426.7307"
-       x2="519.46716"
-       y2="1420.1044"
-       id="linearGradient3517"
-       xlink:href="#linearGradient3625"
-       gradientUnits="userSpaceOnUse"
-       gradientTransform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)" />
-    <linearGradient
-       x1="459.09088"
-       y1="1285.9814"
-       x2="545.42017"
-       y2="1282.9309"
-       id="linearGradient3536"
-       xlink:href="#linearGradient14450"
-       gradientUnits="userSpaceOnUse"
-       gradientTransform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)" />
-    <linearGradient
-       x1="480.61465"
-       y1="1371.4814"
-       x2="494.6759"
-       y2="1371.4814"
-       id="linearGradient3570"
-       xlink:href="#linearGradient3566"
-       gradientUnits="userSpaceOnUse"
-       gradientTransform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)" />
-    <linearGradient
-       x1="477.2341"
-       y1="1369.8682"
-       x2="494.52222"
-       y2="1369.8682"
-       id="linearGradient3573"
-       xlink:href="#linearGradient3574"
-       gradientUnits="userSpaceOnUse"
-       gradientTransform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)" />
-    <linearGradient
-       x1="474.92917"
-       y1="1368.101"
-       x2="494.52222"
-       y2="1368.101"
-       id="linearGradient3576"
-       xlink:href="#linearGradient3582"
-       gradientUnits="userSpaceOnUse"
-       gradientTransform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)" />
-    <linearGradient
-       x1="472.93158"
-       y1="1366.0266"
-       x2="494.2149"
-       y2="1366.0266"
-       id="linearGradient3579"
-       xlink:href="#linearGradient3590"
-       gradientUnits="userSpaceOnUse"
-       gradientTransform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)" />
-    <radialGradient
-       cx="496.88397"
-       cy="1153.4373"
-       r="39.052128"
-       fx="496.88397"
-       fy="1153.4373"
-       id="radialGradient3600"
-       xlink:href="#linearGradient12482"
-       gradientUnits="userSpaceOnUse"
-       gradientTransform="matrix(1.2584195,-0.1602019,0.1474251,1.1580552,-405.36486,-388.64598)" />
-    <linearGradient
-       x1="439.55005"
-       y1="597.60486"
-       x2="451.37723"
-       y2="597.60486"
-       id="linearGradient3603"
-       xlink:href="#linearGradient5099"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="456.84824"
-       y1="652.74744"
-       x2="464.76743"
-       y2="646.80127"
-       id="linearGradient3605"
-       xlink:href="#linearGradient3174"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="407.961"
-       y1="272.99841"
-       x2="549.90308"
-       y2="272.99841"
-       id="linearGradient3766"
-       xlink:href="#linearGradient3211"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="448.17624"
-       y1="303.31522"
-       x2="444.84506"
-       y2="279.95868"
-       id="linearGradient3768"
-       xlink:href="#linearGradient3307"
-       gradientUnits="userSpaceOnUse" />
-    <linearGradient
-       x1="482.36987"
-       y1="304.08746"
-       x2="478.23489"
-       y2="281.73093"
-       id="linearGradient3770"
-       xlink:href="#linearGradient3238"
-       gradientUnits="userSpaceOnUse" />
-    <radialGradient
-       cx="435.21771"
-       cy="332.45865"
-       r="29.268661"
-       fx="435.21771"
-       fy="332.45865"
-       id="radialGradient3772"
-       xlink:href="#linearGradient6274"
-       gradientUnits="userSpaceOnUse"
-       gradientTransform="matrix(0.7372316,-7.5958565e-2,0.127922,1.2415734,71.819209,-44.633546)" />
-    <radialGradient
-       cx="475.54245"
-       cy="338.79556"
-       r="28.530207"
-       fx="475.54245"
-       fy="338.79556"
-       id="radialGradient3774"
-       xlink:href="#linearGradient10183"
-       gradientUnits="userSpaceOnUse"
-       gradientTransform="matrix(0.5809229,8.1549164e-2,-0.1461905,1.0414014,251.65926,-51.854458)" />
-    <radialGradient
-       cx="475.54245"
-       cy="338.79556"
-       r="28.530207"
-       fx="475.54245"
-       fy="338.79556"
-       id="radialGradient3832"
-       xlink:href="#linearGradient10183"
-       gradientUnits="userSpaceOnUse"
-       gradientTransform="matrix(0.4779985,6.7100772e-2,-0.1202893,0.8568921,188.19196,-124.24935)" />
-    <radialGradient
-       cx="435.21771"
-       cy="332.45865"
-       r="29.268661"
-       fx="435.21771"
-       fy="332.45865"
-       id="radialGradient3835"
-       xlink:href="#linearGradient6274"
-       gradientUnits="userSpaceOnUse"
-       gradientTransform="matrix(0.6066133,-6.2500682e-2,0.1052575,1.0215989,40.214891,-118.3078)" />
-  </defs>
-  <g
-     id="layer5"
-     style="display:inline">
-    <rect
-       width="758.51001"
-       height="1137.6801"
-       x="5.4949937"
-       y="64.624954"
-       id="rect3612"
-       style="opacity:1;fill:#ffffff;fill-opacity:1;stroke:#ffffff;stroke-width:1.98998749;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    <path
-       d="M 289.73072,780.4506 C 244.14754,805.27271 253.75554,945.2517 254.56371,975.60139 C 254.82762,985.51217 258.82627,1037.3057 260.99546,1051.4627 C 263.65268,1068.8049 269.42335,1091.5824 274.0679,1100.4071 C 277.71978,1128.7217 284.96495,1134.4451 284.96495,1134.4451 L 477.26444,1132.9322 C 487.24254,1107.6756 496.6155,1082.9049 500.61659,1045.2763 C 505.5392,998.98117 504.92607,956.69137 504.92607,956.69137 C 506.24314,944.2105 507.53364,887.32829 505.30426,848.52645 C 503.1508,811.49459 460.67676,774.39937 460.67676,774.39937 C 460.67676,774.39937 289.73072,780.4506 289.73072,780.4506 z"
-       id="path9544"
-       style="fill:#614031;fill-opacity:1;fill-rule:evenodd;stroke:#1f1a17;stroke-width:2.87989092;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 375.24726,832.42062 C 357.9732,847.12666 357.17247,884.82303 359.76119,902.07276 C 364.39997,904.97199 370.19846,907.43207 380.63572,913.81037 C 391.073,920.18875 422.76779,911.78169 421.22511,904.97199 C 415.65474,880.38315 401.3051,828.15279 380.63572,818.91426 C 380.22571,821.37434 379.82189,828.67043 378.89618,839.20893 C 377.6326,853.59382 378.89618,869.95794 379.71621,881.43834 C 375.89254,873.47059 374.01722,841.85095 375.24726,832.42062 z"
-       id="path10522"
-       style="fill:url(#radialGradient3600);fill-opacity:1;fill-rule:evenodd;stroke:#99999f;stroke-width:1.64565206;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:0.94117647;display:inline" />
-    <path
-       d="M 511.25649,1165.9458 A 7.2253599,7.2253599 0 1 1 496.80577,1165.9458 A 7.2253599,7.2253599 0 1 1 511.25649,1165.9458 z"
-       transform="matrix(0.822826,0,0,0.822826,-18.57231,-81.582154)"
-       id="path12462"
-       style="fill:#f0c217;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:11.44000025;stroke-opacity:0.94117647;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <path
-       d="M 511.25649,1165.9458 A 7.2253599,7.2253599 0 1 1 496.80577,1165.9458 A 7.2253599,7.2253599 0 1 1 511.25649,1165.9458 z"
-       transform="matrix(0.2252796,0,0,0.2252796,282.62798,614.81623)"
-       id="path12464"
-       style="fill:#1f1a17;fill-opacity:1;fill-rule:nonzero;stroke:#1f1a17;stroke-width:0.99920875;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:11.44000025;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <path
-       d="M 363.66568,936.53872 C 350.84006,940.30084 342.80268,944.4051 340.92158,947.65427 C 339.0405,950.90337 340.06654,954.32353 342.46065,955.69164 C 344.85477,957.05967 348.85421,955.91355 351.35309,955.17861 C 354.26023,954.32353 358.08091,952.96594 360.07451,950.90337 C 361.95364,948.95919 366.57282,947.14124 366.57282,947.14124 L 363.66568,936.53872 z"
-       id="path3526"
-       style="fill:#dedede;fill-opacity:1;fill-rule:evenodd;stroke:#9d9d9d;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 363.83669,938.59076 C 351.35309,942.01092 344.25624,947.48329 339.98103,950.39042"
-       id="path3528"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 364.77724,940.64289 C 351.26758,945.26018 346.56486,948.93681 340.23755,952.52795"
-       id="path3530"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 365.20476,942.60953 C 354.43123,946.88477 351.69511,949.70632 349.30099,950.73238 C 346.90688,951.75845 341.3491,954.58 341.3491,954.58"
-       id="path3532"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 365.71778,944.91813 C 357.8514,947.65427 355.6283,950.5614 353.06317,952.1005 C 350.49804,953.63951 344.34175,956.20467 344.34175,956.20467"
-       id="path3534"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 363.66568,936.53872 C 350.84006,940.30084 342.80268,944.4051 340.92158,947.65427 C 339.0405,950.90337 340.06654,954.32353 342.46065,955.69164 C 344.85477,957.05967 348.85421,955.91355 351.35309,955.17861 C 354.26023,954.32353 358.08091,952.96594 360.07451,950.90337 C 361.95364,948.95919 366.57282,947.14124 366.57282,947.14124 L 363.66568,936.53872 z"
-       id="path3536"
-       style="fill:none;fill-opacity:1;fill-rule:evenodd;stroke:#9d9d9d;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 425.72788,924.51295 C 429.59818,918.47522 435.83057,916.73478 436.72462,917.80758 C 437.61866,918.88046 440.12198,921.20494 440.30079,923.17183 C 440.4796,925.13879 441.73126,928.35728 441.73126,930.86064 C 441.73126,933.36393 442.23675,936.34428 441.01602,941.05274 C 439.76436,945.88051 441.57599,958.00987 440.30079,958.57597 C 438.86936,959.21144 435.65176,954.82101 434.04249,953.74812 C 432.43321,952.67524 427.42656,952.31764 427.42656,952.31764 C 427.42656,952.31764 427.06895,949.45676 426.89014,942.48322 C 426.71133,935.50969 425.12797,925.44875 425.72788,924.51295 z"
-       id="path3538"
-       style="fill:#dedede;fill-opacity:1;fill-rule:evenodd;stroke:#9d9d9d;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 427.60537,949.81436 C 433.86368,949.63556 440.70179,955.61026 440.70179,955.61026"
-       id="path3540"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 427.24776,947.84747 C 434.04249,948.02627 440.50129,952.33936 440.50129,952.33936"
-       id="path3542"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 426.89014,944.98651 C 433.32725,945.70171 440.50129,949.4784 440.50129,949.4784"
-       id="path3544"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 427.06895,942.84082 C 434.93653,943.91362 440.30079,946.59579 440.30079,946.59579"
-       id="path3546"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 425.72788,924.51295 C 429.59818,918.47522 435.83057,916.73478 436.72462,917.80758 C 437.61866,918.88046 440.12198,921.20494 440.30079,923.17183 C 440.4796,925.13879 441.73126,928.35728 441.73126,930.86064 C 441.73126,933.36393 442.23675,936.34428 441.01602,941.05274 C 439.76436,945.88051 441.57599,958.00987 440.30079,958.57597 C 438.86936,959.21144 435.65176,954.82101 434.04249,953.74812 C 432.43321,952.67524 427.42656,952.31764 427.42656,952.31764 C 427.42656,952.31764 427.06895,949.45676 426.89014,942.48322 C 426.71133,935.50969 425.12797,925.44875 425.72788,924.51295 z"
-       id="path3548"
-       style="fill:none;fill-opacity:1;fill-rule:evenodd;stroke:#9d9d9d;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 376.61452,981.22459 C 371.17773,991.59236 372.18923,994.50039 373.32716,997.28204 C 374.46509,1000.0636 375.35014,1000.9487 375.60302,1005.2476 C 375.85589,1009.5464 376.31081,1010.6843 377.75244,1010.6843 C 379.01682,1010.6844 380.53406,1008.1557 380.28118,1005.6269 C 380.02831,1003.0982 379.77543,1000.9487 378.89038,998.42 C 378.00532,995.8913 380.15475,992.98318 380.15475,992.98318 L 376.61452,981.22459 z"
-       id="path3550"
-       style="fill:#dedede;fill-opacity:1;fill-rule:evenodd;stroke:#9d9d9d;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 377.67838,985.34464 C 375.51625,986.60373 374.02706,994.24762 375.29143,997.02918 C 376.55579,999.81083 378.00532,1006.2591 378.00532,1006.2591 C 378.00532,1006.2591 376.83341,997.89907 376.55579,995.8913 C 375.96698,991.63317 377.81753,990.13653 379.06919,989.51069"
-       id="path3552"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:round;stroke-opacity:1;display:inline" />
-    <path
-       d="M 376.61452,981.22459 C 371.17773,991.59236 372.18923,994.50039 373.32716,997.28204 C 374.46509,1000.0636 375.35014,1000.9487 375.60302,1005.2476 C 375.85589,1009.5464 376.31081,1010.6843 377.75244,1010.6843 C 379.01682,1010.6844 380.53406,1008.1557 380.28118,1005.6269 C 380.02831,1003.0982 379.77543,1000.9487 378.89038,998.42 C 378.00532,995.8913 380.15475,992.98318 380.15475,992.98318 L 376.61452,981.22459 z"
-       id="path3554"
-       style="fill:none;fill-opacity:1;fill-rule:evenodd;stroke:#9d9d9d;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 387.36164,1033.443 C 379.52256,1036.0982 374.21222,1041.0292 372.31566,1043.3051 C 370.41911,1045.5809 369.15474,1048.2361 370.79842,1049.8798 C 372.4421,1051.5235 372.56854,1052.0292 375.35014,1053.1671 C 378.13176,1054.305 379.26968,1053.9258 380.91337,1051.2706 C 382.55705,1048.6154 382.68348,1046.8453 384.20072,1044.6958 C 387.10877,1043.1786 386.22371,1042.9258 387.86739,1042.1671 C 387.86739,1039.5119 387.61451,1035.5924 387.36164,1033.443 z"
-       id="path3556"
-       style="fill:#dedede;fill-opacity:1;fill-rule:evenodd;stroke:#9d9d9d;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 387.36164,1035.2132 C 379.14325,1038.5005 372.06279,1045.9603 370.67198,1049.6269"
-       id="path3558"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:url(#linearGradient3579);stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 387.61451,1037.1097 C 381.03981,1039.7648 374.84439,1046.3396 372.31566,1051.1441"
-       id="path3560"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:url(#linearGradient3576);stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 387.61451,1038.7534 C 382.0513,1041.535 378.51106,1045.3281 374.21222,1052.4086"
-       id="path3562"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:url(#linearGradient3573);stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 387.74096,1040.397 C 380.15475,1044.9488 378.13176,1050.3855 376.99383,1053.42"
-       id="path3564"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:url(#linearGradient3570);stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 387.36164,1033.443 C 379.52256,1036.0982 374.21222,1041.0292 372.31566,1043.3051 C 370.41911,1045.5809 369.15474,1048.2361 370.79842,1049.8798 C 372.4421,1051.5235 372.56854,1052.0292 375.35014,1053.1671 C 378.13176,1054.305 379.26968,1053.9258 380.91337,1051.2706 C 382.55705,1048.6154 382.68348,1046.8453 384.20072,1044.6958 C 387.10877,1043.1786 386.22371,1042.9258 387.86739,1042.1671 C 387.86739,1039.5119 387.61451,1035.5924 387.36164,1033.443 z"
-       id="path3600"
-       style="fill:none;fill-opacity:1;fill-rule:evenodd;stroke:#9d9d9d;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 425.90048,926.18814 C 431.08148,921.21284 434.49573,919.88735 438.42951,919.70855"
-       id="path3602"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <g
-       transform="matrix(0.836494,0,0,0.822826,-26.261294,-81.582154)"
-       id="g3861"
-       style="display:inline">
-      <path
-         d="M 541.97214,1245.0056 C 551.5338,1246.3094 558.05311,1249.5691 558.05311,1249.5691"
-         id="path3863"
-         style="opacity:1;fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" />
-      <path
-         d="M 541.84304,1243.1657 C 551.10788,1243.8013 557.41174,1246.6182 557.84636,1246.5985"
-         id="path3865"
-         style="opacity:1;fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" />
-      <path
-         d="M 541.71395,1241.3259 C 550.68196,1241.2933 556.77038,1243.6674 557.63962,1243.6279"
-         id="path3867"
-         style="opacity:1;fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" />
-      <path
-         d="M 541.58485,1239.486 C 550.25604,1238.7852 556.12901,1240.7165 557.43287,1240.6573"
-         id="path3869"
-         style="opacity:1;fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" />
-      <path
-         d="M 541.45575,1237.6462 C 549.83012,1236.2771 555.48764,1237.7657 557.22612,1237.6867"
-         id="path3871"
-         style="opacity:1;fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" />
-      <path
-         d="M 541.32665,1235.8063 C 549.4042,1233.769 554.84628,1234.8148 557.01938,1234.7161"
-         id="path3873"
-         style="opacity:1;fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" />
-      <path
-         d="M 541.19756,1233.9665 C 548.97827,1231.261 554.20491,1231.864 556.81263,1231.7454"
-         id="path3875"
-         style="opacity:1;fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" />
-      <path
-         d="M 541.06846,1232.1266 C 548.55235,1228.7529 553.56355,1228.9131 556.60589,1228.7748"
-         id="path3877"
-         style="opacity:1;fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" />
-      <path
-         d="M 540.93936,1230.2868 C 548.12643,1226.2448 552.92218,1225.9623 556.39914,1225.8042"
-         id="path3879"
-         style="opacity:1;fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" />
-      <path
-         d="M 540.81026,1228.4469 C 547.70051,1223.7367 552.28081,1223.0114 556.19239,1222.8336"
-         id="path3881"
-         style="opacity:1;fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" />
-      <path
-         d="M 540.68117,1226.6071 C 547.27459,1221.2287 551.63945,1220.0606 555.98565,1219.863"
-         id="path3883"
-         style="opacity:1;fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" />
-      <path
-         d="M 540.55207,1224.7672 C 546.84867,1218.7206 550.99808,1217.1097 555.7789,1216.8924"
-         id="path3885"
-         style="opacity:1;fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" />
-    </g>
-    <path
-       d="M 437.68119,922.20344 C 439.80079,922.12881 440.06531,922.05821 440.04304,922.10273"
-       id="path4509"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:0.82282603;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 436.50251,924.82299 C 438.62211,924.74836 440.65675,924.48818 440.63448,924.5327"
-       id="path4511"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:0.82282603;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 436.8186,927.22531 C 438.9382,927.15068 441.09928,926.89042 441.07701,926.93494"
-       id="path4513"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:0.82282603;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 436.94504,929.56444 C 439.06464,929.48981 441.54181,929.35602 441.51953,929.40054"
-       id="path4515"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:0.82282603;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 437.07147,931.96668 C 439.19107,931.89205 441.79468,931.94792 441.7724,931.99244"
-       id="path4517"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:0.82282603;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 437.19791,934.3059 C 439.31751,934.23127 441.79468,934.41352 441.7724,934.45804"
-       id="path4519"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:0.82282603;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 437.26113,936.58167 C 439.50716,936.75989 441.66824,937.00542 441.64597,937.04994"
-       id="path4521"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:0.82282603;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 437.32435,938.85752 C 439.44395,939.03575 441.35215,939.6606 441.32988,939.70512"
-       id="path4523"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:0.82282603;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 437.8301,941.19657 C 439.06464,941.43807 440.90962,941.99965 440.88735,942.04416"
-       id="path4525"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#3f3f3f;stroke-width:0.82282603;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 425.72788,924.51295 C 429.59818,918.47522 435.83057,916.73478 436.72462,917.80758 C 437.61866,918.88046 440.12198,921.20494 440.30079,923.17183 C 440.4796,925.13879 441.73126,928.35728 441.73126,930.86064 C 441.73126,933.36393 442.23675,936.34428 441.01602,941.05274 C 439.76436,945.88051 441.57599,958.00987 440.30079,958.57597 C 438.86936,959.21144 435.65176,954.82101 434.04249,953.74812 C 432.43321,952.67524 427.42656,952.31764 427.42656,952.31764 C 427.42656,952.31764 427.06895,949.45676 426.89014,942.48322 C 426.71133,935.50969 425.12797,925.44875 425.72788,924.51295 z"
-       id="path4527"
-       style="fill:none;fill-opacity:1;fill-rule:evenodd;stroke:#9d9d9d;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 422.51108,1033.8223 C 428.95936,1040.2706 433.13177,1046.0866 433.76395,1048.7418 C 434.39614,1051.397 434.26969,1053.7993 433.13177,1055.6959 C 431.98086,1057.614 429.30192,1061.7384 426.43062,1060.627 C 422.51108,1059.1097 423.77545,1056.328 422.38464,1053.9258 C 420.99383,1051.5235 417.95935,1050.1326 417.95935,1050.1326 L 422.51108,1033.8223 z"
-       id="path4529"
-       style="fill:#dedede;fill-opacity:1;fill-rule:evenodd;stroke:#9d9d9d;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 421.49958,1037.2359 C 429.33866,1044.5693 434.01682,1052.7877 434.01682,1052.7877"
-       id="path4531"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#7e7e7e;stroke-width:1.23423898;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 420.8674,1040.0176 C 428.45361,1047.8566 432.62602,1055.8222 432.62602,1055.8222"
-       id="path4533"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#7e7e7e;stroke-width:1.23423898;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 419.72947,1043.3051 C 427.82142,1051.6499 430.60303,1058.9832 430.60303,1058.9832"
-       id="path4535"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#7e7e7e;stroke-width:1.23423898;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 418.84441,1047.4775 C 425.92487,1053.2935 428.20074,1060.5005 428.20074,1060.5005"
-       id="path4537"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#7e7e7e;stroke-width:1.23423898;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 422.51108,1033.8223 C 428.95936,1040.2706 433.13177,1046.0866 433.76395,1048.7418 C 434.39614,1051.397 434.26969,1053.7993 433.13177,1055.6959 C 431.98086,1057.614 429.30192,1061.7384 426.43062,1060.627 C 422.51108,1059.1097 423.77545,1056.328 422.38464,1053.9258 C 420.99383,1051.5235 417.95935,1050.1326 417.95935,1050.1326 L 422.51108,1033.8223 z"
-       id="path4541"
-       style="fill:none;fill-opacity:1;fill-rule:evenodd;stroke:#afafaf;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 358.87212,900.7968 C 358.8567,936.05407 369.07754,957.50317 373.07743,971.63504 C 377.38517,986.85469 380.55373,997.10373 384.14579,1013.8984 C 389.28614,1037.9321 386.12281,1073.2396 381.17895,1083.7427 C 388.1699,1082.7355 401.71778,1083.8669 406.71131,1086.4856 C 406.71131,1086.4856 413.01287,1069.5805 417.93689,1052.7957 C 423.90653,1032.4465 429.58746,998.00859 429.78956,980.23728 C 429.86753,973.4432 426.67017,914.22458 421.82157,904.17911 C 419.90448,909.06661 411.96779,912.11074 403.11665,913.92178 C 395.29093,915.52292 386.95662,915.8732 378.26938,911.30363 C 370.66154,907.30182 365.74724,904.39321 358.87212,900.7968 z"
-       id="path13463"
-       style="fill:url(#linearGradient3536);fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 381.76095,1084.6351 C 369.11218,1104.4021 351.16287,1114.9926 349.90251,1118.0175 C 348.89031,1120.4467 351.41494,1122.8069 352.92738,1123.059 C 354.43982,1123.3111 360.23748,1122.8069 363.01028,1122.5548 C 365.78308,1122.3028 373.09319,1119.0259 378.13465,1118.5217 C 383.1761,1118.0176 387.96547,1118.7738 390.4862,1120.0341 C 393.00693,1121.2945 403.59398,1124.5714 405.86264,1124.5714 C 408.13129,1124.5714 408.88751,1123.3111 408.38337,1120.2862 C 407.87922,1117.2613 406.87092,1111.7157 406.36678,1107.6826 C 405.80053,1103.1526 405.99442,1090.5416 406.75064,1086.7606 C 399.68531,1083.5201 386.80241,1083.6268 381.76095,1084.6351 z"
-       id="path4767"
-       style="fill:#dedede;fill-opacity:1;fill-rule:evenodd;stroke:#999999;stroke-width:2.05706501;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 404.07513,1086.1078 L 404.85435,1124.0673 L 404.85435,1124.3194"
-       id="path4769"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#666666;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 402.85957,1085.8557 L 401.32533,1123.8152"
-       id="path4773"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#666666;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 401.66439,1085.4949 L 397.04009,1122.0507"
-       id="path4775"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#666666;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 400.39252,1085.2083 L 393.51107,1121.0424"
-       id="path4777"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#666666;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 399.01187,1085.065 L 390.23413,1119.53"
-       id="path4779"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#666666;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 397.52124,1084.7042 L 386.95718,1118.5217"
-       id="path4781"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#666666;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 395.9755,1084.6697 L 383.1761,1118.2696"
-       id="path4783"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#666666;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 394.47456,1084.5379 L 379.89915,1118.2696"
-       id="path4785"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#666666;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 392.84185,1084.5264 L 375.86599,1118.7738"
-       id="path4787"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#666666;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 391.08883,1084.4919 L 371.32868,1119.7821"
-       id="path4789"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#666666;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 389.02886,1084.4919 L 366.03515,1121.7986"
-       id="path4791"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#666666;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 386.65001,1084.4919 L 360.48955,1122.5548"
-       id="path4793"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#666666;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 383.93232,1084.744 L 355.19603,1122.3028"
-       id="path4795"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#666666;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 381.76095,1084.6351 C 369.11218,1104.4021 351.16287,1114.9926 349.90251,1118.0175 C 348.89031,1120.4467 351.41494,1122.8069 352.92738,1123.059 C 354.43982,1123.3111 360.23748,1122.8069 363.01028,1122.5548 C 365.78308,1122.3028 373.09319,1119.0259 378.13465,1118.5217 C 383.1761,1118.0176 387.96547,1118.7738 390.4862,1120.0341 C 393.00693,1121.2945 403.59398,1124.5714 405.86264,1124.5714 C 408.13129,1124.5714 408.88751,1123.3111 408.38337,1120.2862 C 407.87922,1117.2613 406.87092,1111.7157 406.36678,1107.6826 C 405.80053,1103.1526 405.1756,1090.5416 405.93182,1086.7606 C 398.86649,1083.5201 386.80241,1083.6268 381.76095,1084.6351 z"
-       id="path4797"
-       style="fill:none;fill-opacity:1;fill-rule:evenodd;stroke:#999999;stroke-width:2.05706501;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 428.15754,946.01496 C 430.76864,974.17215 430.95841,989.46766 425.97865,1019.0788 C 422.46194,1039.9901 413.31203,1067.8796 407.18121,1086.3419"
-       id="path2555"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#656160;stroke-width:1.23423898;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 406.39827,1105.462 C 406.0911,1097.7827 406.32148,1090.641 407.243,1086.1871"
-       id="path2638"
-       style="fill:#999999;fill-opacity:1;fill-rule:evenodd;stroke:url(#linearGradient3517);stroke-width:1.23423898;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 259.4474,803.7894 C 261.7177,835.52391 237.66421,871.39649 235.73196,883.90599 C 231.07596,914.04924 241.40173,925.66104 256.32598,929.68696 C 270.06562,933.39338 286.28427,934.27981 296.38429,938.01075 C 306.43296,941.72277 306.31298,945.40352 308.86999,944.92619 C 314.78196,943.82262 335.24974,948.75727 345.01886,946.33454 C 355.52371,938.39394 363.71046,914.61723 362.97473,887.02747 C 362.97473,887.02747 352.04974,885.00957 343.72593,886.05011 C 335.40212,887.09058 321.85224,889.33994 318.75451,888.95609 C 297.97563,886.38105 277.26172,882.83936 265.59017,876.34406 C 261.84875,864.28809 260.00909,828.57786 271.41287,810.55254 L 259.4474,803.7894 z"
-       id="path3614"
-       style="fill:#614031;fill-opacity:1;fill-rule:evenodd;stroke:#1f1a17;stroke-width:2.87989092;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 489.87565,809.87247 C 500.91156,830.10494 492.08282,849.96961 490.61137,866.52347 C 490.61137,866.52347 447.82119,886.30873 441.6855,887.49171 C 432.04653,889.35014 423.29232,883.44513 400.11691,883.07733 C 392.19733,900.70234 405.50274,940.87123 415.56718,944.51058 C 424.02805,947.4535 443.47833,941.87293 452.35355,942.30335 C 462.65374,932.73891 489.99949,931.6434 503.11874,927.95672 C 520.43,923.09209 528.50134,908.82783 525.92629,888.59528 C 524.99624,881.28776 496.49719,808.40101 496.49719,808.40101 L 489.87565,809.87247 z"
-       id="path4585"
-       style="fill:#614031;fill-opacity:1;fill-rule:evenodd;stroke:#1f1a17;stroke-width:2.87989092;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 362.34497,1154.4407 C 362.74302,1126.8128 360.19941,1112.8286 359.35497,1106.6006 C 358.5957,1101.0008 353.1614,1096.1357 344.83212,1096.1357 C 333.29927,1096.1357 296.35144,1096.3492 291.65287,1096.3492 C 279.90263,1096.3491 274.67394,1097.684 272.85858,1105.1056 C 269.99712,1116.804 272.0043,1139.0635 272.21787,1143.5485 C 272.44159,1148.2466 273.49621,1154.3635 279.90644,1154.4407 C 297.63286,1154.6542 340.34712,1157.2171 362.34497,1154.4407 z"
-       id="path4587"
-       style="fill:#614031;fill-opacity:1;fill-rule:evenodd;stroke:#1f1a17;stroke-width:2.87989092;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 401.85631,1153.8366 C 401.45826,1126.2087 404.00187,1112.2246 404.84631,1105.9966 C 405.60557,1100.3968 411.03988,1095.5317 419.36916,1095.5317 C 430.90201,1095.5317 467.84984,1095.7452 472.54841,1095.7452 C 484.29865,1095.7451 489.52733,1097.08 491.34269,1104.5016 C 494.20416,1116.2 492.19697,1138.4595 491.9834,1142.9445 C 491.75968,1147.6425 490.70507,1152.8533 484.29483,1152.9305 C 466.56841,1153.144 423.85416,1156.6131 401.85631,1153.8366 z"
-       id="path5558"
-       style="fill:#614031;fill-opacity:1;fill-rule:evenodd;stroke:#1f1a17;stroke-width:2.87989092;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <g
-       transform="matrix(0.8191828,7.7345246e-2,-7.7345246e-2,0.8191828,84.284367,-103.79149)"
-       id="g9457"
-       style="display:inline">
-      <path
-         d="M 533.01332,1215.8049 C 533.01332,1222.3453 526.41992,1226.8635 519.05212,1224.2288 C 511.86952,1221.6602 504.44878,1219.1346 496.31506,1215.3768 C 504.23474,1212.0471 512.51166,1208.2373 519.05212,1206.5249 C 526.62173,1204.5431 533.01332,1209.2645 533.01332,1215.8049 z"
-         id="path9459"
-         style="fill:#7f4730;fill-opacity:1;fill-rule:nonzero;stroke:#1f1a17;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 523.47054,1215.3362 C 523.47054,1219.0119 519.76514,1221.551 515.62453,1220.0703 C 511.58801,1218.6268 507.41766,1217.2074 502.84661,1215.0956 C 507.29736,1213.2244 511.94888,1211.0833 515.62453,1210.121 C 519.87855,1209.0072 523.47054,1211.6606 523.47054,1215.3362 z"
-         id="path9461"
-         style="fill:#bf3042;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.56198645;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    </g>
-    <g
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="g9441"
-       style="display:inline">
-      <path
-         d="M 533.01332,1215.8049 C 533.01332,1222.3453 526.41992,1226.8635 519.05212,1224.2288 C 511.86952,1221.6602 504.44878,1219.1346 496.31506,1215.3768 C 504.23474,1212.0471 512.51166,1208.2373 519.05212,1206.5249 C 526.62173,1204.5431 533.01332,1209.2645 533.01332,1215.8049 z"
-         id="path7498"
-         style="fill:#7f4730;fill-opacity:1;fill-rule:nonzero;stroke:#1f1a17;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 523.47054,1215.3362 C 523.47054,1219.0119 519.76514,1221.551 515.62453,1220.0703 C 511.58801,1218.6268 507.41766,1217.2074 502.84661,1215.0956 C 507.29736,1213.2244 511.94888,1211.0833 515.62453,1210.121 C 519.87855,1209.0072 523.47054,1211.6606 523.47054,1215.3362 z"
-         id="path8470"
-         style="fill:#bf3042;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.56198645;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    </g>
-    <g
-       transform="matrix(0.822826,0,0,0.822826,-22.659749,-96.771259)"
-       id="g9445"
-       style="display:inline">
-      <path
-         d="M 533.01332,1215.8049 C 533.01332,1222.3453 526.41992,1226.8635 519.05212,1224.2288 C 511.86952,1221.6602 504.44878,1219.1346 496.31506,1215.3768 C 504.23474,1212.0471 512.51166,1208.2373 519.05212,1206.5249 C 526.62173,1204.5431 533.01332,1209.2645 533.01332,1215.8049 z"
-         id="path9447"
-         style="fill:#7f4730;fill-opacity:1;fill-rule:nonzero;stroke:#1f1a17;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 523.47054,1215.3362 C 523.47054,1219.0119 519.76514,1221.551 515.62453,1220.0703 C 511.58801,1218.6268 507.41766,1217.2074 502.84661,1215.0956 C 507.29736,1213.2244 511.94888,1211.0833 515.62453,1210.121 C 519.87855,1209.0072 523.47054,1211.6606 523.47054,1215.3362 z"
-         id="path9449"
-         style="fill:#bf3042;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.56198645;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    </g>
-    <g
-       transform="matrix(0.7889277,-0.2337429,0.2337429,0.7889277,-292.58913,52.528322)"
-       id="g9451"
-       style="display:inline">
-      <path
-         d="M 533.01332,1215.8049 C 533.01332,1222.3453 526.41992,1226.8635 519.05212,1224.2288 C 511.86952,1221.6602 504.44878,1219.1346 496.31506,1215.3768 C 504.23474,1212.0471 512.51166,1208.2373 519.05212,1206.5249 C 526.62173,1204.5431 533.01332,1209.2645 533.01332,1215.8049 z"
-         id="path9453"
-         style="fill:#7f4730;fill-opacity:1;fill-rule:nonzero;stroke:#1f1a17;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 523.47054,1215.3362 C 523.47054,1219.0119 519.76514,1221.551 515.62453,1220.0703 C 511.58801,1218.6268 507.41766,1217.2074 502.84661,1215.0956 C 507.29736,1213.2244 511.94888,1211.0833 515.62453,1210.121 C 519.87855,1209.0072 523.47054,1211.6606 523.47054,1215.3362 z"
-         id="path9455"
-         style="fill:#bf3042;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.56198645;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    </g>
-    <g
-       transform="matrix(-0.779817,-0.2625418,0.2625418,-0.779817,447.73629,1977.6089)"
-       id="g9463"
-       style="display:inline">
-      <path
-         d="M 533.01332,1215.8049 C 533.01332,1222.3453 526.41992,1226.8635 519.05212,1224.2288 C 511.86952,1221.6602 504.44878,1219.1346 496.31506,1215.3768 C 504.23474,1212.0471 512.51166,1208.2373 519.05212,1206.5249 C 526.62173,1204.5431 533.01332,1209.2645 533.01332,1215.8049 z"
-         id="path9465"
-         style="fill:#7f4730;fill-opacity:1;fill-rule:nonzero;stroke:#1f1a17;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 523.47054,1215.3362 C 523.47054,1219.0119 519.76514,1221.551 515.62453,1220.0703 C 511.58801,1218.6268 507.41766,1217.2074 502.84661,1215.0956 C 507.29736,1213.2244 511.94888,1211.0833 515.62453,1210.121 C 519.87855,1209.0072 523.47054,1211.6606 523.47054,1215.3362 z"
-         id="path9467"
-         style="fill:#bf3042;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.56198645;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    </g>
-    <g
-       transform="matrix(-0.8225098,2.2811151e-2,-2.2811151e-2,-0.8225098,805.38217,1923.4391)"
-       id="g9469"
-       style="display:inline">
-      <path
-         d="M 533.01332,1215.8049 C 533.01332,1222.3453 526.41992,1226.8635 519.05212,1224.2288 C 511.86952,1221.6602 504.44878,1219.1346 496.31506,1215.3768 C 504.23474,1212.0471 512.51166,1208.2373 519.05212,1206.5249 C 526.62173,1204.5431 533.01332,1209.2645 533.01332,1215.8049 z"
-         id="path9471"
-         style="fill:#7f4730;fill-opacity:1;fill-rule:nonzero;stroke:#1f1a17;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 523.47054,1215.3362 C 523.47054,1219.0119 519.76514,1221.551 515.62453,1220.0703 C 511.58801,1218.6268 507.41766,1217.2074 502.84661,1215.0956 C 507.29736,1213.2244 511.94888,1211.0833 515.62453,1210.121 C 519.87855,1209.0072 523.47054,1211.6606 523.47054,1215.3362 z"
-         id="path9473"
-         style="fill:#bf3042;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.56198645;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    </g>
-    <g
-       transform="matrix(-0.8223887,2.6824123e-2,-2.6824123e-2,-0.8223887,812.05661,1905.9416)"
-       id="g9475"
-       style="display:inline">
-      <path
-         d="M 533.01332,1215.8049 C 533.01332,1222.3453 526.41992,1226.8635 519.05212,1224.2288 C 511.86952,1221.6602 504.44878,1219.1346 496.31506,1215.3768 C 504.23474,1212.0471 512.51166,1208.2373 519.05212,1206.5249 C 526.62173,1204.5431 533.01332,1209.2645 533.01332,1215.8049 z"
-         id="path9477"
-         style="fill:#7f4730;fill-opacity:1;fill-rule:nonzero;stroke:#1f1a17;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 523.47054,1215.3362 C 523.47054,1219.0119 519.76514,1221.551 515.62453,1220.0703 C 511.58801,1218.6268 507.41766,1217.2074 502.84661,1215.0956 C 507.29736,1213.2244 511.94888,1211.0833 515.62453,1210.121 C 519.87855,1209.0072 523.47054,1211.6606 523.47054,1215.3362 z"
-         id="path9479"
-         style="fill:#bf3042;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.56198645;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    </g>
-    <g
-       transform="matrix(-0.8228199,3.1679568e-3,-3.1679568e-3,-0.8228199,788.73884,1905.2911)"
-       id="g9481"
-       style="display:inline">
-      <path
-         d="M 533.01332,1215.8049 C 533.01332,1222.3453 526.41992,1226.8635 519.05212,1224.2288 C 511.86952,1221.6602 504.44878,1219.1346 496.31506,1215.3768 C 504.23474,1212.0471 512.51166,1208.2373 519.05212,1206.5249 C 526.62173,1204.5431 533.01332,1209.2645 533.01332,1215.8049 z"
-         id="path9483"
-         style="fill:#7f4730;fill-opacity:1;fill-rule:nonzero;stroke:#1f1a17;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 523.47054,1215.3362 C 523.47054,1219.0119 519.76514,1221.551 515.62453,1220.0703 C 511.58801,1218.6268 507.41766,1217.2074 502.84661,1215.0956 C 507.29736,1213.2244 511.94888,1211.0833 515.62453,1210.121 C 519.87855,1209.0072 523.47054,1211.6606 523.47054,1215.3362 z"
-         id="path9485"
-         style="fill:#bf3042;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.56198645;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    </g>
-    <g
-       transform="matrix(0.822826,0,0,0.822826,0.5934704,-78.892852)"
-       id="g12408"
-       style="display:inline">
-      <path
-         d="M 576.56153,1488.7943 C 576.12573,1499.8967 566.55571,1502.7493 547.68988,1502.522 C 532.3084,1502.3345 516.85713,1494.885 510.53805,1489.6659 C 516.85713,1483.1394 532.09311,1476.0102 547.47198,1475.5025 C 567.85839,1474.8366 576.56153,1479.653 576.56153,1488.7943 z"
-         transform="matrix(0,-1,1,0,-961.80487,2024.4998)"
-         id="path12410"
-         style="fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#201818;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 527.75215,1460.6852 C 533.88645,1460.6852 538.15435,1467.8131 537.55755,1476.5919 C 536.93045,1485.8159 532.14325,1492.2806 527.97005,1495.1133 C 523.79685,1492.0627 519.32055,1486.0877 517.94665,1477.0277 C 516.70175,1468.818 521.61785,1460.6852 527.75215,1460.6852 z"
-         id="path12412"
-         style="fill:#bf3042;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 527.75207,1484.981 C 525.30897,1483.4557 523.72097,1474.215 523.72097,1471.6891 C 523.72097,1469.1632 525.52687,1467.1132 527.75207,1467.1132 C 529.97727,1467.1132 531.78317,1469.1632 531.78317,1471.6891 C 531.78317,1474.215 529.97727,1483.2378 527.75207,1484.981 z"
-         id="path12414"
-         style="fill:#dedede;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    </g>
-    <g
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="g12403"
-       style="display:inline">
-      <path
-         d="M 576.56153,1488.7943 C 576.12573,1499.8967 566.55571,1502.7493 547.68988,1502.522 C 532.3084,1502.3345 516.85713,1494.885 510.53805,1489.6659 C 516.85713,1483.1394 532.09311,1476.0102 547.47198,1475.5025 C 567.85839,1474.8366 576.56153,1479.653 576.56153,1488.7943 z"
-         transform="matrix(0,-1,1,0,-961.80487,2024.4998)"
-         id="path9487"
-         style="fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#201818;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 527.75215,1460.6852 C 533.88645,1460.6852 538.15435,1467.8131 537.55755,1476.5919 C 536.93045,1485.8159 532.14325,1492.2806 527.97005,1495.1133 C 523.79685,1492.0627 519.32055,1486.0877 517.94665,1477.0277 C 516.70175,1468.818 521.61785,1460.6852 527.75215,1460.6852 z"
-         id="path11428"
-         style="fill:#bf3042;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 527.75207,1484.981 C 525.30897,1483.4557 523.72097,1474.215 523.72097,1471.6891 C 523.72097,1469.1632 525.52687,1467.1132 527.75207,1467.1132 C 529.97727,1467.1132 531.78317,1469.1632 531.78317,1471.6891 C 531.78317,1474.215 529.97727,1483.2378 527.75207,1484.981 z"
-         id="path11431"
-         style="fill:#dedede;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    </g>
-    <g
-       transform="matrix(0.822826,0,0,0.822826,22.646535,-78.534266)"
-       id="g12416"
-       style="display:inline">
-      <path
-         d="M 576.56153,1488.7943 C 576.12573,1499.8967 566.55571,1502.7493 547.68988,1502.522 C 532.3084,1502.3345 516.85713,1494.885 510.53805,1489.6659 C 516.85713,1483.1394 532.09311,1476.0102 547.47198,1475.5025 C 567.85839,1474.8366 576.56153,1479.653 576.56153,1488.7943 z"
-         transform="matrix(0,-1,1,0,-961.80487,2024.4998)"
-         id="path12418"
-         style="fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#201818;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 527.75215,1460.6852 C 533.88645,1460.6852 538.15435,1467.8131 537.55755,1476.5919 C 536.93045,1485.8159 532.14325,1492.2806 527.97005,1495.1133 C 523.79685,1492.0627 519.32055,1486.0877 517.94665,1477.0277 C 516.70175,1468.818 521.61785,1460.6852 527.75215,1460.6852 z"
-         id="path12420"
-         style="fill:#bf3042;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 527.75207,1484.981 C 525.30897,1483.4557 523.72097,1474.215 523.72097,1471.6891 C 523.72097,1469.1632 525.52687,1467.1132 527.75207,1467.1132 C 529.97727,1467.1132 531.78317,1469.1632 531.78317,1471.6891 C 531.78317,1474.215 529.97727,1483.2378 527.75207,1484.981 z"
-         id="path12422"
-         style="fill:#dedede;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    </g>
-    <g
-       transform="matrix(0.822826,0,0,0.822826,45.416773,-88.216099)"
-       id="g12424"
-       style="display:inline">
-      <path
-         d="M 576.56153,1488.7943 C 576.12573,1499.8967 566.55571,1502.7493 547.68988,1502.522 C 532.3084,1502.3345 516.85713,1494.885 510.53805,1489.6659 C 516.85713,1483.1394 532.09311,1476.0102 547.47198,1475.5025 C 567.85839,1474.8366 576.56153,1479.653 576.56153,1488.7943 z"
-         transform="matrix(0,-1,1,0,-961.80487,2024.4998)"
-         id="path12426"
-         style="fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#201818;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 527.75215,1460.6852 C 533.88645,1460.6852 538.15435,1467.8131 537.55755,1476.5919 C 536.93045,1485.8159 532.14325,1492.2806 527.97005,1495.1133 C 523.79685,1492.0627 519.32055,1486.0877 517.94665,1477.0277 C 516.70175,1468.818 521.61785,1460.6852 527.75215,1460.6852 z"
-         id="path12428"
-         style="fill:#bf3042;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 527.75207,1484.981 C 525.30897,1483.4557 523.72097,1474.215 523.72097,1471.6891 C 523.72097,1469.1632 525.52687,1467.1132 527.75207,1467.1132 C 529.97727,1467.1132 531.78317,1469.1632 531.78317,1471.6891 C 531.78317,1474.215 529.97727,1483.2378 527.75207,1484.981 z"
-         id="path12430"
-         style="fill:#dedede;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    </g>
-    <g
-       transform="matrix(0.822826,0,0,0.822826,-84.032926,-79.968611)"
-       id="g12432"
-       style="display:inline">
-      <path
-         d="M 576.56153,1488.7943 C 576.12573,1499.8967 566.55571,1502.7493 547.68988,1502.522 C 532.3084,1502.3345 516.85713,1494.885 510.53805,1489.6659 C 516.85713,1483.1394 532.09311,1476.0102 547.47198,1475.5025 C 567.85839,1474.8366 576.56153,1479.653 576.56153,1488.7943 z"
-         transform="matrix(0,-1,1,0,-961.80487,2024.4998)"
-         id="path12434"
-         style="fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#201818;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 527.75215,1460.6852 C 533.88645,1460.6852 538.15435,1467.8131 537.55755,1476.5919 C 536.93045,1485.8159 532.14325,1492.2806 527.97005,1495.1133 C 523.79685,1492.0627 519.32055,1486.0877 517.94665,1477.0277 C 516.70175,1468.818 521.61785,1460.6852 527.75215,1460.6852 z"
-         id="path12436"
-         style="fill:#bf3042;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 527.75207,1484.981 C 525.30897,1483.4557 523.72097,1474.215 523.72097,1471.6891 C 523.72097,1469.1632 525.52687,1467.1132 527.75207,1467.1132 C 529.97727,1467.1132 531.78317,1469.1632 531.78317,1471.6891 C 531.78317,1474.215 529.97727,1483.2378 527.75207,1484.981 z"
-         id="path12438"
-         style="fill:#dedede;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    </g>
-    <g
-       transform="matrix(0.822826,0,0,0.822826,-105.7274,-74.589815)"
-       id="g12440"
-       style="display:inline">
-      <path
-         d="M 576.56153,1488.7943 C 576.12573,1499.8967 566.55571,1502.7493 547.68988,1502.522 C 532.3084,1502.3345 516.85713,1494.885 510.53805,1489.6659 C 516.85713,1483.1394 532.09311,1476.0102 547.47198,1475.5025 C 567.85839,1474.8366 576.56153,1479.653 576.56153,1488.7943 z"
-         transform="matrix(0,-1,1,0,-961.80487,2024.4998)"
-         id="path12442"
-         style="fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#201818;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 527.75215,1460.6852 C 533.88645,1460.6852 538.15435,1467.8131 537.55755,1476.5919 C 536.93045,1485.8159 532.14325,1492.2806 527.97005,1495.1133 C 523.79685,1492.0627 519.32055,1486.0877 517.94665,1477.0277 C 516.70175,1468.818 521.61785,1460.6852 527.75215,1460.6852 z"
-         id="path12444"
-         style="fill:#bf3042;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 527.75207,1484.981 C 525.30897,1483.4557 523.72097,1474.215 523.72097,1471.6891 C 523.72097,1469.1632 525.52687,1467.1132 527.75207,1467.1132 C 529.97727,1467.1132 531.78317,1469.1632 531.78317,1471.6891 C 531.78317,1474.215 529.97727,1483.2378 527.75207,1484.981 z"
-         id="path12446"
-         style="fill:#dedede;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    </g>
-    <g
-       transform="matrix(0.822826,0,0,0.822826,-128.49764,-76.920627)"
-       id="g12448"
-       style="display:inline">
-      <path
-         d="M 576.56153,1488.7943 C 576.12573,1499.8967 566.55571,1502.7493 547.68988,1502.522 C 532.3084,1502.3345 516.85713,1494.885 510.53805,1489.6659 C 516.85713,1483.1394 532.09311,1476.0102 547.47198,1475.5025 C 567.85839,1474.8366 576.56153,1479.653 576.56153,1488.7943 z"
-         transform="matrix(0,-1,1,0,-961.80487,2024.4998)"
-         id="path12450"
-         style="fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#201818;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 527.75215,1460.6852 C 533.88645,1460.6852 538.15435,1467.8131 537.55755,1476.5919 C 536.93045,1485.8159 532.14325,1492.2806 527.97005,1495.1133 C 523.79685,1492.0627 519.32055,1486.0877 517.94665,1477.0277 C 516.70175,1468.818 521.61785,1460.6852 527.75215,1460.6852 z"
-         id="path12452"
-         style="fill:#bf3042;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 527.75207,1484.981 C 525.30897,1483.4557 523.72097,1474.215 523.72097,1471.6891 C 523.72097,1469.1632 525.52687,1467.1132 527.75207,1467.1132 C 529.97727,1467.1132 531.78317,1469.1632 531.78317,1471.6891 C 531.78317,1474.215 529.97727,1483.2378 527.75207,1484.981 z"
-         id="path12454"
-         style="fill:#dedede;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    </g>
-    <g
-       transform="matrix(0.822826,0,0,0.822826,-151.80576,-84.450942)"
-       id="g12456"
-       style="display:inline">
-      <path
-         d="M 576.56153,1488.7943 C 576.12573,1499.8967 566.55571,1502.7493 547.68988,1502.522 C 532.3084,1502.3345 516.85713,1494.885 510.53805,1489.6659 C 516.85713,1483.1394 532.09311,1476.0102 547.47198,1475.5025 C 567.85839,1474.8366 576.56153,1479.653 576.56153,1488.7943 z"
-         transform="matrix(0,-1,1,0,-961.80487,2024.4998)"
-         id="path12458"
-         style="fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#201818;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 527.75215,1460.6852 C 533.88645,1460.6852 538.15435,1467.8131 537.55755,1476.5919 C 536.93045,1485.8159 532.14325,1492.2806 527.97005,1495.1133 C 523.79685,1492.0627 519.32055,1486.0877 517.94665,1477.0277 C 516.70175,1468.818 521.61785,1460.6852 527.75215,1460.6852 z"
-         id="path12460"
-         style="fill:#bf3042;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 527.75207,1484.981 C 525.30897,1483.4557 523.72097,1474.215 523.72097,1471.6891 C 523.72097,1469.1632 525.52687,1467.1132 527.75207,1467.1132 C 529.97727,1467.1132 531.78317,1469.1632 531.78317,1471.6891 C 531.78317,1474.215 529.97727,1483.2378 527.75207,1484.981 z"
-         id="path12463"
-         style="fill:#dedede;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1;stroke-linecap:butt;stroke-linejoin:round;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    </g>
-    <path
-       d="M 307.12176,476.24856 C 281.71952,502.01094 261.94549,536.15349 248.36571,566.26867 C 234.78593,596.38386 229.47727,612.08723 226.77511,632.1246 C 226.14482,636.7984 225.49493,657.0865 233.67661,661.01082 C 242.19777,665.09795 234.02195,656.88421 261.13962,655.11567 C 288.25729,653.34713 295.92098,656.88421 295.92098,656.88421 C 295.92098,656.88421 300.6371,658.65276 297.68952,664.54791 C 294.74195,670.44305 302.6623,660.93058 281.18312,672.80111 C 260.03211,684.49025 252.59899,696.41588 252.54109,705.81393 C 252.39797,729.4621 270.02285,755.22292 284.72021,778.66959 C 276.91953,781.69208 269.22769,786.73024 264.47477,791.19309 C 259.28194,796.06891 251.25249,807.72819 254.5548,813.79529 C 259.01354,821.98702 279.76801,825.50312 286.94912,824.10802 C 300.44114,821.48699 290.52552,817.15909 298.85835,809.72255 C 303.59411,805.50376 309.3452,799.13714 314.92341,792.43572 C 325.60397,779.60449 324.80719,727.03646 324.80719,727.03646 C 324.80719,727.03646 433.27789,721.1413 439.17303,730.57354 C 445.06818,740.00577 444.01627,783.57265 442.12061,788.9355 C 440.97502,792.17636 441.54318,796.77514 445.48451,800.51768 C 449.6111,804.43606 455.10472,810.67596 459.58678,814.95515 C 466.38299,821.44379 456.60935,826.40774 473.65071,828.03882 C 473.65071,828.03882 483.17792,829.87076 495.12916,823.65966 C 505.09374,818.48112 504.21645,813.02875 501.04987,805.46739 C 497.81043,797.732 485.6001,787.91445 472.95927,781.2652 C 474.86534,778.21424 489.62341,753.98991 496.82261,740.49055 C 501.18576,732.30914 504.90448,721.15893 504.74944,713.51969 C 504.37846,695.24044 497.84288,689.876 474.50184,674.39801 C 470.40049,666.84628 473.43286,660.53567 480.33088,659.65584 C 487.88946,658.69177 497.85099,656.73442 503.7978,656.17326 C 511.55488,655.44127 513.64778,636.64945 513.71101,625.6366 C 513.78225,613.40739 511.63361,606.54639 508.98676,598.19189 C 505.85942,588.32075 496.9665,568.15247 489.74172,549.59256 C 481.57729,549.61038 474.53944,523.97818 460.40129,503.78285 C 446.26313,483.58752 425.02468,468.82905 425.02468,468.82905 C 407.04411,497.42586 390.03415,510.07282 366.98781,510.28336 C 346.24449,510.47286 326.82964,504.57995 307.12176,476.24856 z"
-       id="path3467"
-       style="fill:#7f4730;fill-opacity:1;fill-rule:evenodd;stroke:#201818;stroke-width:3.62043452;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    <path
-       d="M 301.86221,368.26108 C 291.84046,408.64283 294.19649,457.20481 313.31166,484.15643 C 333.31554,512.36109 368.79946,515.60781 392.60137,503.31565 C 406.91509,495.92354 421.25077,480.55568 427.38274,458.21779 C 431.50934,443.18517 434.5306,431.98439 434.5306,414.11473 C 434.5306,396.24507 431.91771,371.54682 424.84354,361.08293 C 423.77448,359.76505 421.50457,366.09233 420.01381,364.77973 C 405.75766,354.5683 385.06164,346.41815 364.89419,346.21001 C 339.33879,345.94387 319.21969,358.14291 308.30079,370.38011 C 306.54727,372.03732 302.90835,365.80162 301.86221,368.26108 z"
-       id="path3465"
-       style="fill:#7f4730;fill-opacity:1;fill-rule:evenodd;stroke:#201818;stroke-width:3.62043452;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    <path
-       d="M 264.52302,566.9196 L 264.58522,576.32955"
-       id="path3402"
-       style="fill:#201818;fill-opacity:1;fill-rule:evenodd;stroke:#201818;stroke-width:3.3135345;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    <path
-       d="M 478.96237,561.2095 L 479.89816,576.49414"
-       id="path3443"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#201818;stroke-width:3.62043452;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    <path
-       d="M 459.39771,596.11768 A 34.357849,18.841402 0 1 1 390.68201,596.11768 A 34.357849,18.841402 0 1 1 459.39771,596.11768 z"
-       transform="matrix(0.8225634,0,0,0.8344474,-18.768178,-87.825914)"
-       id="path2181"
-       style="fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:#202020;stroke-width:3.19000006;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <path
-       d="M 335.64177,395.21191 L 335.64177,425.13388"
-       id="path3155"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#202020;stroke-width:1.61661816;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 335.90559,405.79752 L 356.97083,405.79752"
-       id="path3157"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#202020;stroke-width:1.35642409;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 335.8902,414.1991 L 356.95543,414.1991"
-       id="path3159"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#202020;stroke-width:1.35642409;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 451.17527,597.60486 A 5.7048388,2.7467742 0 1 1 439.76559,597.60486 A 5.7048388,2.7467742 0 1 1 451.17527,597.60486 z"
-       transform="matrix(1.1226988,0,0,1.2785132,-152.97824,-354.23543)"
-       id="path4126"
-       style="fill:url(#linearGradient3603);fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:0.40393949;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <path
-       d="M 459.39771,596.11768 A 34.357849,18.841402 0 1 1 390.68201,596.11768 A 34.357849,18.841402 0 1 1 459.39771,596.11768 z"
-       transform="matrix(0.8225634,0,0,0.8344474,54.505185,-89.572834)"
-       id="path3181"
-       style="fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:#202020;stroke-width:3.19000006;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <use
-       transform="translate(39.958666,-0.8182662)"
-       id="use5111"
-       style="display:inline"
-       x="0"
-       y="0"
-       width="765"
-       height="1260"
-       xlink:href="#path4126" />
-    <path
-       d="M 397.79996,392.70895 L 397.79996,422.63091"
-       id="path3183"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#202020;stroke-width:1.61661816;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 377.37637,405.06452 L 397.56636,405.06452"
-       id="path3185"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#202020;stroke-width:1.32794595;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 378.44151,413.25295 L 397.05953,413.25295"
-       id="path3187"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#202020;stroke-width:1.27520227;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 421.9785,460.53569 C 370.0576,471.32275 341.7093,468.56609 312.5153,464.29886 L 312.52029,473.82878 C 318.775,480.19975 331.92431,488.32556 339.31624,489.54028 L 339.38426,497.59284 C 350.53971,503.5238 372.88112,507.79295 392.1852,497.07771 C 392.1852,497.07771 392.22833,493.39563 392.29882,488.37716 C 409.95434,483.51667 422.01917,469.32545 422.01917,469.32545 L 421.9785,460.53569 z"
-       id="path3194"
-       style="fill:#ffffff;fill-opacity:1;fill-rule:evenodd;stroke:#202020;stroke-width:1.15195644;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 339.15485,468.05886 C 339.15485,468.05886 339.51999,486.70546 339.72346,497.25814 C 357.72944,505.95007 372.32376,505.77835 392.2251,497.0686 L 391.65649,466.49017 C 371.89321,470.38376 356.82139,469.49823 339.15485,468.05886 z"
-       id="path2195"
-       style="fill:#ffffff;fill-opacity:1;fill-rule:evenodd;stroke:#202020;stroke-width:2.13934755;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 365.54928,469.04468 L 365.92877,503.45228"
-       id="path3168"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#202020;stroke-width:1.8924998;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 463.13839,649.36627 A 3.5152819,4.6870422 0 1 1 456.10783,649.36627 A 3.5152819,4.6870422 0 1 1 463.13839,649.36627 z"
-       transform="matrix(1.1305141,0,0,0.9771059,-160.5445,-181.34451)"
-       id="path3172"
-       style="fill:url(#linearGradient3605);fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:2.29999995;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <path
-       d="M 463.13839,649.36627 A 3.5152819,4.6870422 0 1 1 456.10783,649.36627 A 3.5152819,4.6870422 0 1 1 463.13839,649.36627 z"
-       transform="matrix(0.822826,0,0,0.7585427,-18.819561,-39.416939)"
-       id="path3170"
-       style="fill:#1e1e1e;fill-opacity:0.94117647;fill-rule:nonzero;stroke:none;stroke-width:2.29999995;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <use
-       transform="translate(14.510834,-0.3442377)"
-       id="use3182"
-       style="display:inline"
-       x="0"
-       y="0"
-       width="765"
-       height="1260"
-       xlink:href="#path3172" />
-    <use
-       transform="translate(14.510834,-0.3442377)"
-       id="use3184"
-       style="display:inline"
-       x="0"
-       y="0"
-       width="765"
-       height="1260"
-       xlink:href="#path3170" />
-    <rect
-       width="256.16684"
-       height="58.161732"
-       rx="8.4748182"
-       ry="8.4748182"
-       x="247.57883"
-       y="575.32227"
-       id="rect3527"
-       style="fill:#dedede;fill-opacity:1;fill-rule:nonzero;stroke:#655d5a;stroke-width:1.23423898;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <rect
-       width="154.88071"
-       height="31.930382"
-       x="264.82346"
-       y="588.52972"
-       id="rect4498"
-       style="fill:#fcfcfc;fill-opacity:1;fill-rule:nonzero;stroke:#202020;stroke-width:1.23423898;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <path
-       d="M 412.73087,588.52972 L 412.73087,620.46011"
-       id="path4500"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:1.23423898;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 273.99886,588.52972 L 273.99886,620.46011"
-       id="path4502"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:1.23423898;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 345.46041,822.43168 L 533.69062,822.87772"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path5113"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 345.46041,830.5348 L 533.69062,830.98084"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path5115"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 345.46041,838.63792 L 533.69062,839.08396"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path5117"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 345.46041,846.74103 L 533.69062,847.18707"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path5119"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <rect
-       width="24.985559"
-       height="31.884996"
-       x="427.75528"
-       y="588.59961"
-       id="rect5141"
-       style="fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:#202020;stroke-width:1.18927538;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <rect
-       width="30.011555"
-       height="31.775713"
-       x="461.59357"
-       y="588.6543"
-       id="rect5145"
-       style="fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:#202020;stroke-width:1.30117762;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <path
-       d="M 542.80362,822.67849 L 573.39743,822.67849"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path5147"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 542.96132,830.74042 L 573.55513,830.74042"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path5149"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 542.33052,838.62543 L 572.92433,838.62543"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path5151"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 542.33052,846.6489 L 572.92433,846.6489"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path5153"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 584.3586,822.67849 L 619.83909,822.67849"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path5155"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter4797)" />
-    <path
-       d="M 584.3586,830.74042 L 619.83909,830.74042"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path5157"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter4793)" />
-    <path
-       d="M 584.3586,838.62543 L 619.83909,838.62543"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path5159"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter4789)" />
-    <path
-       d="M 584.3586,846.6489 L 619.83909,846.6489"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path5161"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#202020;stroke-width:1.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter4785)" />
-    <path
-       d="M 552.89643,852.53919 L 552.89643,814.30348"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path5173"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 562.98923,853.32768 L 562.98923,815.09197"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path5175"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 592.63684,853.32768 L 592.63684,815.09197"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path5177"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter4809)" />
-    <path
-       d="M 601.9411,853.32768 L 601.9411,815.09197"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path5179"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter4805)" />
-    <path
-       d="M 611.24545,853.32768 L 611.24545,815.09197"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path5181"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter4801)" />
-    <path
-       d="M 524.54673,814.40289 C 524.54673,814.40289 524.54673,853.20865 524.54673,853.20865"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path4305"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    <path
-       d="M 514.62883,814.40289 C 514.62883,814.40289 514.62883,853.20865 514.62883,853.20865"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path4307"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    <path
-       d="M 504.71093,814.40289 C 504.71093,814.40289 504.71093,853.20865 504.71093,853.20865"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path4309"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    <path
-       d="M 494.79303,814.40289 C 494.79303,814.40289 494.79303,853.20865 494.79303,853.20865"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path4311"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    <path
-       d="M 484.87513,814.40289 C 484.87513,814.40289 484.87513,853.20865 484.87513,853.20865"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path4313"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    <path
-       d="M 474.95723,814.40289 C 474.95723,814.40289 474.95723,853.20865 474.95723,853.20865"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path4315"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    <path
-       d="M 465.03933,814.40289 C 465.03933,814.40289 465.03933,853.20865 465.03933,853.20865"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path4317"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    <path
-       d="M 455.12143,814.40289 C 455.12143,814.40289 455.12143,853.20865 455.12143,853.20865"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path4319"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    <path
-       d="M 445.20353,814.40289 C 445.20353,814.40289 445.20353,853.20865 445.20353,853.20865"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path4321"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    <path
-       d="M 435.28563,814.40289 C 435.28563,814.40289 435.28563,853.20865 435.28563,853.20865"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path4323"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    <path
-       d="M 425.36773,814.40289 C 425.36773,814.40289 425.36773,853.20865 425.36773,853.20865"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path4325"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    <path
-       d="M 415.44983,814.40289 C 415.44983,814.40289 415.44983,853.20865 415.44983,853.20865"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path4327"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    <path
-       d="M 405.53193,814.40289 C 405.53193,814.40289 405.53193,853.20865 405.53193,853.20865"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path4329"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    <path
-       d="M 395.61403,814.40289 C 395.61403,814.40289 395.61403,853.20865 395.61403,853.20865"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path4331"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    <path
-       d="M 385.69613,814.40289 C 385.69613,814.40289 385.69613,853.20865 385.69613,853.20865"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path4333"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    <path
-       d="M 375.77823,814.40289 C 375.77823,814.40289 375.77823,853.20865 375.77823,853.20865"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path4335"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    <path
-       d="M 365.86033,814.40289 C 365.86033,814.40289 365.86033,853.20865 365.86033,853.20865"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path4337"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    <path
-       d="M 355.94243,814.40289 C 355.94243,814.40289 355.94243,853.20865 355.94243,853.20865"
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="path4339"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:2.12681651;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    <path
-       d="M 465.89237,613.1197 L 467.13736,653.44254 C 486.05256,661.73823 504.04439,663.56241 509.71041,652.03192 C 514.82708,641.61942 506.13428,623.63891 486.7472,616.51536 C 481.3429,614.52961 471.16809,613.05654 465.89237,613.1197 z"
-       id="path3386"
-       style="fill:#7f4730;fill-opacity:1;fill-rule:nonzero;stroke:#151515;stroke-width:3.62043452;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <path
-       d="M 294.25853,625.0513 C 299.51347,633.61603 294.97342,650.38612 274.01501,660.73872 C 255.49663,669.88604 236.34684,670.22431 230.93453,659.96239 C 225.52221,649.70046 236.13602,633.19329 254.40517,623.55783 C 272.67431,613.92237 290.66096,619.18784 294.25853,625.0513 z"
-       id="path3377"
-       style="fill:#7f4730;fill-opacity:1;fill-rule:nonzero;stroke:#151515;stroke-width:3.62043476;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <path
-       d="M 290.49954,616.00234 C 288.33166,619.04296 280.13474,624.57436 275.12362,625.7456 C 270.1125,626.91684 266.16064,625.90159 265.39472,623.29379 C 264.60335,620.59934 267.54321,617.26251 272.55433,616.09127 C 277.56545,614.92003 286.52452,614.74553 290.49954,616.00234 z"
-       id="path3381"
-       style="fill:#614031;fill-opacity:1;fill-rule:nonzero;stroke:#151515;stroke-width:0.82282603;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <path
-       d="M 282.59522,618.02918 C 281.40743,619.69515 276.91633,622.72581 274.17073,623.36754 C 271.42514,624.00926 269.2599,623.453 268.84026,622.02419 C 268.40666,620.54789 270.01741,618.71964 272.76301,618.07791 C 275.50861,617.43618 280.4173,617.34058 282.59522,618.02918 z"
-       id="path3388"
-       style="fill:#bf3042;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.54790151;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <path
-       d="M 295.49886,619.50789 C 293.93939,623.56818 286.82282,631.96287 282.02008,634.51692 C 277.21733,637.07099 273.03325,636.82376 271.72918,633.96379 C 270.38179,631.0088 272.65745,626.42001 277.46019,623.86596 C 282.26294,621.3119 291.24206,618.98441 295.49886,619.50789 z"
-       id="path3390"
-       style="fill:#614031;fill-opacity:1;fill-rule:nonzero;stroke:#151515;stroke-width:0.90961164;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <path
-       d="M 287.95995,623.74577 C 287.10552,625.97042 283.20635,630.56988 280.57491,631.96926 C 277.94349,633.36863 275.65102,633.23318 274.93652,631.6662 C 274.19829,630.04715 275.44512,627.53295 278.07655,626.13357 C 280.70798,624.73419 285.62766,623.45897 287.95995,623.74577 z"
-       id="path3392"
-       style="fill:#bf3042;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.54790151;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <path
-       d="M 297.15472,622.21724 C 297.69235,626.54874 297.78921,636.6562 295.0455,641.65517 C 292.30181,646.65415 288.87072,648.7895 285.64946,647.5894 C 282.23579,646.31763 281.09033,639.93136 283.83404,634.93239 C 286.57773,629.93342 292.63998,624.85296 297.15472,622.21724 z"
-       id="path3394"
-       style="fill:#614031;fill-opacity:1;fill-rule:nonzero;stroke:#151515;stroke-width:0.97365355;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <path
-       d="M 293.81722,629.94058 C 294.28692,632.27692 293.45689,638.24933 291.98391,640.84028 C 290.51093,643.43121 288.50232,644.54443 287.05979,643.60366 C 285.56932,642.63163 285.27598,639.84062 286.74897,637.24967 C 288.22194,634.65873 291.69393,630.94729 293.81722,629.94058 z"
-       id="path3400"
-       style="fill:#bf3042;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.54790151;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <g
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="g3470">
-      <path
-         d="M 571.68049,843.38167 C 574.3768,847.03229 584.45008,853.58666 590.56323,854.90772 C 596.67639,856.22878 601.45781,854.91453 602.33534,851.73004 C 603.24204,848.43973 599.60164,844.44493 593.48848,843.12385 C 587.37532,841.80278 576.48513,841.77342 571.68049,843.38167 z"
-         id="path3393"
-         style="fill:#614031;fill-opacity:1;fill-rule:nonzero;stroke:#151515;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 581.17256,846.14599 C 582.64986,848.14618 588.16903,851.73732 591.51844,852.46114 C 594.86783,853.18495 597.48759,852.46486 597.96838,850.72008 C 598.46517,848.91731 596.47059,846.72854 593.12118,846.00473 C 589.77178,845.28091 583.80502,845.26483 581.17256,846.14599 z"
-         id="path3395"
-         style="fill:#bf3042;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.54790151;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    </g>
-    <g
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="g3466">
-      <path
-         d="M 566.602,849.4393 C 568.57977,854.34136 577.09031,865.4763 582.97846,868.48194 C 588.86659,871.4876 594.33502,870.05681 595.78053,866.52078 C 597.51174,862.28586 595.26959,856.44783 589.38145,853.44219 C 583.4933,850.43654 571.76399,848.71639 566.602,849.4393 z"
-         id="path3391"
-         style="fill:#614031;fill-opacity:1;fill-rule:nonzero;stroke:#151515;stroke-width:1.10547268;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 574.61597,853.6644 C 575.6996,856.35027 580.53146,861.85982 583.75758,863.50663 C 586.9837,865.15342 589.76665,864.94209 590.60292,863.0234 C 591.46698,861.04096 589.90062,858.01125 586.67449,856.36444 C 583.44837,854.71762 577.44421,853.26835 574.61597,853.6644 z"
-         id="path3397"
-         style="fill:#bf3042;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.54790151;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    </g>
-    <g
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="g3462">
-      <path
-         d="M 564.02844,851.68614 C 563.46346,856.96054 563.55183,869.24462 566.98778,875.26318 C 570.42371,881.28176 574.63654,883.80659 578.5264,882.28262 C 582.6486,880.66761 583.91029,872.88397 580.47435,866.8654 C 577.03842,860.84682 569.56827,854.79689 564.02844,851.68614 z"
-         id="path3389"
-         style="fill:#614031;fill-opacity:1;fill-rule:nonzero;stroke:#151515;stroke-width:1.18330431;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 567.77897,860.84895 C 567.25585,863.69755 568.38623,870.938 570.22896,874.05638 C 572.07168,877.17472 574.53514,878.4865 576.26886,877.31391 C 578.06019,876.10236 578.35973,872.70488 576.517,869.58651 C 574.67429,866.46814 570.37962,862.02897 567.77897,860.84895 z"
-         id="path3399"
-         style="fill:#bf3042;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.54790151;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    </g>
-    <path
-       d="M 271.93941,641.04601 C 263.8694,672.72827 273.89788,711.69109 275.52608,720.25166 C 277.38785,730.04025 287.75662,776.45076 294.95388,786.90394 C 346.80267,797.97984 414.8617,798.33464 466.5163,781.82283 C 471.59743,774.35058 479.88849,736.54296 483.25411,713.07836 C 484.86926,701.81775 489.2209,651.36044 486.243,638.05712 C 479.03098,637.70193 463.79826,638.83767 458.4463,643.73602 C 453.11524,648.61522 444.52911,661.9331 439.61628,669.44049 C 426.70617,666.56708 395.34898,665.87433 377.74621,676.31494 C 357.8487,666.06739 330.25012,667.76088 311.39279,669.44049 C 300.89936,651.83834 283.61602,639.83053 271.93941,641.04601 z"
-       id="path4814"
-       style="fill:#614031;fill-opacity:1;fill-rule:evenodd;stroke:#1f1a17;stroke-width:2.87989092;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <g
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="g6763"
-       style="display:inline">
-      <path
-         d="M 433.26187,954.97713 C 433.12117,964.22992 385.23871,988.51607 375.84937,981.93089 C 369.54522,977.5095 374.51617,949.67506 382.19722,947.93876 C 393.94216,945.08479 422.86841,945.72434 433.26187,954.97713 z"
-         id="path5787"
-         style="opacity:1;fill:#1f1a17;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 417.07798,966.49628 A 14.600079,7.3329391 0 1 1 387.87783,966.49628 A 14.600079,7.3329391 0 1 1 417.07798,966.49628 z"
-         transform="matrix(0.9033081,-0.4289923,0.4289923,0.9033081,-374.97666,265.74902)"
-         id="path6759"
-         style="opacity:1;fill:#f0c217;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 417.07798,966.49628 A 14.600079,7.3329391 0 1 1 387.87783,966.49628 A 14.600079,7.3329391 0 1 1 417.07798,966.49628 z"
-         transform="matrix(0.4733492,-0.2247994,0.2247994,0.4733492,-4.0038603,599.99181)"
-         id="path6761"
-         style="opacity:1;fill:#999999;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    </g>
-    <g
-       transform="matrix(-0.822826,0,0,0.822826,783.1606,-82.42754)"
-       id="g6768"
-       style="display:inline">
-      <path
-         d="M 433.26187,954.97713 C 433.12117,964.22992 385.23871,988.51607 375.84937,981.93089 C 369.54522,977.5095 374.51617,949.67506 382.19722,947.93876 C 393.94216,945.08479 422.86841,945.72434 433.26187,954.97713 z"
-         id="path6770"
-         style="opacity:1;fill:#1f1a17;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 417.07798,966.49628 A 14.600079,7.3329391 0 1 1 387.87783,966.49628 A 14.600079,7.3329391 0 1 1 417.07798,966.49628 z"
-         transform="matrix(0.9033081,-0.4289923,0.4289923,0.9033081,-374.97666,265.74902)"
-         id="path6772"
-         style="opacity:1;fill:#f0c217;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-      <path
-         d="M 417.07798,966.49628 A 14.600079,7.3329391 0 1 1 387.87783,966.49628 A 14.600079,7.3329391 0 1 1 417.07798,966.49628 z"
-         transform="matrix(0.4733492,-0.2247994,0.2247994,0.4733492,-4.0038603,599.99181)"
-         id="path6774"
-         style="opacity:1;fill:#999999;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    </g>
-    <path
-       d="M 441.84981,787.26959 C 426.73016,794.02353 341.82382,797.54045 325.38677,790.20691 C 313.81069,776.74435 322.3369,747.93846 331.96154,734.42146 C 347.92659,730.83777 417.1933,730.70237 432.9963,733.59762 C 444.57238,749.59637 445.76811,771.85044 441.84981,787.26959 z"
-       id="path6784"
-       style="fill:#7f4730;fill-opacity:1;fill-rule:nonzero;stroke:#1f1a17;stroke-width:2.87989116;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <path
-       d="M 324.56873,758.45687 L 346.7056,754.83841 L 414.60614,753.77417 L 441.21295,758.45687 L 441.00009,768.03539 L 436.53015,776.76236 C 401.57125,781.96337 364.95096,781.51715 328.61297,778.03947 L 324.35588,768.46104 L 324.56873,758.45687 z"
-       id="path6787"
-       style="fill:#bf3042;fill-opacity:1;fill-rule:evenodd;stroke:#1f1a17;stroke-width:2.48608851;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <rect
-       width="102.08041"
-       height="7.8198242"
-       rx="2.5685453"
-       ry="2.5685453"
-       x="330.89883"
-       y="767.29144"
-       id="rect6789"
-       style="fill:#999999;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <path
-       d="M 333.43498,771.09573 L 340.40941,771.09573"
-       id="path6793"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#ffffff;stroke-width:1.8924998;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 422.83459,771.09573 L 429.80903,771.09573"
-       id="path6795"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#ffffff;stroke-width:1.8924998;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <g
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="g7098"
-       style="display:inline">
-      <path
-         d="M 536.82603,1036.2797 C 536.82603,1036.2797 545.30223,1036.2797 545.30223,1036.2797"
-         id="path7100"
-         style="opacity:1;fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#ffffff;stroke-width:2.29999995;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-      <path
-         d="M 524.75387,1036.2797 C 524.75387,1036.2797 533.23007,1036.2797 533.23007,1036.2797"
-         id="path7102"
-         style="opacity:1;fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#ffffff;stroke-width:2.29999995;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-      <path
-         d="M 512.6817,1036.2797 C 512.6817,1036.2797 521.1579,1036.2797 521.1579,1036.2797"
-         id="path7104"
-         style="opacity:1;fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#ffffff;stroke-width:2.29999995;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-      <path
-         d="M 500.60954,1036.2797 C 500.60954,1036.2797 509.08574,1036.2797 509.08574,1036.2797"
-         id="path7106"
-         style="opacity:1;fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#ffffff;stroke-width:2.29999995;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-      <path
-         d="M 488.53737,1036.2797 C 488.53737,1036.2797 497.01357,1036.2797 497.01357,1036.2797"
-         id="path7108"
-         style="opacity:1;fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#ffffff;stroke-width:2.29999995;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-      <path
-         d="M 476.46521,1036.2797 C 476.46521,1036.2797 484.94141,1036.2797 484.94141,1036.2797"
-         id="path7110"
-         style="opacity:1;fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#ffffff;stroke-width:2.29999995;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-      <path
-         d="M 464.39304,1036.2797 C 464.39304,1036.2797 472.86924,1036.2797 472.86924,1036.2797"
-         id="path7112"
-         style="opacity:1;fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#ffffff;stroke-width:2.29999995;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-      <path
-         d="M 452.32088,1036.2797 C 452.32088,1036.2797 460.79708,1036.2797 460.79708,1036.2797"
-         id="path7114"
-         style="opacity:1;fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#ffffff;stroke-width:2.29999995;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-      <path
-         d="M 440.24871,1036.2797 C 440.24871,1036.2797 448.72491,1036.2797 448.72491,1036.2797"
-         id="path7116"
-         style="opacity:1;fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#ffffff;stroke-width:2.29999995;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-      <path
-         d="M 428.17655,1036.2797 C 428.17655,1036.2797 436.65275,1036.2797 436.65275,1036.2797"
-         id="path7118"
-         style="opacity:1;fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#ffffff;stroke-width:2.29999995;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
-    </g>
-    <path
-       d="M 400.73611,773.04393 C 400.17512,778.08663 397.09768,785.20329 391.63093,791.58064 C 381.69478,803.17183 364.54406,811.97304 354.586,805.56515 C 344.62787,799.15722 345.82613,786.7179 350.47862,773.22459 C 359.54765,773.82772 391.97069,774.37694 400.73611,773.04393 z"
-       id="path7562"
-       style="fill:#bf3042;fill-opacity:1;fill-rule:nonzero;stroke:#040102;stroke-width:1.89249992;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dashoffset:11.44000025;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <path
-       d="M 351.89228,772.10895 L 351.14506,775.2473 L 399.26622,775.69565 L 399.86401,772.10895 L 351.89228,772.10895 z"
-       id="path7567"
-       style="fill:#bf3042;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 331.95555,732.84197 C 338.0846,725.2335 337.60309,722.34122 338.0846,718.68175 C 339.14133,710.65057 341.46615,707.26904 350.97675,706.2123 C 360.48734,705.15557 376.30931,704.13848 378.24046,704.73288 C 381.19931,706.84635 380.24826,714.08496 382.46739,714.03213 C 384.2703,713.9892 383.94968,708.04954 386.06029,704.73288 C 390.07587,703.46479 409.8727,705.01611 417.12824,705.57826 C 427.68055,706.39584 429.02944,710.3745 429.59768,719.31579 C 430.1747,728.3952 434.45866,733.68736 434.45866,733.68736 C 434.45866,733.68736 392.18951,730.94831 382.0447,731.1512 C 371.47737,731.36255 331.95555,733.05332 331.95555,732.84197 z"
-       id="path8538"
-       style="fill:#1f1a17;fill-opacity:1;fill-rule:evenodd;stroke:#1f1a17;stroke-width:0.82282603px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 474.92407,978.74426 A 15.924983,8.219346 0 1 1 443.0741,978.74426 A 15.924983,8.219346 0 1 1 474.92407,978.74426 z"
-       transform="matrix(0.8749294,0,0,0.8337798,-41.738509,-92.408775)"
-       id="path8540"
-       style="fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:#ffffff;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:11.44000025;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <path
-       d="M 475.18094,977.20312 A 15.154419,6.4213638 0 1 1 444.8721,977.20312 A 15.154419,6.4213638 0 1 1 475.18094,977.20312 z"
-       transform="matrix(0.8894236,0,0,0.947083,-47.825644,-202.7951)"
-       id="path8546"
-       style="fill:#1f1a17;fill-opacity:1;fill-rule:nonzero;stroke:#1f1a17;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:11.44000025;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <path
-       d="M 474.92407,978.74426 A 15.924983,8.219346 0 1 1 443.0741,978.74426 A 15.924983,8.219346 0 1 1 474.92407,978.74426 z"
-       transform="matrix(0.8749294,0,0,0.8337798,3.1726275,-93.042841)"
-       id="path9517"
-       style="fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:#ffffff;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:11.44000025;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <path
-       d="M 475.18094,977.20312 A 15.154419,6.4213638 0 1 1 444.8721,977.20312 A 15.154419,6.4213638 0 1 1 475.18094,977.20312 z"
-       transform="matrix(0.8894236,0,0,0.947083,-2.9145076,-203.42917)"
-       id="path9519"
-       style="fill:#1f1a17;fill-opacity:1;fill-rule:nonzero;stroke:#1f1a17;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;marker:none;marker-start:none;marker-mid:none;marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:11.44000025;stroke-opacity:1;visibility:visible;display:inline;overflow:visible;enable-background:accumulate" />
-    <path
-       d="M 360.95723,90.054207 C 345.9239,90.225659 330.3722,95.668085 321.20445,110.47058 L 321.33302,110.44486 C 316.78646,117.14276 313.04767,125.83766 310.45629,136.981 C 304.56789,162.30202 306.96409,198.75238 305.23648,217.30939 C 287.77445,221.4329 286.56738,193.97641 284.94868,181.00219 C 283.12204,166.36135 281.51149,155.68958 277.72324,143.66646 C 273.98928,131.81568 265.22912,102.97257 246.14729,99.825266 C 185.48,89.818977 128.45612,115.45447 112.87519,121.81015 C 99.101332,127.42871 69.001814,143.22431 55.817352,152.02329 C 41.652541,161.47652 28.883981,175.17524 18.841608,188.07335 C 11.985897,196.87864 6.0295181,211.39546 13.750373,220.36927 C 27.269298,215.77926 46.14876,204.31319 59.725775,199.05294 C 72.38088,194.14987 81.817666,191.56591 93.693061,189.66758 C 109.55565,187.13188 124.19398,185.70018 141.15984,185.4506 C 159.90086,185.17492 175.82479,187.72147 192.45789,195.58164 C 211.16929,204.42393 220.7732,215.00757 235.27056,226.15477 C 244.9289,233.58119 254.81402,244.24864 261.24101,254.92797 C 266.94283,265.65978 268.12159,273.3788 268.72358,298.82059 C 268.97803,309.78816 269.0227,317.55065 268.69787,328.46804 C 268.4294,337.49099 268.45081,345.47195 267.66933,356.54698 C 267.16177,363.74037 266.15277,372.63256 265.45799,379.89467 C 260.16432,385.61059 256.6341,388.94307 252.60133,394.13984 C 248.95449,398.83932 243.66515,403.04995 242.98455,409.92781 C 247.46807,410.92503 273.53349,509.82918 278.41652,505.93021 C 286.13265,499.76908 296.83791,482.34205 304.38998,477.07461 C 277.45734,463.37524 276.25955,402.08172 279.82284,386.66028 C 283.27215,371.73209 298.03402,320.24617 303.97177,310.93688 C 318.06323,288.45787 338.37927,280.95839 360.62449,281.22061 C 403.4596,281.72556 423.86193,301.30299 441.5768,330.81041 C 452.67752,350.86544 455.06985,362.30768 456.39314,379.04613 C 457.59533,394.25271 447.05427,466.91143 431.09733,473.09774 C 438.05503,474.84919 447.92108,488.49435 452.30458,492.61715 C 456.06536,496.15431 489.96224,408.64904 495.66549,409.20595 C 496.19648,403.51463 490.32509,396.43371 487.62101,392.39134 C 484.32754,387.46785 477.66775,380.199 473.19584,375.9091 C 469.54653,372.4083 467.99071,371.69326 463.16765,367.6037 C 462.95515,361.77838 462.0236,351.97526 461.77913,345.95309 C 461.37363,335.96475 461.07333,326.06277 461.05916,315.89423 C 460.99885,315.894 460.93906,315.87237 460.87916,315.86852 C 461.25301,299.78792 461.49842,274.44058 464.27332,263.61907 C 469.18931,244.44774 477.06902,232.65929 491.81228,215.07233 C 501.75699,203.20947 522.95609,194.60342 541.61896,191.49322 C 564.5684,187.66865 587.60999,188.65374 610.99348,192.31605 C 631.49643,195.52721 648.36801,201.89486 668.33417,211.90959 C 688.39478,221.97169 715.64836,246.27172 747.32546,257.08788 C 755.56931,235.11126 739.33839,211.92158 715.36382,188.89618 C 706.49067,180.37432 695.2242,171.24349 684.40499,163.92855 C 655.18845,144.17508 621.13198,128.86326 597.62256,120.88447 C 577.43353,114.03256 556.96075,109.71238 539.71618,107.77068 C 536.14902,107.22129 533.06518,106.88247 528.83945,106.63929 C 512.89716,105.72185 492.30656,102.7588 479.75273,105.37934 C 479.73583,105.38287 479.71782,105.37429 479.70131,105.37934 C 454.86616,112.97269 441.91112,153.45249 440.12852,169.4312 C 438.82443,181.12052 437.46827,192.8923 436.4258,200.08147 C 435.34004,207.56934 436.4881,226.81459 422.25777,223.35202 C 421.36888,217.39901 420.80068,206.29818 420.30356,198.61581 C 419.45953,185.57242 420.23752,176.58794 419.94357,165.95991 C 419.54325,151.48583 417.97484,137.88199 415.13518,128.4699 C 411.97675,118.00114 405.06067,107.86795 397.52156,101.34235 L 397.5987,101.34235 C 395.98353,99.895189 393.96133,98.524904 391.65893,97.253934 C 383.84509,92.940532 372.56907,89.921773 360.95723,90.054207 z"
-       id="path2325"
-       style="fill:#1f1a17;fill-opacity:1;fill-rule:evenodd;stroke:#1f1a17;stroke-width:1.05801404px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <g
-       transform="matrix(0.822826,0,0,0.822826,-18.879821,-81.582154)"
-       id="g3449"
-       style="display:inline">
-      <path
-         d="M 400.60077,284.78921 C 414.71523,268.44422 420.27616,261.36336 431.16105,261.27581 C 440.6375,261.20395 453.16309,280.08262 460.50115,287.2286 C 465.90547,280.17323 475.1257,263.91074 488.9606,263.10582 C 500.59575,262.42888 518.50424,290.21006 518.50424,290.21006 C 517.35932,280.18149 503.03312,257.64781 485.97914,257.68496 C 469.20831,257.7215 464.40292,273.48739 460.50115,282.89191 C 456.72479,266.06904 445.85613,255.88152 434.21003,255.78766 C 417.6602,255.65646 404.75554,270.03106 400.60077,284.78921 z"
-         id="path3201"
-         style="fill:url(#linearGradient3766);fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" />
-      <path
-         d="M 454.31403,328.0686 C 440.9844,328.37851 443.09641,330.9256 432.02386,332.72927 C 423.46476,319.64236 417.40796,295.4728 416.42074,289.36478 C 414.78171,279.2239 417.2422,273.24126 425.33681,271.93792 C 432.65991,270.75881 447.57824,270.42894 454.11139,286.93312 C 457.81749,296.29554 455.53215,317.20767 454.31403,328.0686 z"
-         id="path3191"
-         style="fill:#ffffff;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" />
-      <path
-         d="M 444.5874,277.00387 C 448.44939,277.48358 450.9705,281.56322 449.88132,297.72359 C 449.33965,305.76057 445.62187,315.09978 442.76367,315.30242 C 437.91254,315.64635 434.09638,307.82418 433.64497,300.30722 C 433.25455,293.80609 434.25517,287.08623 435.4687,284.70411 C 438.14697,279.44675 441.50255,276.62069 444.5874,277.00387 z"
-         id="path3303"
-         style="fill:#000000;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" />
-      <path
-         d="M 448.22471,302.81437 C 446.59691,302.87452 446.05055,299.74416 445.54116,296.19314 C 444.78171,290.89893 442.62969,288.92895 441.95312,285.87498 C 441.10211,282.0336 443.91716,280.5165 446.64855,280.45889 C 450.3937,280.37991 450.62167,302.72579 448.22471,302.81437 z"
-         id="path3305"
-         style="fill:url(#linearGradient3768);fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" />
-      <path
-         d="M 454.6758,326.7559 L 463.58606,326.7559"
-         id="path3212"
-         style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#201818;stroke-width:0.96397775px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" />
-      <path
-         d="M 485.72441,335.4456 C 495.16323,321.36229 500.92922,307.11497 503.10382,292.59637 C 504.37731,284.09395 504.53807,280.22187 500.55684,275.96608 C 496.21199,271.32158 484.27547,272.32518 480.9301,273.26927 C 475.86697,274.69813 470.30185,278.21879 466.69696,284.35614 C 462.57549,291.37301 463.5002,320.65943 464.74927,327.80465 C 480.61504,328.76723 482.03545,335.37864 485.72441,335.4456 z"
-         id="path3224"
-         style="opacity:1;fill:#ffffff;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" />
-      <path
-         d="M 475.72922,278.40301 C 479.6016,278.34056 483.6427,281.12801 483.86976,296.57575 C 484.04734,308.65677 478.8612,317.54768 475.85318,317.30085 C 471.00616,316.90312 467.18589,309.39411 466.73448,302.30565 C 466.32057,295.80597 467.05675,288.66862 467.8091,286.10325 C 468.95022,282.21225 471.87666,278.46514 475.72922,278.40301 z"
-         id="path3226"
-         style="opacity:1;fill:#000000;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-      <path
-         d="M 481.79348,304.08661 C 480.16568,304.14676 479.61932,301.0164 479.10993,297.46538 C 478.35048,292.17117 476.19846,290.20119 475.52189,287.14722 C 474.67088,283.30584 477.48593,281.78874 480.21732,281.73113 C 483.96247,281.65215 484.19044,303.99803 481.79348,304.08661 z"
-         id="path3234"
-         style="fill:url(#linearGradient3770);fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    </g>
-    <path
-       d="M 308.51832,203.31166 C 308.91029,196.13541 320.86329,192.23754 325.36687,192.39839 C 341.44959,192.97278 343.93858,188.18625 352.93724,187.80333 C 356.20597,187.66424 365.18459,187.50861 370.16873,188.76063 C 375.96443,190.21652 379.93323,195.27031 385.48559,195.84468 C 389.09902,196.21849 403.71255,197.16436 406.92921,204.0775 C 410.37503,211.48312 407.31214,215.3737 402.33416,219.39437 C 397.35617,223.41506 391.03796,225.71259 386.82582,230.88203 C 382.33633,236.39186 382.42223,240.26361 376.67839,246.77328 C 371.29212,252.87773 366.72242,253.47441 359.06399,254.0488 C 351.78628,254.59463 344.05531,250.88824 339.9179,246.58183 C 335.48464,241.96746 333.09222,236.0495 328.43024,225.52112 C 324.70354,217.10493 323.1353,214.59885 316.36821,211.35302 C 312.09409,209.30294 308.25147,208.19686 308.51832,203.31166 z"
-       id="path2271"
-       style="fill:#eec210;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 357.91523,188.20235 C 357.5323,205.05091 354.66039,224.94675 352.36286,226.86136 C 350.06533,228.77596 344.89588,229.35035 341.44959,226.09551 C 338.00329,222.84067 336.85453,218.24561 332.45093,215.75662 C 328.04733,213.26763 321.53765,212.50178 319.04866,210.9701 C 316.55967,209.43841 309.91144,206.5785 310.62438,203.31166 C 311.2917,200.25389 313.6153,196.15115 315.64735,195.20625 C 318.15245,194.04139 320.75972,193.01496 322.40486,192.71043 C 324.77648,192.27143 333.44555,192.41202 336.31747,191.83764 C 339.18938,191.26325 345.46102,188.74807 349.89253,188.16512 C 354.12425,187.60844 357.78222,189.45788 357.91523,188.20235 z"
-       id="path2280"
-       style="fill:url(#radialGradient3835);fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:0.99000001;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 359.17204,187.89795 C 359.47412,228.37654 359.32308,222.18393 359.62516,228.82966 C 365.5157,230.34006 385.45291,225.50679 388.92682,224.44952 C 392.40073,223.39224 403.72869,211.7622 404.33285,209.19453 C 404.93701,206.62685 406.74948,203.7571 402.97349,201.18944 C 398.15396,197.91216 395.11944,196.65825 390.28617,196.20513 C 385.45291,195.75202 383.79148,195.60097 380.92172,194.39266 C 378.05198,193.18434 374.57807,190.31459 371.40624,189.25732 C 366.81876,187.72816 363.40114,187.89796 359.17204,187.89795 z"
-       id="path9204"
-       style="fill:url(#radialGradient3832);fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 328.45497,215.51484 C 332.26241,223.60443 334.88081,230.37428 339.42977,236.26979 C 343.62147,241.70226 348.1142,246.26385 359.2143,246.429 C 371.96578,246.62107 376.00121,240.08944 379.55075,235.23322 C 382.28616,231.49086 386.34,224.62279 390.52049,218.67972 C 391.62992,217.10253 398.6907,209.17584 401.46034,209.1491 C 405.15081,209.11346 406.36974,211.63311 405.19418,213.07307 C 402.37934,216.52101 400.56817,212.49517 398.96931,212.53412 C 397.41864,212.5719 393.83952,216.40565 391.3705,219.51194 C 385.21312,227.25857 383.16966,231.64634 379.29936,237.94593 C 375.27975,244.48852 368.2271,248.79428 359.39317,248.69081 C 349.14655,248.57079 343.50539,244.90953 340.52154,240.68301 C 337.46877,236.35885 330.85585,221.80464 328.39499,216.93774 C 325.4309,211.07559 322.59684,207.30492 320.43392,207.20508 C 318.70051,207.12506 319.15581,210.2846 314.3285,208.02247 C 312.50536,207.16813 311.84958,203.96235 314.92921,202.95897 C 319.30519,201.53321 322.06047,205.23742 323.47894,206.97677 C 325.84226,209.87471 327.46309,213.40739 328.45497,215.51484 z"
-       id="path6287"
-       style="fill:#603f2f;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 341.96944,195.22692 C 342.20389,196.8127 348.64142,195.03326 352.02917,195.00151 C 353.4962,194.98776 353.64241,192.51103 353.1933,191.71709 C 352.85961,191.1272 351.28535,190.95206 349.63259,191.60177 C 345.26451,193.3189 341.74118,193.68295 341.96944,195.22692 z"
-       id="path7258"
-       style="fill:#603f2f;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 374.38321,196.31987 C 373.98747,197.87186 368.04682,195.63981 364.81377,195.04819 C 363.42929,194.79484 363.54558,192.40442 364.06008,191.66195 C 364.44234,191.1103 365.93969,191.08063 367.4454,191.89861 C 371.42481,194.06049 374.76851,194.80879 374.38321,196.31987 z"
-       id="path8229"
-       style="fill:#603f2f;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;display:inline" />
-    <path
-       d="M 459.92427,441.16333 C 453.47384,422.5753 444.02743,397.55078 457.36874,396.9403 C 479.19804,395.94142 466.74158,426.79466 481.57785,431.42599 C 493.55223,435.16394 497.0114,407.10446 517.24519,411.34961 C 539.02578,426.09625 518.65653,440.35115 528.48825,449.4267 C 538.05732,458.2598 555.62446,434.38034 562.60307,439.97918 C 569.84855,445.79213 567.96626,450.12329 558.25572,465.2107 C 551.9794,474.96229 536.41076,479.55737 523.84109,501.30077 C 515.29532,516.0835 514.02003,526.83241 504.37144,534.65991 C 493.55511,543.43475 474.7612,534.90709 468.23063,529.98049 C 461.19761,524.67483 463.66161,512.55546 464.18341,498.97845 C 464.71461,485.15662 461.03116,452.69838 459.92427,441.16333 z"
-       id="path3384"
-       style="fill:#eebe18;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:2.95579696;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 443.33887,431.77356 C 443.20633,409.69398 442.62164,394.18361 457.90029,393.43196 C 478.64182,392.41154 475.29814,408.54692 490.85239,409.89553 C 505.36621,411.15392 508.35224,405.00873 517.00053,408.34996 C 530.82557,413.69118 528.42321,423.14176 539.33665,429.33935 C 548.87543,434.7563 556.5634,429.95516 563.18174,434.56969 C 572.41798,441.00951 570.32587,450.67639 563.78677,462.03845 C 557.06881,473.71127 544.78683,485.00754 527.27266,508.33129 C 512.57009,527.8882 503.6667,551.65241 490.95383,556.39235 C 476.10597,561.92831 466.15911,557.63913 458.57483,551.91761 C 450.40703,545.75587 442.38598,535.89813 442.99199,520.13047 C 443.6089,504.07848 444.22899,498.68676 444.12579,481.62852 C 443.92711,448.78743 443.4233,445.23108 443.33887,431.77356 z"
-       id="path2413"
-       style="fill:#e69900;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 560.89818,623.3984 C 560.67918,596.59657 559.88737,577.65924 578.43812,576.74702 C 603.5557,575.51166 599.54418,595.04188 618.31852,596.74338 C 635.83792,598.33607 639.44499,591.00533 649.94419,595.0566 C 666.72912,601.53322 663.8632,612.67487 677.21202,620.18906 C 688.91695,626.85793 698.00311,621.19768 706.07599,626.84673 C 717.30406,634.69513 714.94169,646.13599 707.11849,659.89174 C 699.08199,674.02428 684.25075,687.68905 663.0369,715.95946 C 645.24576,739.63755 634.36416,768.34304 618.91522,774.25947 C 600.92803,781.07222 588.91888,775.99733 579.68259,769.16804 C 569.73179,761.81645 559.88487,749.84831 560.55594,730.78488 C 561.23556,711.37502 562.00607,704.76067 561.88638,684.06129 C 561.65161,644.32309 561.01016,639.73602 560.89818,623.3984 C 560.89818,623.3984 560.89818,623.3984 560.89818,623.3984"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10261"
-       style="fill:#e69900;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 561.17617,623.55578 C 560.85128,596.81248 559.91093,577.71568 578.42921,576.80583 C 603.38208,575.57919 599.46587,594.96407 618.00413,596.77986 C 635.30489,598.48835 638.87188,591.40931 649.35045,595.44339 C 666.10437,601.89314 663.3367,612.40607 676.84173,619.88752 C 688.75185,626.71278 697.36774,621.37193 705.49448,627.09575 C 716.72813,634.98426 714.69527,645.86285 707.09865,659.522 C 699.2962,673.55632 684.63927,687.10434 663.55622,715.2367 C 645.90631,738.75044 634.91299,767.13463 619.46646,773.33606 C 601.5849,780.30379 589.72109,775.48097 580.45021,768.87877 C 570.45501,761.77755 560.42752,749.83169 560.97897,730.94998 C 561.53037,711.72024 562.33179,704.99312 562.22257,684.3521 C 562.00004,644.93269 561.3053,639.86119 561.17617,623.55578 C 561.17617,623.55578 561.17617,623.55578 561.17617,623.55578"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10263"
-       style="fill:#e69900;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 561.53616,623.75959 C 561.07414,597.09207 559.94144,577.78876 578.41767,576.88198 C 603.15725,575.66665 599.36448,594.8633 617.59701,596.82709 C 634.61463,598.68554 638.12973,591.93244 648.5816,595.94426 C 665.29534,602.35921 662.6549,612.05797 676.36223,619.49705 C 688.53806,626.52481 696.54497,621.59758 704.74145,627.41822 C 715.98233,635.35868 714.37618,645.50914 707.07296,659.0432 C 699.57359,672.95033 685.14238,686.34718 664.22872,714.30076 C 646.7617,737.60168 635.62371,765.56979 620.18028,772.14029 C 602.43551,779.30872 590.75992,774.8123 581.44423,768.50419 C 571.39155,761.72717 561.13023,749.81018 561.52678,731.16377 C 561.91213,712.16729 562.75358,705.29415 562.65793,684.72868 C 562.45123,645.72209 561.68748,640.02326 561.53616,623.75959 C 561.53616,623.75959 561.53616,623.75959 561.53616,623.75959"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10265"
-       style="fill:#e69a00;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 561.96246,624.00094 C 561.33805,597.42316 559.97758,577.87531 578.40401,576.97215 C 602.89101,575.77022 599.2444,594.74398 617.1149,596.88303 C 633.79723,598.91906 637.25087,592.55192 647.67112,596.53738 C 664.3373,602.91112 661.84752,611.64577 675.79441,619.03466 C 688.2849,626.30222 695.57064,621.86479 703.84972,627.8001 C 715.09915,635.80207 713.99831,645.09028 707.04253,658.4762 C 699.90207,672.23272 685.73817,685.45054 665.02508,713.19242 C 647.77464,736.24131 636.46533,763.71672 621.02559,770.72426 C 603.4428,778.13037 591.9901,774.02047 582.62135,768.06062 C 572.50059,761.66751 561.96237,749.78471 562.17549,731.41695 C 562.36422,712.69668 563.25306,705.65062 563.17347,685.17463 C 562.98554,646.65689 562.14005,640.2152 561.96246,624.00094 C 561.96246,624.00094 561.96246,624.00094 561.96246,624.00094"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10267"
-       style="fill:#e69b01;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 562.446,624.27469 C 561.63739,597.79871 560.01856,577.97347 578.38851,577.07443 C 602.58901,575.88769 599.10821,594.60863 616.56806,596.94648 C 632.87008,599.18394 636.254,593.25459 646.63839,597.21015 C 663.25062,603.53715 660.93172,611.17821 675.15035,618.51018 C 687.99774,626.04974 694.46549,622.16788 702.83825,628.23324 C 714.09738,636.30499 713.56969,644.61518 707.00802,657.83308 C 700.27465,671.41875 686.41395,684.43351 665.92837,711.93526 C 648.9236,734.69829 637.41997,761.61483 621.9844,769.11809 C 604.58535,776.79379 593.38546,773.12232 583.95652,767.55748 C 573.75855,761.59984 562.90626,749.75582 562.91131,731.70412 C 562.87701,713.29716 563.8196,706.05495 563.75824,685.68046 C 563.59159,647.71722 562.6534,640.4329 562.446,624.27469 C 562.446,624.27469 562.446,624.27469 562.446,624.27469"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10269"
-       style="fill:#e69c02;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 562.98066,624.57739 C 561.96838,598.21397 560.06388,578.08202 578.37137,577.18753 C 602.25509,576.01758 598.95761,594.45897 615.9634,597.01664 C 631.84489,599.47682 635.15174,594.03156 645.49647,597.95405 C 662.04904,604.22937 659.9191,610.66121 674.43818,617.93024 C 687.68021,625.77057 693.24348,622.50301 701.71984,628.71219 C 712.9897,636.86109 713.09576,644.08984 706.96986,657.12195 C 700.68663,670.51872 687.16119,683.30895 666.92717,710.54519 C 650.19404,732.99211 638.47554,759.2907 623.04458,767.3421 C 605.84869,775.31589 594.92835,772.1292 585.43287,767.00114 C 575.14952,761.52501 563.94994,749.72387 563.72493,732.02166 C 563.44402,713.96112 564.44605,706.50204 564.40484,686.23977 C 564.26171,648.88965 563.22103,640.67363 562.98066,624.57739 C 562.98066,624.57739 562.98066,624.57739 562.98066,624.57739"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10271"
-       style="fill:#e69d02;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 563.56196,624.90649 C 562.32825,598.66544 560.11315,578.20004 578.35274,577.3105 C 601.89204,576.15881 598.79388,594.29625 615.306,597.09291 C 630.73029,599.79525 633.95333,594.87629 644.25495,598.76284 C 660.74265,604.98196 658.81816,610.09912 673.66391,617.29972 C 687.33499,625.46704 691.91489,622.86738 700.50387,629.23291 C 711.7854,637.46569 712.5805,643.51869 706.92837,656.3488 C 701.13455,669.54019 687.9736,682.0863 668.01309,709.03386 C 651.57529,731.13713 639.62318,756.76386 624.19724,765.41121 C 607.22223,773.70908 596.60582,771.04947 587.03798,766.39628 C 576.6618,761.44366 565.08465,749.68913 564.60951,732.36689 C 564.06048,714.683 565.12714,706.98812 565.10783,686.84786 C 564.99029,650.16434 563.83816,640.93535 563.56196,624.90649 C 563.56196,624.90649 563.56196,624.90649 563.56196,624.90649"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10273"
-       style="fill:#e79e03;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 564.18641,625.26002 C 562.71483,599.15043 560.16608,578.32681 578.33273,577.44259 C 601.50203,576.31051 598.61799,594.12146 614.5998,597.17485 C 629.53294,600.13732 632.66596,595.78373 642.92126,599.63167 C 659.33928,605.79043 657.63548,609.49531 672.83215,616.6224 C 686.96415,625.14099 690.48767,623.2588 699.19764,629.79229 C 710.4917,638.11518 712.02698,642.90513 706.88381,655.51826 C 701.61571,668.48901 688.84632,680.77288 669.17963,707.41034 C 653.05908,729.14443 640.85602,754.04943 625.43547,763.33697 C 608.69774,771.98299 598.40781,769.88957 588.76226,765.74651 C 578.28636,761.35627 566.3036,749.65182 565.55977,732.73775 C 564.72271,715.45846 565.85879,707.51028 565.86302,687.5011 C 565.77295,651.53367 564.50111,641.2165 564.18641,625.26002 C 564.18641,625.26002 564.18641,625.26002 564.18641,625.26002"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10275"
-       style="fill:#e79f04;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 564.85122,625.6364 C 563.12639,599.66677 560.22243,578.46178 578.31142,577.58322 C 601.08683,576.47202 598.43074,593.93537 613.84795,597.26209 C 628.25822,600.50149 631.29539,596.74982 641.50138,600.55665 C 657.84522,606.65114 656.37637,608.85247 671.94663,615.9013 C 686.56934,624.79386 688.96822,623.67551 697.80699,630.38781 C 709.11439,638.80664 711.43769,642.25192 706.83636,654.63403 C 702.12797,667.36991 689.77544,679.37458 670.42155,705.6819 C 654.63876,727.02295 642.16853,751.15958 626.75372,761.12869 C 610.2686,770.14535 600.32627,768.65472 590.59797,765.05476 C 580.0159,761.26323 567.60132,749.6121 566.57143,733.13257 C 565.42773,716.28405 566.63773,708.0662 566.66701,688.19655 C 566.6062,652.99149 565.2069,641.51581 564.85122,625.6364 C 564.85122,625.6364 564.85122,625.6364 564.85122,625.6364"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10277"
-       style="fill:#e7a004;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 565.55407,626.03431 C 563.5615,600.21264 560.282,578.60447 578.2889,577.73189 C 600.64786,576.64278 598.23277,593.73864 613.05309,597.35431 C 626.91055,600.8865 629.8464,597.77118 640.00026,601.53455 C 656.26567,607.5611 655.04522,608.17285 671.01045,615.13894 C 686.15193,624.42687 687.36182,624.11606 696.33676,631.01741 C 707.65827,639.53766 710.81468,641.56133 706.7862,653.69922 C 702.66955,666.18676 690.75772,677.89628 671.73453,703.85456 C 656.30882,724.78008 643.55614,748.10437 628.1474,758.79405 C 611.92935,768.20257 602.35449,767.34921 592.53871,764.32342 C 581.84441,761.16486 568.9733,749.5701 567.64098,733.54999 C 566.17309,717.15687 567.46123,708.65392 567.517,688.9318 C 567.48712,654.53272 565.95308,641.83226 565.55407,626.03431 C 565.55407,626.03431 565.55407,626.03431 565.55407,626.03431"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10279"
-       style="fill:#e7a105;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 566.293,626.45265 C 564.01895,600.78655 560.34464,578.75449 578.26522,577.8882 C 600.18636,576.82229 598.02464,593.5318 612.21742,597.45127 C 625.4937,601.29128 628.32302,598.84498 638.42207,602.56266 C 654.60503,608.51777 653.64573,607.45834 670.02621,614.33744 C 685.7131,624.04104 685.67296,624.57924 694.79107,631.67934 C 706.1274,640.30621 710.15969,640.8353 706.73346,652.71641 C 703.23892,664.94288 691.79044,676.34208 673.11492,701.93341 C 658.06462,722.42208 645.01498,744.89232 629.61263,756.33955 C 613.67535,766.16005 604.48684,765.97668 594.57909,763.55454 C 583.76678,761.06145 570.41572,749.52595 568.76544,733.98884 C 566.95672,718.0745 568.32702,709.27181 568.41062,689.70479 C 568.41327,656.15308 566.73756,642.16495 566.293,626.45265 C 566.293,626.45265 566.293,626.45265 566.293,626.45265"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10281"
-       style="fill:#e8a306;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 567.06632,626.89047 C 564.49769,601.38716 560.41018,578.91149 578.24043,578.05178 C 599.70338,577.01017 597.80682,593.31534 611.34285,597.55275 C 624.01089,601.7149 626.72872,599.96876 636.77042,603.63862 C 652.86709,609.51899 652.18109,606.71057 668.99615,613.49863 C 685.25384,623.63724 683.90547,625.06397 693.17341,632.37208 C 704.52526,641.11054 709.47421,640.07546 706.67827,651.68785 C 703.8348,663.64109 692.87123,674.71553 674.55957,699.92282 C 659.90216,719.9543 646.54174,741.53074 631.14606,753.7708 C 615.50263,764.02244 606.71845,764.54025 596.71445,762.74986 C 585.77865,760.95322 571.92528,749.47974 569.94224,734.44812 C 567.77683,719.03484 569.2331,709.91846 569.34585,690.51377 C 569.38252,657.84887 567.55857,642.51313 567.06632,626.89047 C 567.06632,626.89047 567.06632,626.89047 567.06632,626.89047"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10283"
-       style="fill:#e8a407;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 567.87258,627.34693 C 564.99682,602.01336 560.47852,579.07518 578.21459,578.22233 C 599.19983,577.20605 597.57972,593.08965 610.43104,597.65854 C 622.46494,602.15655 625.06653,601.14041 635.04843,604.76041 C 651.05513,610.56283 650.65408,605.93095 667.92223,612.6241 C 684.77502,623.21626 682.06272,625.56935 691.48687,633.09431 C 702.8549,641.94913 708.75953,639.28327 706.62073,650.61549 C 704.45606,662.28387 693.99804,673.01971 676.06573,697.82661 C 661.81795,717.38143 648.13352,738.02601 632.7448,751.09265 C 617.40773,761.7938 609.0451,763.04266 598.94074,761.91092 C 587.87619,760.84039 573.49912,749.43156 571.16916,734.92695 C 568.63187,720.03609 570.17777,710.59266 570.3209,691.35719 C 570.39306,659.61687 568.41453,642.87613 567.87258,627.34693 C 567.87258,627.34693 567.87258,627.34693 567.87258,627.34693"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10285"
-       style="fill:#e8a608;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 568.71048,627.82131 C 565.51554,602.66412 560.54954,579.24529 578.18774,578.39957 C 598.67652,577.40961 597.34372,592.85511 609.48345,597.76849 C 620.85833,602.61554 623.33912,602.35803 633.25886,605.92622 C 649.17207,611.64764 649.06715,605.12075 666.80616,611.71526 C 684.27742,622.77875 680.14765,626.09455 689.73415,633.84489 C 701.11899,642.82062 708.01681,638.45999 706.56092,649.50106 C 705.1017,660.87339 695.16907,671.25735 677.63101,695.64815 C 663.80892,714.7076 649.78775,734.38376 634.40627,748.30941 C 619.38759,759.47771 611.46304,761.48629 601.2544,761.03906 C 590.05604,760.72312 575.13473,749.38149 572.44422,735.42458 C 569.52045,721.07662 571.15951,711.29331 571.33422,692.23372 C 571.44325,661.45425 569.30408,643.25338 568.71048,627.82131 C 568.71048,627.82131 568.71048,627.82131 568.71048,627.82131"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10287"
-       style="fill:#e9a709;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 569.57887,628.31294 C 566.05313,603.33857 560.62315,579.42159 578.15991,578.58326 C 598.13417,577.62058 597.09912,592.61204 608.50138,597.88243 C 619.19325,603.09123 621.54885,603.61994 631.40419,607.13444 C 647.2205,612.77192 647.42248,604.28106 665.64949,610.77335 C 683.7617,622.32532 678.16291,626.63887 687.91765,634.62278 C 699.31993,643.72381 707.24707,637.60675 706.49895,648.34607 C 705.77082,659.41159 696.38271,669.43087 679.25323,693.39043 C 665.87233,711.93649 651.50218,730.60898 636.12819,745.42491 C 621.43948,757.07735 613.96896,759.87331 603.65223,760.13547 C 592.3152,760.60159 576.82984,749.3296 573.76567,735.94031 C 570.44137,722.15501 572.17697,712.01945 572.3844,693.14213 C 572.53165,663.35848 570.226,643.64436 569.57887,628.31294 C 569.57887,628.31294 569.57887,628.31294 569.57887,628.31294"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10289"
-       style="fill:#e9a90a;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 570.4767,628.82125 C 566.60895,604.03589 560.69925,579.60386 578.13113,578.77318 C 597.57343,577.8387 596.84623,592.36073 607.486,598.00025 C 617.47171,603.58305 619.69787,604.92466 629.48662,608.38364 C 645.20275,613.93433 645.72203,603.4129 664.45359,609.79949 C 683.2285,621.85652 676.11086,627.20165 686.03956,635.42705 C 697.45985,644.65764 706.45123,636.72458 706.43487,647.15191 C 706.46264,657.90021 697.6375,667.54245 680.93046,691.05614 C 668.00571,709.0714 653.27474,726.70619 637.90851,742.44258 C 623.56095,754.59559 616.55986,758.20561 606.13139,759.20125 C 594.65098,760.47594 578.58244,749.27595 575.13194,736.47353 C 571.39351,723.26997 573.22894,712.77022 573.4702,694.08135 C 573.65696,665.32729 571.17919,644.04859 570.4767,628.82125 C 570.4767,628.82125 570.4767,628.82125 570.4767,628.82125"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10291"
-       style="fill:#e9aa0b;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 571.40305,629.34569 C 567.18243,604.75535 560.77777,579.79193 578.10144,578.96914 C 596.99487,578.06375 596.58531,592.10143 606.43838,598.1218 C 615.6955,604.0905 617.78811,606.27081 627.50815,609.67251 C 643.12091,615.13365 643.96758,602.51716 663.21971,608.7947 C 682.67837,621.37283 673.99364,627.7823 684.10181,636.25686 C 695.54069,645.62112 705.6301,635.81439 706.36876,645.91983 C 707.17643,656.34084 698.93215,665.59405 682.66097,688.64771 C 670.20685,706.11531 655.10361,722.67944 639.74537,739.36553 C 625.74981,752.03501 619.23305,756.48496 608.68928,758.23735 C 597.06094,760.3463 580.3907,749.2206 576.5416,737.02369 C 572.3759,724.42034 574.31431,713.54483 574.59049,695.0504 C 574.81801,667.35863 572.16264,644.46567 571.40305,629.34569 C 571.40305,629.34569 571.40305,629.34569 571.40305,629.34569"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10293"
-       style="fill:#eaac0c;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 572.35706,629.8858 C 567.77302,605.4963 560.85863,579.98561 578.07087,579.17094 C 596.39904,578.29552 596.3166,591.83439 605.35947,598.24698 C 613.86624,604.61309 615.82132,607.65716 625.47059,610.99987 C 640.97691,616.36879 642.16074,601.59468 661.94899,607.75991 C 682.1118,620.87469 671.81319,628.38029 682.1062,637.11146 C 693.56423,646.61338 704.78446,634.87703 706.30067,644.65096 C 707.91154,654.7349 700.26545,663.58747 684.44315,686.16737 C 672.47372,703.07095 656.98708,718.53245 641.63709,736.1966 C 628.00402,749.39796 621.98607,754.71292 611.32355,757.24466 C 599.54287,760.21279 582.25296,749.1636 577.99336,737.59027 C 573.38762,725.60507 575.4321,714.34257 575.74422,696.04839 C 576.01373,669.45062 573.17547,644.8952 572.35706,629.8858 C 572.35706,629.8858 572.35706,629.8858 572.35706,629.8858"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10295"
-       style="fill:#eaae0d;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 573.33795,630.44113 C 568.38027,606.25812 560.94177,580.18475 578.03943,579.37843 C 595.78643,578.53382 596.04032,591.55982 604.25016,598.37569 C 611.98544,605.15041 613.7991,609.08258 623.37563,612.36463 C 638.77249,617.63873 640.30298,600.6462 660.64245,606.69596 C 681.52928,620.36252 669.57131,628.99513 680.05436,637.99013 C 691.53207,647.6336 703.91499,633.91325 706.23066,643.34633 C 708.66736,653.0837 701.63633,661.52435 686.27555,683.61713 C 674.80446,699.94081 658.92363,714.26861 643.5821,732.93838 C 630.32176,746.68661 624.81665,752.89095 614.03205,756.22401 C 602.09473,760.07551 584.16769,749.10498 579.48602,738.17282 C 574.42785,726.82318 576.58138,715.1628 576.93047,697.0745 C 577.24314,671.60157 574.21683,645.33683 573.33795,630.44113 C 573.33795,630.44113 573.33795,630.44113 573.33795,630.44113"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10297"
-       style="fill:#eab00e;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 574.34501,631.01128 C 569.0037,607.04027 561.02713,580.38921 578.00715,579.59146 C 595.15747,578.77848 595.75666,591.27793 603.11126,598.50783 C 610.05447,605.70207 611.72295,610.54602 621.22478,613.7658 C 636.50926,618.94254 638.39567,599.67242 659.30107,605.60364 C 680.93121,619.83669 667.26962,629.62637 677.94779,638.89224 C 689.44571,648.68103 703.02233,632.92376 706.15879,642.0069 C 709.44334,651.38847 703.04378,659.40619 688.15683,680.99887 C 677.19738,696.72717 660.91184,709.89103 645.579,729.59324 C 632.70132,743.90293 627.72275,751.02038 616.8128,755.17613 C 604.71467,759.93457 586.1335,749.04481 581.0185,738.77091 C 575.49583,728.07378 577.76132,716.0049 578.14836,698.12798 C 578.50535,673.80989 575.28598,645.79024 574.34501,631.01128 C 574.34501,631.01128 574.34501,631.01128 574.34501,631.01128"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10299"
-       style="fill:#ebb110;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 575.37757,631.59586 C 569.64293,607.84223 561.11465,580.59884 577.97406,579.80987 C 594.51258,579.02934 595.46583,590.98891 601.94352,598.64332 C 608.0746,606.26769 609.59422,612.04652 619.01946,615.20245 C 634.18873,620.27938 636.44006,598.67399 657.92572,604.48364 C 680.318,619.29754 664.90964,630.27359 675.78787,639.81719 C 687.30651,649.75498 702.10706,631.90921 706.08509,640.63355 C 710.23897,649.6503 704.48686,657.2344 690.08574,678.3143 C 679.65089,693.43216 662.95039,705.4026 647.62647,726.16339 C 635.14114,741.04877 630.70243,749.10244 619.66397,754.10171 C 607.40094,759.79007 588.14909,748.98311 582.58978,739.38414 C 576.59086,729.35605 578.97114,716.86832 579.39709,699.20814 C 579.79952,676.07413 576.38219,646.25513 575.37757,631.59586 C 575.37757,631.59586 575.37757,631.59586 575.37757,631.59586"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10301"
-       style="fill:#ebb311;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 576.43502,632.19453 C 570.29756,608.66351 561.20428,580.81352 577.94017,580.03356 C 593.85215,579.28624 595.16798,590.69291 600.74763,598.78208 C 606.04701,606.84694 607.41418,613.58318 616.76099,616.67372 C 631.81227,621.64843 634.43732,597.65148 656.51722,603.33666 C 679.69001,618.74539 662.49279,630.93641 673.57589,640.76444 C 685.11575,650.85482 701.16973,630.87021 706.00962,639.2271 C 711.05377,647.87024 705.96473,655.01026 692.06115,675.56503 C 682.16354,690.05772 665.03807,700.80599 649.72329,722.65088 C 637.63976,738.12581 633.75394,747.13828 622.58386,753.0014 C 610.15196,759.64208 590.21326,748.91992 584.19894,740.01216 C 577.71227,730.66923 580.21012,717.75256 580.67592,700.31433 C 581.12488,678.39295 577.50483,646.73123 576.43502,632.19453 C 576.43502,632.19453 576.43502,632.19453 576.43502,632.19453"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10303"
-       style="fill:#ecb512;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 577.51678,632.80696 C 570.96725,609.50368 561.29597,581.03314 577.9055,580.26239 C 593.17653,579.54904 594.86328,590.39011 599.52425,598.92403 C 603.97281,607.43952 605.18401,615.15517 614.45059,618.17883 C 629.38116,623.04896 632.38852,596.60547 655.07633,602.1633 C 679.04757,618.18055 660.02036,631.61448 671.31305,641.73347 C 682.87462,651.97995 700.21085,629.80733 705.93242,637.78832 C 711.88731,646.04925 707.47658,652.73498 694.08198,672.75255 C 684.73396,686.6057 667.17376,696.10368 651.86832,719.0576 C 640.19583,735.13564 636.8756,745.12895 625.57088,751.87579 C 612.96624,759.49069 592.32489,748.85528 585.8451,740.65461 C 578.85947,732.0126 581.47759,718.65713 581.98415,701.44596 C 582.48072,680.76508 578.65328,647.21827 577.51678,632.80696 C 577.51678,632.80696 577.51678,632.80696 577.51678,632.80696"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10305"
-       style="fill:#ecb713;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 578.62232,633.43286 C 571.65165,610.36231 561.38968,581.25758 577.87007,580.49624 C 592.48607,579.81763 594.55189,590.08066 598.27397,599.06909 C 601.853,608.04512 602.90483,616.76173 612.0894,619.71702 C 626.89662,624.48028 630.29469,595.53647 653.60377,600.96415 C 678.39102,617.60329 657.49358,632.30745 669.00047,642.7238 C 680.58423,653.12981 699.23089,628.72107 705.85352,636.3179 C 712.73918,644.18823 709.02166,650.40968 696.14723,669.87824 C 687.36089,683.07779 669.3564,691.298 654.0605,715.38534 C 642.8081,732.07974 640.06589,743.07545 628.62357,750.72544 C 615.84239,759.33597 594.48294,748.78922 587.52744,741.31119 C 580.03189,733.3855 582.77292,719.58158 583.32114,702.60246 C 583.86636,683.18936 579.82698,647.71603 578.62232,633.43286 C 578.62232,633.43286 578.62232,633.43286 578.62232,633.43286"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10307"
-       style="fill:#edb915;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 579.75114,634.07194 C 572.35047,611.23903 561.48536,581.48676 577.83389,580.73502 C 591.78106,580.09187 594.23394,589.76469 596.99737,599.21721 C 599.68856,608.66347 600.57765,618.40211 609.6785,621.2876 C 624.35975,625.94174 628.15677,594.44495 652.1002,599.73975 C 677.72064,617.01388 654.9136,633.01501 666.6392,643.73499 C 678.24561,654.30388 698.2303,627.61195 705.77295,634.81652 C 713.60898,642.28802 710.59928,648.03542 698.25597,666.9434 C 690.04312,679.4756 671.58499,686.39114 656.29884,711.63574 C 645.47537,728.95949 643.32336,740.97871 631.74053,749.55086 C 618.77909,759.17799 596.68644,748.72177 589.24521,741.98159 C 581.229,734.78731 584.09552,720.5255 584.68628,703.78332 C 585.28118,685.66469 581.02539,648.22426 579.75114,634.07194 C 579.75114,634.07194 579.75114,634.07194 579.75114,634.07194"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path10309"
-       style="fill:#edbb16;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter13754)" />
-    <path
-       d="M 186.30394,484.81994 C 174.23544,474.60325 165.98657,476.89979 166.21719,459.73641 C 166.33066,451.4961 199.451,461.12941 209.82077,451.81478 C 221.80354,441.05127 205.34946,422.56543 218.7786,415.18232 C 231.17322,408.36796 252.22714,435.72005 262.97552,432.74735 C 272.41482,430.13671 266.13085,406.00041 276.79126,406.1025 C 287.4299,406.2044 286.33697,415.97799 286.26186,428.31739 C 286.18868,440.34136 283.245,455.55547 285.03317,481.53478 C 286.52106,503.32827 290.38527,517.78417 285.82761,527.93793 C 280.91844,538.87477 279.00662,540.3269 270.52925,540.6053 C 260.42099,540.93726 252.42203,536.88947 242.05768,527.34768 C 230.81007,516.99275 234.25706,519.22552 224.22778,507.76415 C 204.91908,485.69834 197.31601,494.14229 186.30394,484.81994 z"
-       id="path10374"
-       style="fill:#eebe18;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.06473088;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 174.3533,483.6244 C 160.72034,472.13801 157.47525,463.94829 161.00966,458.17567 C 165.85832,450.25652 176.27874,452.67511 187.9628,442.17992 C 201.46429,430.05223 204.84175,415.74547 215.0112,412.05756 C 229.99346,406.62428 237.54687,412.67187 248.33442,413.29177 C 259.35118,413.92485 267.53388,403.23091 275.27781,403.34594 C 287.26405,403.52397 291.00545,411.59026 290.92083,425.49359 C 290.83837,439.04151 288.77809,456.1839 290.79288,485.45589 C 292.46936,510.01156 299.14111,535.94248 294.0058,547.38316 C 288.47443,559.70616 280.09174,564.12607 270.53992,564.43976 C 259.15051,564.81378 249.62469,562.95592 236.45987,548.85936 C 224.70241,536.26974 222.83983,531.69312 211.53941,518.7791 C 189.78347,493.9166 185.42139,492.4445 174.3533,483.6244 z"
-       id="path10372"
-       style="fill:#e69d08;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 233.95114,686.33884 C 217.39701,672.3908 213.40731,662.53377 217.67248,655.41374 C 223.52177,645.78646 236.39404,648.79198 250.58191,636.04774 C 266.97667,621.32118 270.89957,603.89552 283.28864,599.37964 C 301.47321,592.76379 310.77681,600.30887 323.88682,601.02931 C 337.26129,601.76898 347.0733,588.64915 356.51141,588.78883 C 371.06622,589.0045 375.56892,598.8233 375.46617,615.70602 C 375.36604,632.15716 372.85403,652.97303 375.30058,688.51779 C 377.33631,718.33556 385.41891,749.74483 379.18314,763.63716 C 372.46644,778.60089 362.33807,783.94531 350.73937,784.32622 C 336.9093,784.78039 325.34633,782.50242 309.3725,765.41228 C 295.08805,750.13231 292.87308,744.63265 279.15107,728.95125 C 252.73299,698.7609 247.40194,697.06272 233.95114,686.33884 C 233.95114,686.33884 233.95114,686.33884 233.95114,686.33884"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11586"
-       style="fill:#e69d08;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 234.15145,686.35888 C 217.62355,672.43212 213.54998,662.75085 217.75976,655.4399 C 223.52969,645.80724 236.78244,648.93369 250.94828,636.20924 C 267.31759,621.50554 270.90808,604.00983 283.35178,599.43202 C 301.49299,592.79302 311.02287,600.69518 324.13222,601.35541 C 337.48025,602.04071 347.04978,588.69557 356.53678,588.83503 C 371.069,589.04943 375.49067,598.89685 375.38808,615.75335 C 375.2881,632.17894 372.76129,652.9625 375.20404,688.45207 C 377.23661,718.22354 385.27215,749.44047 379.04606,763.31123 C 372.33979,778.25172 362.31988,783.5464 350.73919,783.92672 C 336.93059,784.38019 325.39322,782.06551 309.46632,765.05172 C 295.19042,749.8092 293.06445,744.42367 279.36374,728.76663 C 252.98668,698.62315 247.60131,697.09118 234.15145,686.35888 C 234.15145,686.35888 234.15145,686.35888 234.15145,686.35888"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11588"
-       style="fill:#e69d08;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 234.41084,686.38483 C 217.91689,672.48563 213.73472,663.03197 217.87279,655.47377 C 223.53994,645.83415 237.2854,649.11719 251.42271,636.41836 C 267.75905,621.74427 270.9191,604.15786 283.43355,599.49984 C 301.5186,592.83087 311.3415,601.19545 324.45001,601.7777 C 337.7638,602.39259 347.01933,588.75568 356.56963,588.89487 C 371.0726,589.10761 375.38934,598.99208 375.28696,615.81464 C 375.18718,632.20716 372.64119,652.94886 375.07902,688.36696 C 377.1075,718.07848 385.08211,749.04634 378.86855,762.88917 C 372.17579,777.79958 362.29633,783.02984 350.73896,783.40939 C 336.95817,783.86194 325.45394,781.49973 309.58782,764.5848 C 295.32299,749.39079 293.31226,744.15306 279.63914,728.52755 C 253.3152,698.44477 247.85948,697.12803 234.41084,686.38483 C 234.41084,686.38483 234.41084,686.38483 234.41084,686.38483"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11590"
-       style="fill:#e69e08;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 234.71801,686.41556 C 218.26427,672.54899 213.95348,663.36486 218.00664,655.51389 C 223.55208,645.86601 237.881,649.33449 251.98453,636.66601 C 268.28184,622.02698 270.93215,604.33315 283.53039,599.58016 C 301.54892,592.87569 311.71883,601.78786 324.82633,602.27777 C 338.09958,602.80929 346.98327,588.82687 356.60853,588.96572 C 371.07686,589.1765 375.26935,599.10486 375.16721,615.88722 C 375.06767,632.24057 372.49897,652.9327 374.93098,688.26618 C 376.95461,717.9067 384.85705,748.57962 378.65835,762.38937 C 371.98158,777.26414 362.26844,782.41812 350.73869,782.79677 C 336.99082,783.24824 325.52584,780.82974 309.73171,764.03188 C 295.47998,748.89531 293.60572,743.83261 279.96527,728.24443 C 253.70424,698.23354 248.16521,697.17167 234.71801,686.41556 C 234.71801,686.41556 234.71801,686.41556 234.71801,686.41556"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11592"
-       style="fill:#e69e08;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 235.06643,686.45041 C 218.6583,672.62087 214.20163,663.74246 218.15847,655.55939 C 223.56585,645.90215 238.55658,649.58097 252.62179,636.94691 C 268.87482,622.34766 270.94696,604.53199 283.64023,599.67126 C 301.58331,592.92652 312.14683,602.45982 325.25319,602.84499 C 338.48044,603.28193 346.94236,588.90761 356.65266,589.04608 C 371.0817,589.25465 375.13324,599.23278 375.03138,615.96954 C 374.93211,632.27846 372.33766,652.91438 374.76306,688.15186 C 376.78119,717.71185 384.60178,748.05022 378.41992,761.82245 C 371.76129,776.65681 362.2368,781.72427 350.73838,782.10189 C 337.02786,782.55213 325.60739,780.06979 309.89491,763.40472 C 295.65804,748.3333 293.93859,743.46912 280.3352,727.92329 C 254.14551,697.99394 248.51199,697.22117 235.06643,686.45041 C 235.06643,686.45041 235.06643,686.45041 235.06643,686.45041"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11594"
-       style="fill:#e69f09;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 235.45168,686.48895 C 219.09399,672.70034 214.47601,664.15997 218.32634,655.60971 C 223.58108,645.94211 239.30358,649.85351 253.32643,637.25751 C 269.53049,622.70223 270.96332,604.75184 283.76168,599.77199 C 301.62135,592.98273 312.62008,603.20282 325.72517,603.47218 C 338.90157,603.80456 346.89713,588.99689 356.70145,589.13495 C 371.08705,589.34106 374.98274,599.37423 374.88118,616.06058 C 374.78222,632.32037 372.15929,652.89412 374.57738,688.02546 C 376.58944,717.4964 384.31952,747.46485 378.15628,761.1956 C 371.5177,775.98527 362.20182,780.95706 350.73803,781.33353 C 337.06882,781.78243 325.69757,779.22948 310.07536,762.71125 C 295.85493,747.71186 294.30664,743.0672 280.74423,727.5682 C 254.63343,697.72901 248.89544,697.2759 235.45168,686.48895 C 235.45168,686.48895 235.45168,686.48895 235.45168,686.48895"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11596"
-       style="fill:#e6a009;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 235.87053,686.53086 C 219.56768,672.78674 214.77432,664.61391 218.50886,655.66441 C 223.59763,645.98555 240.11574,650.14983 254.09252,637.5952 C 270.24336,623.08774 270.98112,604.99087 283.89372,599.88151 C 301.66269,593.04385 313.1346,604.01063 326.23832,604.15407 C 339.35944,604.37276 346.84796,589.09396 356.75449,589.23156 C 371.09286,589.435 374.81912,599.52802 374.71789,616.15955 C 374.61925,632.36592 371.96536,652.8721 374.37551,687.88803 C 376.38096,717.26216 384.01264,746.82842 377.86964,760.51407 C 371.25288,775.25516 362.16379,780.12293 350.73766,780.49817 C 337.11335,780.94558 325.79562,778.31588 310.27156,761.95729 C 296.069,747.03623 294.7068,742.63023 281.18894,727.18214 C 255.16392,697.44097 249.31233,697.33541 235.87053,686.53086 C 235.87053,686.53086 235.87053,686.53086 235.87053,686.53086"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11598"
-       style="fill:#e7a10a;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 236.32048,686.57587 C 220.07653,672.87956 215.09477,665.10154 218.70493,655.72317 C 223.61542,646.03222 240.98819,650.46814 254.91549,637.95796 C 271.00915,623.50186 271.00023,605.24765 284.03556,599.99916 C 301.70711,593.1095 313.68733,604.87841 326.78957,604.88659 C 339.85129,604.98315 346.79513,589.19823 356.81147,589.33535 C 371.0991,589.53592 374.64335,599.69322 374.54248,616.26586 C 374.44418,632.41486 371.75703,652.84844 374.15865,687.74039 C 376.157,717.01053 383.68298,746.14475 377.56173,759.78194 C 370.96839,774.47084 362.12294,779.22687 350.73726,779.60078 C 337.16118,780.04661 325.90094,777.33446 310.48232,761.14736 C 296.29896,746.31044 295.13667,742.16081 281.66667,726.76742 C 255.73379,697.13154 249.76017,697.39933 236.32048,686.57587 C 236.32048,686.57587 236.32048,686.57587 236.32048,686.57587"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11600"
-       style="fill:#e7a20a;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 236.79951,686.62379 C 220.61827,672.97838 215.43594,665.62069 218.91367,655.78573 C 223.63435,646.08191 241.91703,650.80702 255.79164,638.34416 C 271.82442,623.94274 271.02059,605.52102 284.18658,600.12441 C 301.7544,593.17939 314.27577,605.80228 327.37644,605.66645 C 340.37493,605.63299 346.73889,589.30924 356.87214,589.44584 C 371.10575,589.64337 374.45622,599.86909 374.35573,616.37905 C 374.25781,632.46697 371.53525,652.82325 373.92778,687.58322 C 375.91857,716.74264 383.33201,745.41689 377.23391,759.0025 C 370.66551,773.63584 362.07944,778.27291 350.73683,778.6454 C 337.21211,779.08955 326.01307,776.28962 310.7067,760.28509 C 296.54378,745.53774 295.59432,741.66106 282.17527,726.3259 C 256.34048,696.80212 250.23696,697.46738 236.79951,686.62379 C 236.79951,686.62379 236.79951,686.62379 236.79951,686.62379"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11602"
-       style="fill:#e7a30b;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 237.30595,686.67445 C 221.191,673.08285 215.79663,666.16954 219.13435,655.85187 C 223.65436,646.13444 242.89901,651.16529 256.71793,638.75246 C 272.68635,624.40885 271.0421,605.81003 284.34623,600.25683 C 301.8044,593.25328 314.89788,606.779 327.9969,606.49092 C 340.92854,606.32 346.67944,589.42661 356.93627,589.56266 C 371.11278,589.75696 374.25838,600.05503 374.15829,616.49872 C 374.06076,632.52205 371.30077,652.79661 373.6837,687.41705 C 375.66649,716.45942 382.96096,744.64739 376.88734,758.17846 C 370.34531,772.75306 362.03346,777.26436 350.73638,777.63536 C 337.26595,778.07772 326.13161,775.18499 310.94392,759.37348 C 296.8026,744.72083 296.07815,741.13272 282.71297,725.85911 C 256.98189,696.45385 250.74102,697.53933 237.30595,686.67445 C 237.30595,686.67445 237.30595,686.67445 237.30595,686.67445"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11604"
-       style="fill:#e7a40b;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 237.83839,686.72772 C 221.79314,673.19268 216.17583,666.74657 219.36636,655.92141 C 223.67541,646.18967 243.9314,651.54195 257.69177,639.18172 C 273.59252,624.89889 271.06472,606.11388 284.51408,600.39605 C 301.85696,593.33097 315.55193,607.80587 328.6492,607.35773 C 341.51056,607.04229 346.61693,589.55 357.0037,589.68547 C 371.12017,589.87638 374.05038,600.25052 373.95072,616.62453 C 373.85361,632.57996 371.05425,652.76862 373.42709,687.24236 C 375.40148,716.16166 382.57086,743.83838 376.52298,757.31212 C 370.00867,771.82496 361.98511,776.20403 350.7359,776.57346 C 337.32255,777.01395 326.25624,774.02365 311.19332,758.41507 C 297.07472,743.86198 296.58682,740.57725 283.27828,725.36836 C 257.65622,696.08771 251.27096,697.61497 237.83839,686.72772 C 237.83839,686.72772 237.83839,686.72772 237.83839,686.72772"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11606"
-       style="fill:#e8a60c;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 238.39561,686.78346 C 222.42331,673.30763 216.57269,667.35046 219.60917,655.99418 C 223.69743,646.24747 245.01185,651.93615 258.71094,639.63097 C 274.54088,625.41175 271.0884,606.43188 284.68974,600.54175 C 301.91197,593.41227 316.23643,608.88053 329.33187,608.26489 C 342.11968,607.7982 346.55151,589.67913 357.07427,589.814 C 371.1279,590.00136 373.8327,600.45511 373.73349,616.75619 C 373.63681,632.64057 370.79626,652.73931 373.15853,687.05953 C 375.12413,715.85003 382.1626,742.99172 376.14165,756.40544 C 369.65635,770.85365 361.93451,775.09435 350.73541,775.46213 C 337.38179,775.90066 326.38667,772.80825 311.45433,757.41204 C 297.3595,742.96315 297.11917,739.99592 283.8699,724.85477 C 258.36195,695.70451 251.82557,697.69414 238.39561,686.78346 C 238.39561,686.78346 238.39561,686.78346 238.39561,686.78346"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11608"
-       style="fill:#e8a70d;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 238.97656,686.84158 C 223.08032,673.42747 216.98645,667.98007 219.86232,656.07005 C 223.72039,646.30772 246.13832,652.34714 259.77351,640.09935 C 275.52962,625.94644 271.11308,606.76341 284.87288,600.69365 C 301.96932,593.49704 316.95008,610.00097 330.04362,609.21067 C 342.75474,608.5863 346.48331,589.81376 357.14784,589.94801 C 371.13597,590.13166 373.60576,600.66841 373.507,616.89347 C 373.41077,632.70376 370.52728,652.70876 372.87853,686.86891 C 374.83496,715.52514 381.73695,742.10899 375.74409,755.46016 C 369.28904,769.84098 361.88176,773.93741 350.73489,774.30348 C 337.44355,774.73996 326.52266,771.54109 311.72646,756.3663 C 297.65641,742.02605 297.6742,739.38984 284.48671,724.3193 C 259.09773,695.305 252.4038,697.77667 238.97656,686.84158 C 238.97656,686.84158 238.97656,686.84158 238.97656,686.84158"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11610"
-       style="fill:#e8a80d;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 239.58031,686.90198 C 223.7631,673.55202 217.41644,668.63438 220.12541,656.1489 C 223.74426,646.37035 247.30899,652.77425 260.87778,640.5861 C 276.55717,626.50211 271.13873,607.10796 285.06321,600.85151 C 302.02892,593.58513 317.69173,611.16537 330.78329,610.19357 C 343.41472,609.40533 346.41242,589.95368 357.22431,590.08727 C 371.14434,590.26707 373.3699,600.89008 373.27163,617.03612 C 373.17587,632.76943 370.24775,652.67702 372.58755,686.67081 C 374.53445,715.1875 381.29461,741.19163 375.33093,754.47778 C 368.90731,768.78857 361.82694,772.73507 350.73435,773.09936 C 337.50774,773.53371 326.66398,770.22421 312.00926,755.27953 C 297.96497,741.05217 298.251,738.75997 285.12773,723.76282 C 259.86239,694.88981 253.00472,697.86244 239.58031,686.90198 C 239.58031,686.90198 239.58031,686.90198 239.58031,686.90198"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11612"
-       style="fill:#e9aa0e;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 240.20602,686.96458 C 224.47073,673.68109 217.86208,669.3125 220.39807,656.23062 C 223.76899,646.43525 248.52225,653.2169 262.02223,641.09057 C 277.6221,627.07801 271.16531,607.46504 285.26047,601.01512 C 302.09069,593.67642 318.46036,612.37213 331.54987,611.21224 C 344.09871,610.25415 346.33896,590.09869 357.30355,590.2316 C 371.15303,590.40742 373.12547,601.11981 373.0277,617.18397 C 372.93242,632.83748 369.95805,652.64411 372.28598,686.46551 C 374.22301,714.83758 380.83617,740.24089 374.90273,753.45966 C 368.51169,767.69788 361.77013,771.48898 350.73379,771.85142 C 337.57426,772.28358 326.81045,768.85941 312.30235,754.15321 C 298.28476,740.04286 298.84878,738.10719 285.79207,723.1861 C 260.65486,694.45952 253.6275,697.95134 240.20602,686.96458 C 240.20602,686.96458 240.20602,686.96458 240.20602,686.96458"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11614"
-       style="fill:#e9ab0f;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 240.85296,687.0293 C 225.20236,673.81455 218.32283,670.01361 220.67997,656.31511 C 223.79456,646.50235 249.77666,653.67457 263.20549,641.61214 C 278.72314,627.67343 271.19279,607.83423 285.46441,601.18428 C 302.15455,593.77081 319.25506,613.61982 332.34245,612.26545 C 344.80589,611.13177 346.26301,590.24861 357.38548,590.38082 C 371.16201,590.55252 372.87275,601.35734 372.77549,617.33684 C 372.68071,632.90785 369.65852,652.61009 371.97419,686.25325 C 373.90101,714.47578 380.36218,739.25791 374.46001,752.40701 C 368.10265,766.57019 361.71139,770.20064 350.73321,770.56117 C 337.64304,770.99105 326.96188,767.44833 312.60538,752.9887 C 298.61539,738.99932 299.46684,737.43227 286.47895,722.58982 C 261.47421,694.01463 254.2714,698.04325 240.85296,687.0293 C 240.85296,687.0293 240.85296,687.0293 240.85296,687.0293"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11616"
-       style="fill:#e9ac0f;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 241.52044,687.09607 C 225.95722,673.95224 218.79822,670.737 220.97083,656.40228 C 223.82094,646.57159 251.0709,654.14677 264.42633,642.15028 C 279.85916,628.28776 271.22115,608.21515 285.67483,601.3588 C 302.22045,593.8682 320.075,614.90714 333.16021,613.3521 C 345.53554,612.03725 346.18465,590.4033 357.47001,590.53478 C 371.17127,590.70223 372.612,601.6024 372.51527,617.49456 C 372.42101,632.98045 369.34948,652.57499 371.65249,686.03424 C 373.56877,714.1025 379.87314,738.24371 374.00323,751.32093 C 367.68062,765.40669 361.65078,768.87138 350.73262,769.22994 C 337.714,769.65746 327.11812,765.99243 312.91804,751.7872 C 298.95652,737.92263 300.10453,736.73591 287.18763,721.97459 C 262.31959,693.55561 254.93576,698.13807 241.52044,687.09607 C 241.52044,687.09607 241.52044,687.09607 241.52044,687.09607"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11618"
-       style="fill:#eaae10;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 242.20786,687.16484 C 226.73462,674.09404 219.2878,671.48198 221.27037,656.49206 C 223.84811,646.64289 252.4038,654.63307 265.68362,642.70449 C 281.02909,628.92044 271.25036,608.60744 285.89154,601.53854 C 302.28831,593.9685 320.91943,616.2329 334.00238,614.47121 C 346.28698,612.96978 346.10395,590.5626 357.55706,590.69335 C 371.18081,590.85641 372.34346,601.85479 372.24728,617.65698 C 372.15356,633.05522 369.03121,652.53884 371.32118,685.80869 C 373.22662,713.71807 379.36949,737.19922 373.53281,750.20242 C 367.24599,764.20845 361.58836,767.50242 350.732,767.85895 C 337.78708,768.28406 327.27902,764.49306 313.24003,750.54983 C 299.30784,736.8138 300.76127,736.01876 287.91748,721.341 C 263.1902,693.08289 255.61995,698.23573 242.20786,687.16484 C 242.20786,687.16484 242.20786,687.16484 242.20786,687.16484"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11620"
-       style="fill:#eab011;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 242.91464,687.23555 C 227.53393,674.23984 219.79118,672.24796 221.57836,656.58436 C 223.87604,646.7162 253.77425,655.13307 266.97635,643.27431 C 282.232,629.57094 271.28038,609.01079 286.11435,601.72335 C 302.35808,594.07163 321.78765,617.59601 334.86828,615.62185 C 347.05959,613.92858 346.02097,590.72639 357.64657,590.85637 C 371.19062,591.01493 372.06736,602.11429 371.97174,617.82399 C 371.87856,633.13209 368.70397,652.50168 370.98054,685.57679 C 372.87483,713.3228 378.85165,736.1253 373.04914,749.05239 C 366.79912,762.97644 361.52419,766.09489 350.73137,766.44933 C 337.86222,766.87195 327.44446,762.95144 313.5711,749.27758 C 299.66906,735.67372 301.4365,735.2814 288.6679,720.68956 C 264.08535,692.59685 256.32342,698.33614 242.91464,687.23555 C 242.91464,687.23555 242.91464,687.23555 242.91464,687.23555"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11622"
-       style="fill:#eab111;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 243.64028,687.30814 C 228.35457,674.38953 220.30798,673.03437 221.89456,656.67913 C 223.90472,646.79147 255.18126,655.64642 268.30355,643.85934 C 283.46699,630.2388 271.31121,609.42489 286.34311,601.91308 C 302.42971,594.1775 322.67903,618.99549 335.75728,616.80319 C 347.8528,614.91296 345.93578,590.89456 357.73847,591.02375 C 371.20069,591.17769 371.78389,602.38071 371.68885,617.99545 C 371.59624,633.21102 368.36801,652.46352 370.63081,685.3387 C 372.51365,712.917 378.32,735.02274 372.55256,747.87169 C 366.34032,761.71156 361.4583,764.64982 350.73073,765.00212 C 337.93936,765.42218 327.61432,761.36869 313.91099,747.9714 C 300.03991,734.50323 302.12975,734.52438 289.43833,720.02073 C 265.00438,692.09784 257.04566,698.43923 243.64028,687.30814 C 243.64028,687.30814 243.64028,687.30814 243.64028,687.30814"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11624"
-       style="fill:#ebb312;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 244.38429,687.38257 C 229.19598,674.54301 220.83787,673.84069 222.21876,656.7763 C 223.93413,646.86864 256.6239,656.17276 269.66437,644.45918 C 284.73325,630.92357 271.34282,609.84948 286.57765,602.10762 C 302.50316,594.28606 323.59298,620.4304 336.6688,618.01444 C 348.66611,615.92226 345.84843,591.06698 357.83269,591.19537 C 371.21102,591.34456 371.49324,602.65388 371.39879,618.17125 C 371.30676,633.29195 368.02353,652.42439 370.27223,685.09458 C 372.14332,712.50092 377.77489,733.89225 372.04341,746.66108 C 365.86991,760.41466 361.39074,763.16815 350.73006,763.51825 C 338.01846,763.9357 327.78847,759.74587 314.2595,746.63215 C 300.42016,733.3031 302.84056,733.74818 290.22827,719.33497 C 265.94668,691.58619 257.78618,698.54493 244.38429,687.38257 C 244.38429,687.38257 244.38429,687.38257 244.38429,687.38257"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11626"
-       style="fill:#ebb413;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 245.14624,687.4588 C 230.05767,674.70019 221.38053,674.66645 222.55078,656.87581 C 223.96424,646.94767 258.10131,656.71178 271.05798,645.07347 C 286.03003,631.62484 271.37519,610.28431 286.81785,602.30685 C 302.57838,594.39723 324.52896,621.8999 337.60228,619.25488 C 349.49902,616.95589 345.75897,591.24356 357.92919,591.37112 C 371.22159,591.51546 371.19559,602.93363 371.10175,618.35129 C 371.01031,633.37482 367.67075,652.38433 369.905,684.84458 C 371.76407,712.0748 377.21664,732.73452 371.52199,745.4213 C 365.38815,759.0865 361.32156,761.65077 350.72938,761.99862 C 338.09946,762.41338 327.96683,758.08393 314.6164,745.26061 C 300.80957,732.07404 303.56849,732.95327 291.03725,718.63268 C 266.91169,691.06221 258.54456,698.65318 245.14624,687.4588 C 245.14624,687.4588 245.14624,687.4588 245.14624,687.4588"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11628"
-       style="fill:#ecb614;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 245.9257,687.53677 C 230.93918,674.86098 221.93567,675.5112 222.89044,656.97761 C 223.99505,647.02852 259.61269,657.2632 272.48364,645.7019 C 287.35663,632.34224 271.40831,610.72913 287.06358,602.51066 C 302.65533,594.51096 325.48646,623.40319 338.55723,620.52385 C 350.35108,618.01329 345.66746,591.42419 358.0279,591.55091 C 371.23241,591.69029 370.89109,603.21981 370.79787,618.53547 C 370.70704,633.4596 367.30987,652.34334 369.52933,684.58883 C 371.3761,711.6389 376.64555,731.55017 370.98858,744.15301 C 364.89532,757.7278 361.25078,760.0985 350.72869,760.44405 C 338.18232,760.85607 328.14928,756.38378 314.98151,743.85754 C 301.20793,730.81672 304.31317,732.14009 291.86484,717.91425 C 267.89889,690.52619 259.32037,698.76392 245.9257,687.53677 C 245.9257,687.53677 245.9257,687.53677 245.9257,687.53677"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11630"
-       style="fill:#ecb815;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 246.7223,687.61647 C 231.84006,675.02531 222.50302,676.37451 223.23756,657.08164 C 224.02654,647.11115 261.1573,657.82675 273.94064,646.34413 C 288.7124,633.07541 271.44215,611.18373 287.3147,602.71894 C 302.73397,594.62719 326.46501,624.93953 339.53317,621.82071 C 351.22186,619.09393 345.57394,591.6088 358.12878,591.73466 C 371.24347,591.86896 370.5799,603.51229 370.48732,618.7237 C 370.3971,633.54625 366.94104,652.30145 369.14541,684.32746 C 370.97961,711.1934 376.0619,730.33978 370.44344,742.85684 C 364.39166,756.33923 361.17845,758.5121 350.72798,758.8553 C 338.26701,759.26452 328.33574,754.64626 315.35465,742.42363 C 301.61505,729.53177 305.07421,731.30903 292.71061,717.18002 C 268.90779,689.97838 260.11323,698.87709 246.7223,687.61647 C 246.7223,687.61647 246.7223,687.61647 246.7223,687.61647"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11632"
-       style="fill:#edba16;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 247.53567,687.69784 C 232.75991,675.19309 223.08231,677.25601 223.59199,657.18787 C 224.05868,647.19552 262.73442,658.40216 275.42831,646.99989 C 290.09671,633.82402 271.47671,611.64791 287.57112,602.93162 C 302.81426,594.74587 327.46417,626.50821 340.52966,623.14488 C 352.11099,620.19733 345.47845,591.7973 358.23179,591.92227 C 371.25475,592.05139 370.26216,603.81092 370.17022,618.91589 C 370.08064,633.63471 366.56446,652.25868 368.75339,684.06059 C 370.57476,710.73853 375.46597,729.10391 369.88682,741.53337 C 363.87739,754.92142 361.1046,756.89231 350.72725,757.23311 C 338.35348,757.63946 328.52613,752.87215 315.73564,740.95952 C 302.03075,728.21975 305.85128,730.46047 293.5742,716.43033 C 269.93794,689.41904 260.92279,698.99264 247.53567,687.69784 C 247.53567,687.69784 247.53567,687.69784 247.53567,687.69784"
-       transform="matrix(0.822826,0,0,0.822826,-18.057616,-81.103963)"
-       id="path11634"
-       style="fill:#edbc17;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3.5;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline;filter:url(#filter12781)" />
-    <path
-       d="M 442.60048,430.93316 C 442.46535,408.4208 443.06834,391.80699 457.44733,391.84003 C 478.62094,391.88867 475.18619,407.25126 491.04533,408.62629 C 505.84363,409.90935 508.88819,403.64371 517.70599,407.05042 C 531.80202,412.49635 529.79152,421.69321 540.91887,428.01227 C 550.64463,433.5354 558.172,428.9011 564.79239,433.78409 C 572.61082,439.55071 572.07655,450.2065 565.40928,461.79126 C 558.55964,473.69289 546.03692,485.21057 528.17947,508.99149 C 513.18871,528.93173 503.99686,552.86649 491.14875,557.9946 C 478.00842,563.23935 465.86803,559.2658 458.13509,553.43213 C 449.80719,547.14963 441.62894,537.09867 442.2468,521.02195 C 442.87581,504.65532 443.50806,499.15792 443.40284,481.76532 C 443.20026,448.28052 442.68658,444.65446 442.60048,430.93316 z"
-       id="path4377"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#623c31;stroke-width:2.87989092;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <path
-       d="M 172.94026,484.4563 C 159.12239,472.81413 156.21004,463.38306 159.79239,457.53213 C 164.70682,449.50558 174.89182,451.95698 186.73436,441.31943 C 200.41897,429.02724 203.84224,414.52644 214.14962,410.78851 C 229.33509,405.28155 236.99095,411.41115 247.92481,412.03947 C 259.09099,412.68113 267.38469,401.84214 275.23365,401.95873 C 287.38246,402.13918 292.30488,411.06839 292.2191,425.1603 C 292.13553,438.89197 290.0473,456.26687 292.08943,485.93589 C 293.78864,510.82461 300.55088,536.73048 295.34592,548.32634 C 289.73953,560.81649 280.11287,565.67309 270.43149,565.99103 C 258.88761,566.37013 248.47906,561.09627 236.64272,550.19932 C 223.79767,538.37372 222.83795,532.80025 211.38426,519.71107 C 189.33324,494.51135 184.15848,493.39604 172.94026,484.4563 z"
-       id="path14076"
-       style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#623c31;stroke-width:2.87989092;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;display:inline" />
-    <flowRoot
-       id="flowRoot2866"
-       xml:space="preserve"
-       style="font-size:12px;font-style:normal;font-weight:normal;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans"><flowRegion
-         id="flowRegion2868"><rect
-           width="126.74098"
-           height="48.026676"
-           x="546.22021"
-           y="1151.1666"
-           id="rect2870" /></flowRegion><flowPara
-         id="flowPara2872">TuxTotem is a TradeMark of LinuxFest Northwest</flowPara></flowRoot>  </g>
-</svg>
diff --git a/web/images/Vexira_Antivirus_Logo.gif b/web/images/Vexira_Antivirus_Logo.gif
deleted file mode 100644
index 7c8b182b6..000000000
Binary files a/web/images/Vexira_Antivirus_Logo.gif and /dev/null differ
diff --git a/web/images/alz_logo2.gif b/web/images/alz_logo2.gif
deleted file mode 100644
index e800214ec..000000000
Binary files a/web/images/alz_logo2.gif and /dev/null differ
diff --git a/web/images/apache_pb1.gif b/web/images/apache_pb1.gif
deleted file mode 100644
index 65fb3506d..000000000
Binary files a/web/images/apache_pb1.gif and /dev/null differ
diff --git a/web/images/but3.png b/web/images/but3.png
deleted file mode 100644
index 25997e886..000000000
Binary files a/web/images/but3.png and /dev/null differ
diff --git a/web/images/cache_now.gif b/web/images/cache_now.gif
deleted file mode 100644
index 751f13384..000000000
Binary files a/web/images/cache_now.gif and /dev/null differ
diff --git a/web/images/clamav-logo.png b/web/images/clamav-logo.png
deleted file mode 100644
index ae37429fb..000000000
Binary files a/web/images/clamav-logo.png and /dev/null differ
diff --git a/web/images/compaq.gif b/web/images/compaq.gif
deleted file mode 100644
index 25047d94d..000000000
Binary files a/web/images/compaq.gif and /dev/null differ
diff --git a/web/images/courier-imap.png b/web/images/courier-imap.png
deleted file mode 100644
index a57e1708e..000000000
Binary files a/web/images/courier-imap.png and /dev/null differ
diff --git a/web/images/debian.jpg b/web/images/debian.jpg
deleted file mode 100644
index db62d7a03..000000000
Binary files a/web/images/debian.jpg and /dev/null differ
diff --git a/web/images/dyndns_anim2.gif b/web/images/dyndns_anim2.gif
deleted file mode 100644
index cdfd02f46..000000000
Binary files a/web/images/dyndns_anim2.gif and /dev/null differ
diff --git a/web/images/g2679.png b/web/images/g2679.png
deleted file mode 100644
index 8a457ccf5..000000000
Binary files a/web/images/g2679.png and /dev/null differ
diff --git a/web/images/gareth-davies-logo3.png b/web/images/gareth-davies-logo3.png
deleted file mode 100644
index 8a457ccf5..000000000
Binary files a/web/images/gareth-davies-logo3.png and /dev/null differ
diff --git a/web/images/gareth-davies-logo3_88x31.png b/web/images/gareth-davies-logo3_88x31.png
deleted file mode 100644
index 3e97e3b63..000000000
Binary files a/web/images/gareth-davies-logo3_88x31.png and /dev/null differ
diff --git a/web/images/j0213519.gif b/web/images/j0213519.gif
deleted file mode 100644
index ac0a94d1d..000000000
Binary files a/web/images/j0213519.gif and /dev/null differ
diff --git a/web/images/j0233056.gif b/web/images/j0233056.gif
deleted file mode 100644
index ee6bb6cc6..000000000
Binary files a/web/images/j0233056.gif and /dev/null differ
diff --git a/web/images/leaflogo.gif b/web/images/leaflogo.gif
deleted file mode 100644
index 11ad3c381..000000000
Binary files a/web/images/leaflogo.gif and /dev/null differ
diff --git a/web/images/leaflogo.jpg b/web/images/leaflogo.jpg
deleted file mode 100644
index 1238bbba3..000000000
Binary files a/web/images/leaflogo.jpg and /dev/null differ
diff --git a/web/images/linux_powered.gif b/web/images/linux_powered.gif
deleted file mode 100644
index a40d352f9..000000000
Binary files a/web/images/linux_powered.gif and /dev/null differ
diff --git a/web/images/logo-sm.jpg b/web/images/logo-sm.jpg
deleted file mode 100644
index 94a4c0112..000000000
Binary files a/web/images/logo-sm.jpg and /dev/null differ
diff --git a/web/images/logo2.png b/web/images/logo2.png
deleted file mode 100644
index 931d9eb7d..000000000
Binary files a/web/images/logo2.png and /dev/null differ
diff --git a/web/images/medbutton.png b/web/images/medbutton.png
deleted file mode 100644
index 50ba0efb2..000000000
Binary files a/web/images/medbutton.png and /dev/null differ
diff --git a/web/images/netfilterlogo.png b/web/images/netfilterlogo.png
deleted file mode 100644
index 99e9b93fd..000000000
Binary files a/web/images/netfilterlogo.png and /dev/null differ
diff --git a/web/images/new10.gif b/web/images/new10.gif
deleted file mode 100644
index 01c8c8769..000000000
Binary files a/web/images/new10.gif and /dev/null differ
diff --git a/web/images/newlog.gif b/web/images/newlog.gif
deleted file mode 100644
index e07218d63..000000000
Binary files a/web/images/newlog.gif and /dev/null differ
diff --git a/web/images/ninjalogo.png b/web/images/ninjalogo.png
deleted file mode 100644
index 64f9957d2..000000000
Binary files a/web/images/ninjalogo.png and /dev/null differ
diff --git a/web/images/obrasinf.gif b/web/images/obrasinf.gif
deleted file mode 100644
index 09bf635a0..000000000
Binary files a/web/images/obrasinf.gif and /dev/null differ
diff --git a/web/images/ol600_01mic.png b/web/images/ol600_01mic.png
deleted file mode 100644
index fdaec5aad..000000000
Binary files a/web/images/ol600_01mic.png and /dev/null differ
diff --git a/web/images/openlogo-nd-50.png b/web/images/openlogo-nd-50.png
deleted file mode 100644
index 411c9d964..000000000
Binary files a/web/images/openlogo-nd-50.png and /dev/null differ
diff --git a/web/images/openwrt.png b/web/images/openwrt.png
deleted file mode 100644
index 842c5698d..000000000
Binary files a/web/images/openwrt.png and /dev/null differ
diff --git a/web/images/opera.png b/web/images/opera.png
deleted file mode 100644
index e32c17472..000000000
Binary files a/web/images/opera.png and /dev/null differ
diff --git a/web/images/p1000221-600-800.jpg b/web/images/p1000221-600-800.jpg
deleted file mode 100644
index e5b20016d..000000000
Binary files a/web/images/p1000221-600-800.jpg and /dev/null differ
diff --git a/web/images/penguin_in_red_compaq_racer.gif b/web/images/penguin_in_red_compaq_racer.gif
deleted file mode 100644
index c850a9dbc..000000000
Binary files a/web/images/penguin_in_red_compaq_racer.gif and /dev/null differ
diff --git a/web/images/penquin_in_blue_racer_sm2.gif b/web/images/penquin_in_blue_racer_sm2.gif
deleted file mode 100644
index e8e858e5c..000000000
Binary files a/web/images/penquin_in_blue_racer_sm2.gif and /dev/null differ
diff --git a/web/images/postfix-white.gif b/web/images/postfix-white.gif
deleted file mode 100644
index 16389b29e..000000000
Binary files a/web/images/postfix-white.gif and /dev/null differ
diff --git a/web/images/poweredby.png b/web/images/poweredby.png
deleted file mode 100644
index 616a8400f..000000000
Binary files a/web/images/poweredby.png and /dev/null differ
diff --git a/web/images/poweredbycompaqlog0.gif b/web/images/poweredbycompaqlog0.gif
deleted file mode 100644
index ff021ce67..000000000
Binary files a/web/images/poweredbycompaqlog0.gif and /dev/null differ
diff --git a/web/images/pure.jpg b/web/images/pure.jpg
deleted file mode 100644
index c1531ad3a..000000000
Binary files a/web/images/pure.jpg and /dev/null differ
diff --git a/web/images/pureftp-d.jpg b/web/images/pureftp-d.jpg
deleted file mode 100644
index c6f5e751b..000000000
Binary files a/web/images/pureftp-d.jpg and /dev/null differ
diff --git a/web/images/razor.gif b/web/images/razor.gif
deleted file mode 100644
index 1dfd32450..000000000
Binary files a/web/images/razor.gif and /dev/null differ
diff --git a/web/images/sf_logo_metal2.jpg b/web/images/sf_logo_metal2.jpg
deleted file mode 100644
index 2f9e8d05e..000000000
Binary files a/web/images/sf_logo_metal2.jpg and /dev/null differ
diff --git a/web/images/sflogo.png b/web/images/sflogo.png
deleted file mode 100644
index b2a9e99c5..000000000
Binary files a/web/images/sflogo.png and /dev/null differ
diff --git a/web/images/shorewall.jpg b/web/images/shorewall.jpg
deleted file mode 100644
index 0d70c605b..000000000
Binary files a/web/images/shorewall.jpg and /dev/null differ
diff --git a/web/images/shorewallicon.png b/web/images/shorewallicon.png
deleted file mode 100644
index cbd202d43..000000000
Binary files a/web/images/shorewallicon.png and /dev/null differ
diff --git a/web/images/small-picture.gif b/web/images/small-picture.gif
deleted file mode 100644
index d8c86fc1b..000000000
Binary files a/web/images/small-picture.gif and /dev/null differ
diff --git a/web/images/squidnow.gif b/web/images/squidnow.gif
deleted file mode 100644
index c026d12d7..000000000
Binary files a/web/images/squidnow.gif and /dev/null differ
diff --git a/web/images/totem350a.png b/web/images/totem350a.png
deleted file mode 100644
index a6191a48c..000000000
Binary files a/web/images/totem350a.png and /dev/null differ
diff --git a/web/images/washington.jpg b/web/images/washington.jpg
deleted file mode 100644
index 3b2a95694..000000000
Binary files a/web/images/washington.jpg and /dev/null differ
diff --git a/web/index.htm b/web/index.htm
deleted file mode 100644
index 1102d9d0a..000000000
--- a/web/index.htm
+++ /dev/null
@@ -1,22 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01
-Frameset//EN""http://www.w3.org/TR/html4/frameset.dtd">
-<html>
-<head>
-<title>Shoreline Firewall</title>
-<link rel="shortcut icon" href="favicon.ico"  type="image/x-icon" >
-<meta http-equiv="Content-Type" content="text/html;
-charset=UTF-8">
-<link href="/html.css" rel="stylesheet" type="text/css">
-</head>
-<frameset rows="114,*" cols="*" frameborder="no"
-border="1"framespacing="0">  <frame
-src="Banner.html" name="topFrame"scrolling="NO"
-noresize >
-<frameset cols="159,*" frameborder="no" border="0" framespacing="0">
-<frame src="Shorewall_index_frame.htm" name="contents">    <frame src="shorewall_index.htm"
-name="main">
-</frameset>
-</frameset>
-<noframes><body><p>This page uses frames, but your browser doesn't
-support them.</p></body></noframes>
-</html>
diff --git a/web/mailing_list.htm b/web/mailing_list.htm
deleted file mode 100644
index 5590cd965..000000000
--- a/web/mailing_list.htm
+++ /dev/null
@@ -1,124 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
-<html>
-<head>
-  <meta name="generator"
- content="HTML Tidy for Linux (vers 1st April 2002), see www.w3.org">
-  <meta http-equiv="Content-Language" content="en-us">
-  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
-  <meta name="GENERATOR" content="Microsoft FrontPage 5.0">
-  <meta name="ProgId" content="FrontPage.Editor.Document">
-  <title>Shorewall Mailing Lists</title>
-  <meta name="Microsoft Theme" content="none">
-</head>
-<body>
-<h1>Old Shorewall Mailing List Archives<br>
-</h1>
-<span style="font-weight: bold;">Tom Eastep</span><br>
-<br>
-Copyright � 2001-2005 Thomas M. Eastep<br>
-<br>
-<div>
-<div class="legalnotice">
-<p>Permission is granted to copy, distribute and/or modify this
-document under the terms of the GNU Free Documentation License, Version
-1.2 or any later version published by the Free Software Foundation;
-with no Invariant Sections, with no Front-Cover, and with no Back-Cover
-Texts. A copy of the license is included in the section entitled �<span
- class="quote"><a href="GnuCopyright.htm" target="_self">GNU Free
-Documentation License</a></span>�.</p>
-</div>
-</div>
-<div>
-<p class="pubdate">2005-08-14<br>
-</p>
-<hr style="width: 100%; height: 2px;">
-<h2>See the <a target="_top" href="http://shorewall.net/">Shorewall
-Website</a> for Shorewall information and documentation.</h2>
-<h2>Table of Contents</h2>
-<ul>
-  <li><a href="#Search">Search the List Archives</a></li>
-</ul>
-<ul>
-  <li>The Mailing List Archives<br>
-  </li>
-  <li
- style="list-style-type: none; list-style-image: none; list-style-position: outside;">
-    <ul>
-      <li><a href="#Users">Shorewall Users</a></li>
-      <li><a href="#Announce">Shorewall Announcements</a></li>
-      <li><a href="#Devel">Shorewall Development</a></li>
-      <li><a href="#Newbies">Shorewall Newbies (Closed)</a></li>
-    </ul>
-  </li>
-</ul>
-<hr style="width: 100%; height: 2px;">
-<h2 align="left"><a name="Search"></a>Old Mailing List Archives Search</h2>
-<table id="AutoNumber3"
- style="border-collapse: collapse; background-color: rgb(255, 255, 255); height: 40px;"
- cellpadding="0">
-  <tbody>
-    <tr>
-      <td style="vertical-align: middle;"><!-- Search Google -->
-      <center>
-      <form method="get" action="http://www.google.com/search"> <input
- name="ie" value="UTF-8" type="hidden"> <input name="oe" value="UTF-8"
- type="hidden"> <input name="as_sitesearch" value="lists.shorewall.net"
- type="hidden">
-        <table
- style="background-color: rgb(255, 255, 255); width: 631px; height: 59px;"
- border="0" cellspacing="0">
-          <tbody>
-            <tr>
-              <td><a href="http://www.google.com/"><img
- src="http://www.google.com/logos/Logo_40wht.gif" alt="Google"
- align="middle" border="0"></a> <input name="q" size="25"
- maxlength="255" value="" type="text"> <input name="btnG"
- value="Mailing List Archive Search by Google" type="submit"></td>
-            </tr>
-          </tbody>
-        </table>
-      </form>
-      </center>
-<!-- Search Google --> </td>
-    </tr>
-  </tbody>
-</table>
-<hr style="width: 100%; height: 2px;">
-<h2 align="left"><a name="Users"></a>Shorewall Users Mailing List
-Archives<br>
-</h2>
-<p align="left">The Shorewall Users Mailing list provides a way for
-users to get answers to questions and to report problems. Information
-of general interest to the Shorewall user community is also posted to
-this list.<br>
-</p>
-<p align="left">The list archives are at <a
- href="pipermail/shorewall-users"><span
- style="text-decoration: underline;">pipermail/shorewall-users</span></a>.</p>
-<hr style="width: 100%; height: 2px;">
-<h2 align="left"><a name="Announce"></a>Shorewall Announce Mailing List</h2>
-The list archives are at <a href="pipermail/shorewall-announce"><span
- style="text-decoration: underline;">pipermail/shorewall-announce</span></a>.
-<hr style="width: 100%; height: 2px;">
-<h2 align="left"><a name="Devel"></a>Shorewall Development Mailing List</h2>
-<p align="left">The list archives are at <a
- href="pipermail/shorewall-devel"><span
- style="text-decoration: underline;">pipermail/shorewall-devel</span></a>.<br>
-</p>
-<hr style="width: 100%; height: 2px;">
-<h2 align="left"><a name="Newbies"></a>Shorewall Newbies Mailing List
-(Closed)<br>
-</h2>
-This list previously provided a place where people who are new to
-Shorewall could get questions answered and could receive help with
-problems. It proved to be less that a success and has been discontinued.<br>
-<p align="left">The list archives are at <a
- href="http://lists.shorewall.net/pipermail/shorewall-newbies/index.html">
-pipermail/shorewall-newbies</a>.</p>
-<hr style="width: 100%; height: 2px;">
-<h2 align="left"><a name="Unsubscribe"></a>Frustrated by having to
-Rebuild Mailman to use it with Postfix?</h2>
-<p align="left"><a href="gnu_mailman.htm">Check out these instructions</a></p>
-</div>
-</body>
-</html>
diff --git a/web/oldnews.html b/web/oldnews.html
deleted file mode 100644
index 685f1a79a..000000000
--- a/web/oldnews.html
+++ /dev/null
@@ -1,9891 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
-<html>
-<head>
-  <title>Old News </title>
-</head>
-
-<body>
-<span style="font-weight: bold;">2007-02-10 Shorewall 3.2.9<br>
-</span> 
-<pre>Problems Corrected in 3.2.9<br><br>1)  While most distributions store the Shorewall Lite compiled program<br>    in /var/lib/shorewall-lite/, Shorewall includes features that allow<br>    that location to be changed on a per-distribution basis. The<br>    default for a particular distribution may be determined by the<br>    command "shorewall[-lite] show config".<br><br>        teastep@lists:~/shorewall/trunk$ shorewall show config<br>        Default CONFIG_PATH is /etc/shorewall:/usr/share/shorewall<br>        LITEDIR is /var/lib/shorewall-lite<br>        teastep@lists:~/shorewall/trunk$<br><br>    The LITEDIR setting is the location where the compiled script<br>    should be placed. Unfortunately, the "shorewall [re]load" command<br>    previously used the setting on the administrative system rather<br>    than the one from the firewall system so it was possible for that<br>    command to upload the compiled script to the wrong directory.<br><br>    To work around this problem, Shorewall now determines the LITEDIR<br>    setting on the firewall system and uses that setting for uploading<br>    the compiled script and its companion .conf file.<br><br>2)  Previously, IP ranges and ipset names were handled incorrectly in<br>    the last column of the maclist file with the result that run-time<br>    errors occured.<br><br>3)  The new SIP and H323 Netfilter helper modules were not being<br>    automatically loaded by Shorewall. They have now been added to the<br>    /usr/share/shorewall[-lite]/modules files.<br><br>Other Changes in 3.2.9<br><br>1)  Previously, 'ipsecnat' tunnels allowed AH traffic by default<br>    (unless 'isecnat:noah' was given). Given that AH is incompatible<br>    with nat-traversal, 'ipsecnat' now implies 'ipsecnat:noah'.<br><br>2)  A macro that handles SixXS has been contributed by Christian<br>    Roessner.<br><br>3)  It is rather difficult to code a 'params' file that assigns other<br>    than constant values such that it works correctly with Shorewall<br>    Lite. To work around this problem, a new EXPORTPARAMS option<br>    has been added to shorewall.conf. When EXPORTPARAMS=No, the<br>    'params' file is no longer copied to the compiler output.<br><br>    With EXPORTPARAMS=No, if you need to set environmental variables on<br>    the firewall system for use by your extension scripts, then do so<br>    in the init extension script.<br><br>    The default is EXPORTPARAMS=Yes to retain the current behavior. So<br>    if you are happy with the current behavior, you need make no change<br>    to your shorewall.conf file.<br></pre>
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;"></span><span>style="font-weight:
-bold;"&gt;2007-01-16 Shorewall 3.2.8<br>
-</span><span style="font-weight: bold;"></span> 
-<pre>Problems Corrected in 3.2.8<br><br>1)  The 'ash' shell produced an error when processing an entry with a<br>    log tag from /etc/shorewall/rules.<br><br>2)  If the file /etc/shorewall/init did not exist, then the compiler<br>    would incorrectly copy /usr/share/shorewall/init into the<br>    compiled script. /usr/share/shorewall/init is a symbolic link<br>    to the Shorewall init script (usually /etc/init.d/shorewall).<br><br>3)  Previously, "ipp2p:udp" was incorrectly rejected in the PROTO<br>    column of an action definition.<br><br>Other Changes in 3.2.8.<br><br>1)  New macros for network printing protocols have been added,<br>    courtesy of Tuomo Soini. Tuomo also provided a macro for TFTP.<br><br>    The print-oriented macros are:<br><br>        macro.IPP<br>        macro.Jetdirect<br>        macro.Printer<br></pre>
-<span style="font-weight: bold;"></span><span
-style="font-weight: bold;"></span> 
-<pre><span style="font-weight: bold;"></span></pre>
-<hr style="width: 100%; height: 2px;">
-<pre><span style="font-weight: bold;">2006-12-14 Shorewall 3.2.7</span><br></pre>
-<pre>Problems Corrected in 3.2.7<br><br>1)  Handling of saved ipsets in /etc/shorewall/ipsets is broken when<br>    used on a system running Shorewall Lite. If there is a file named<br>    'ipsets' on the CONFIG_PATH when the firewall script is compiled,<br>    then the compiled script attempts to restore the ipsets from that<br>    file (which may not exist on the firewall system).<br><br>2)  The 'try' command failed on systems whose /bin/sh is Busybox ash:<br><br>        /sbin/shorewall: export: 2158: Illegal option -n<br><br>3)  Previously, Shorewall has assumed that the root user is named<br>    'root'. Beginning with this release, the root user may have a<br>    different name. This required the addition of an '-r' option for<br>    the 'shorewall load' and 'shorewall reload' commands.<br><br>        [re]load [ -e ] [ -c ] [ -r &lt;root user&gt; ] [ &lt;dir&gt; ] system<br><br>    Example: shorewall reload -r foobar firewall<br><br>4)  On systems with a light-weight shell such as ash or dash for /bin/sh,<br>    the output of "shorewall show macros" was garbled.<br><br>Other Changes in 3.2.7<br><br>1)  Prior to this release, on firewall systems with Shorewall Lite<br>    installed, the local modules file is used to determine which kernel<br>    modules to load. Beginning with this release, if there is a<br>    'modules' file in the export directory when the firewall script is<br>    compiled, then that file will be copied into the compiled script<br>    and used on the firewall system.<br><br>2)  When syslogd is run with the -C option (which in some<br>    implementations causes syslogd to log to an in-memory circular<br>    buffer), /sbin/shorewall will now use the 'logread' command to read<br>    the log from that buffer. This is for combatibility with OpenWRT.<br><br>3)  Failures of the start, restart and restore commands are now logged<br>    using 'logger'. These failures are logged with the 'kern' facility <br>    and 'err' priority. As part of this change, normal state changes<br>    are now logged with the 'kern' facility and 'info' priority.<br></pre>
-<span style="font-weight: bold;"></span> 
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">2006-11-18 Shorewall 3.2.6<br>
-</span><span style="font-weight: bold;"></span> 
-<pre>Problems Corrected in 3.2.6.<br><br>1)  When using a light-weight shell (e.g., ash) with multiple<br>providers, the /etc/iproute2/rt_tables database may become corrupted.<br><br>2)  A startup error occurred when the LENGTH or TOS column was<br>    non-empty in /etc/shorewall/tcrules.<br><br>3)  A startup error resulted when whitespace as included in LOGFORMAT.<br><br>4)  Previously, when conntrack match support was not available, the<br>    'norfc1918' option on an interface or host group was incorrectly<br>    filtering IPSEC traffic whose source IP address was reserved by RFC<br>    1918.<br><br>5)  If a DNAT or REDIRECT rule was used where the effective policy<br>    between the source and final destination zones is ACCEPT, the ACCEPT<br>    part of the rule was not generated. This was intended as an<br>    optimizaiton but it could lead to confusing results if there was a<br>    DROP or REJECT rule following.<br><br>    This optimization has been removed. You may always use DNAT- and<br>    REDIRECT- to suppress generation of the ACCEPT rule.<br><br>6)  Shorewall[-lite] previously would return an error exit status to a<br>    "start" command where Shorewall was already running. It not returns<br>    a "success" status.<br><br>7)  The install.sh scripst have been corrected to work properly when <br>    used to create packages on Slackware and Arch Linux.<br><br>5)  A change in version 3.2.5 broke Mac Filtration in some<br>    cases. Result was:<br><br>      Setting up MAC Filtration -- Phase 1...<br>      iptables v1.3.6: policy match: invalid policy `--dir'<br>      Try `iptables -h' or 'iptables --help' for more information.<br>      ERROR: Command "/sbin/iptables -A eth1_fwd -s 0.0.0.0/0 -m state <br>             --state NEW -m policy --pol --dir in -j eth1_mac" Failed<br><br>6)  At VERBOSITY 1 and higher, the 'shorewall add' and 'shorewall<br>    delete' commands generated a fractured message. The message<br>    contents depended in the setting of IPSECFILE as follows:<br><br>    IPSECFILE=ipsec<br><br>        ipsec...<br><br>    IPSECFILE=zones<br><br>        IPSEC...<br><br>    The messages have been corrected and are only produced at VERBOSITY<br>    2 and higher as follows:<br><br>    IPSECFILE=ipsec<br><br>        Processing /etc/shorewall/ipsec...<br><br>    IPSECFILE=zones<br><br>        Processing IPSEC...<br><br>7)  Previously, when &lt;action&gt;:none appeared in a rule, the name of the<br>    action chain created was preceded by "%" and might have a one- or<br>    two-digit number appended. If both &lt;action&gt; and &lt;action&gt;:none<br>    appeared, then two chains were created. This has been corrected<br>    such that &lt;action&gt; and &lt;action&gt;:none are treated identically.<br><br>8)  If SAVE_IPSETS=Yes in shorewall.conf, the "shorewall[-lite] save"<br>    command produced error messages as follows:<br><br>       Dynamic Rules Saved<br>       Currently-running Configuration Saved to /var/lib/shorewall/restore<br>       grep: /var/lib/shorewall/restore-base: No such file or directory<br>       grep: /var/lib/shorewall/restore-base: No such file or directory<br>       Current Ipset Contents Saved to<br>       /var/lib/shorewall/restore-ipsets<br><br>9)  If BRIDGING=No in shorewall.conf, then an attempt to define a zone<br>    using ipsets fails as follows:<br><br>    ERROR: BRIDGING=Yes is needed for this zone definition: z eth0:+iset<br><br>Other Changes in 3.2.6.<br><br>1)  The "shorewall [re]load" command now supports a "-c" option.<br><br>    Example:<br><br>        shorewall reload -c gateway<br><br>    When -c is given, Shorewall will capture the capabilities of the<br>    remote system to a file named "capabilities" in the export<br>    directory before compiling the configuration.<br><br>    If the file "capabilities" does not currently exist in the <br>    export directory then "-c" is automatically assumed.<br><br>2)  If 0 (zero) is specified for the IN-BANDWIDTH in<br>    /etc/shorewall/tcdevices then no ingress qdisc will be created for<br>    the device.<br></pre>
-<span style="font-weight: bold;"></span> 
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">2006-10-28 Shorewall 3.2.5<br>
-</span><span style="font-weight: bold;"></span> 
-<pre>Problems Corrected in 3.2.5<br><br>1)  Entries such as the following in /etc/shorewall/masq generate a<br>    run-time error:<br><br>           eth0    eth1!192.168.1.12            206.124.146.176<br><br>    Omitting the exclusion (!192.168.1.12) avoids the error.<br><br>2)  Previously, the 'provider' portion of the packet mark was not being<br>    cleared after routing for traffic that originates on the firewall<br>    itself.<br><br>3)  In prior releases, it was not possible to mark an outgoing packet<br>    with a high mark (HIGH_ROUTE_MARKS=Yes) when the packet originated<br>    on the firewall itself.<br><br>4)  The detected capabilities were not displayed by 'shorewall dump'<br>    when the effective VERBOSITY was less than 2.<br><br>Other changes in 3.2.5<br><br>1)  For users whose kernel and iptables have Extended MARK Target<br>    support, it is now possible to logically AND or OR a value into the<br>    current packet mark by preceding the mark value (and optional mask)<br>    with an ampersand ("&amp;") or vertical bar ("|") respectively.<br><br>    Example: To logically OR the value 4 into the mark value for<br>    packets from 192.168.1.1:<br><br>    #MARK   SOURCE<br>    |4      192.168.1.1<br><br>2)  A new macro (macro.RDP) has been added for Microsoft Remote<br>    Desktop. This macro was contributed by Tuomo Soini.<br><br>3)  A new 'maclog' extension file has been added. This file is<br>    processed just before logging based on the setting of<br>    MACLIST_LOG_LEVEL is done. When the script is copyied at compile<br>    time, the CHAIN variable will contain the name of the chain where<br>    rules should be inserted. Remember that if you have specified<br>    MACLIST_TABLE=mangle, then your run_iptables commands should<br>    include "-t mangle".<br><br>4)  Beginning with this release, Shorewall and Shorewall lite will<br>    share the same change log and release notes.<br></pre>
-<span style="font-weight: bold;"></span> 
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">2006-10-6 Shorewall 3.0.9<br>
-</span><span style="font-weight: bold;"></span> 
-<pre>Problems corrected in 3.0.9<br><br>1)  When using a light-weight shell like ash or dash, "shorewall<br>    [re]start" fails when using the built-in traffic shaper. The error<br>    messages resemble these:<br><br>    local: 3: eth0:: bad variable name<br>    ERROR: Command "tc class add dev eth0 parent 1: classid 1:1 htb rate 800kbit mtu" Failed<br><br>2)  The output formating of the 'hits' command under BusyBox 1.2.0 has<br>    been corrected.<br><br>3)  In prior versions, setting 'mss=' in /etc/shorewall/zones did not<br>    affect traffic to/from the firewall zone. That has been corrected.<br><br>4)  Previously, using IP address ranges in the accounting file could<br>    cause non-fatal iptables errors during shorewall [re]start.<br><br>Other changes in 3.0.9<br><br>1)  It is now possible to use the special value 'detect' in the ADDRESS<br>    column of /etc/shorewall/masq. This allows you to specify SNAT (as<br>    opposed to MASQUERADE) without having to know the ip address of the<br>    external interface. Shorewall must be restarted each time that the<br>    external address (the address of the interface named in the<br>    INTERFACE column) changes.<br><br>2)  Experimental optimization for PPP devices has been added to the<br>    providers file. If you omit the GATEWAY column for a ppp device (or<br>    enter "-" in the column) then Shorewall will generate routes<br>    for the named INTERFACE that do not specify a gateway IP address<br>    (the peer address will be assumed).<br><br>3)  Normally, Shorewall tries to protect users from themselves by<br>    preventing PREROUTING and OUTPUT tcrules from being applied to<br>    packets that have been marked by the 'track' option in<br>    /etc/shorewall/providers.<br><br>    If you really know what you are doing and understand packet marking<br>    thoroughly, you can set TC_EXPERT=Yes in shorewall.conf and<br>    Shorewall will not include these cautionary checks.<br><br>4)  Previously, CLASSIFY tcrules were always processed out of the<br>    POSTROUTING chain. Beginning with this release, they are processed<br>    out of the POSTROUTING chain *except* when the SOURCE is<br>    $FW[:&lt;address&gt;] in which case the rule is processed out of the<br>    OUTPUT chain.<br></pre>
-<span style="font-weight: bold;"></span> 
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">2006-09-27 Shorewall 3.2.4<br>
-</span><span style="font-weight: bold;"></span> 
-<pre>Shorewall Problems corrected in 3.2.4<br><br>1)  Previously, the directory name in the command "shorewall start<br>    &lt;directory name&gt;" was being dropped by "/sbin/shorewall".<br><br>2)  Previous, when /usr/share/shorewall/xmodules had been copied to<br>    /etc/shorewall/modules, Shorewall was not looking in the correct<br>    directory for the "xt_..." modules. There are two parts to the fix:<br><br>    - The /usr/share/shorewall/xmodules file has been removed. The<br>      /usr/share/shorewall/modules file will now load all required<br>      modules regardless of which kernel version you are running.<br>    - The MODULESDIR option can now contain a colon-separated list of<br>      directories to search for modules with the default being:<br><br>      /lib/modules/$(uname -r)/kernel/net/ipv4/netfilter:/lib/modules/$(uname -r)/kernel/net/netfilter<br><br>3)  Rules in /etc/shorewall/tos which specify zones defined<br>    using entries in /etc/shorewall/hosts applied to all traffic<br>    to/from the zone interfaces (the bridge port, ipset or IP<br>    address(es) in the zone definition were ignored).<br><br>4)  Previously, 'shorewall-lite dump' did not report traffic shaping<br>    information even if TC_ENABLED was set to Yes or Internal in the<br>    shorewall.conf file used to compile the exported firewall script.<br><br>    To correct this problem, the firewall script must be recompiled and<br>    re-exported.<br><br>5)  Previously, errors during the compile phase were not reflected in<br>    the exit status of /sbin/shorewall. Thanks to Tuomo Soini for<br>    finding and correcting this problem.<br><br>Other Shorewall changes in 3.2.4<br><br>1)  Previously, scripts compiled for export (-e option) depended on<br>    /usr/share/shorewall-lite/functions in order to run correctly. This<br>    made it possible for a compiled script to be incompatible with the<br>    version of Shorewall Lite installed on a firewall system.<br><br>    Beginning with Shorewall 3.2.4, this dependency is removed such<br>    that version incompatibility between Shorewall and Shorewall Lite<br>    should not be a concern going forward.<br><br>2)  Two new macros have been added, courtesy of Tuomo Soini<br><br>        macro.Finger<br>        macro.Telnets<br><br>3)  The output of "shorewall show macros" has been enhanced to show<br>    macros in each directory in the CONFIG_PATH.<br><br>Shorewall Lite problems corrected in 3.2.4<br><br>1)  Previous, when /usr/share/shorewall-lite/xmodules had been copied to<br>    /etc/shorewall-lite/modules, Shorewall was not looking in the correct<br>    directory for the "xt_..." modules. There are two parts to the fix:<br><br>    - The /usr/share/shorewall-lite/xmodules file has been removed. The<br>      /usr/share/shorewall-lite/modules file will now load all required<br>      modules regardless of which kernel version you are running.<br>    - The MODULESDIR option can now contain a colon-separated list of<br>      directories to search for modules with the default being:<br><br>      /lib/modules/$(uname<br>      -r)/kernel/net/ipv4/netfilter:/lib/modules/$(uname<br>      -r)/kernel/net/netfilter<br><br>     /usr/share/shorewall-lite/modules contains a *lot* of modules. If<br>     you use module autoloading (which non-embedded Linux distributions<br>     do), then you can improve your "shorewall [re]start" time by<br>     trimming all but the helper modules from the file. To do that,<br>     create the file /etc/shorewall-lite/modules with the following<br>     entries:<br><br>        loadmodule ip_conntrack_amanda<br>        loadmodule ip_conntrack_ftp<br>        loadmodule ip_conntrack_irc<br>        loadmodule ip_conntrack_netbios_ns<br>        loadmodule ip_conntrack_pptp<br>        loadmodule ip_conntrack_tftp<br>        loadmodule ip_nat_amanda<br>        loadmodule ip_nat_ftp<br>        loadmodule ip_nat_irc<br>        loadmodule ip_nat_pptp<br>        loadmodule ip_nat_snmp_basic<br>        loadmodule ip_nat_tftp<br><br>Other Shorewall Lite changes in 3.2.4<br><br>None.<br></pre>
-<span style="font-weight: bold;"></span> 
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">2006-08-26 Shorewall 3.2.3<br>
-</span><span style="font-weight: bold;"></span> 
-<pre>Shorewall Problems Corrected in 3.2.3<br><br> 1)  A problem in 'install.sh' resulted in sandbox violations on<br>     Gentoo and, when Shorewall is installed using an RPM, the problem<br>     caused an incorrect copy of shorewall.conf to be installed in<br>     /usr/share/shorewall/configfiles/.<br><br> 2)  A typo in the functions file caused startup errors when the user's<br>     distribution did not support a true mktemp program (such as<br>     Bering Uclibc). Patch courtesy of C&Atilde;&copy;dric Schieli.<br><br> 3)  Several erroneous references to ip_addr_del() were made in<br>     /var/lib/shorewall/compiler and in the code that it generates.<br><br>     a) These should have been references to del_ip_addr()<br>     b) One of the calls also had an incorrect parameter list.<br><br> 4)  Previously, "shorewall check -e" would erroneously attempt to<br>     detect interfaces configured for traffic shaping.<br><br> 5)  SUBSYSLOCK functionality has been restored.<br><br> 6)  In prior versions, setting 'mss=' in /etc/shorewall/zones did not<br>     affect traffic to/from the firewall zone. That has been corrected.<br><br> 7)  When /sbin/shorewall was run under BusyBox ash, shell errors would<br>     occur if certain command options were given.<br><br> 8)  Previously, the 'optional' provider option did not detect the case<br>     where the interface was DOWN but still had a configured IP<br>     address. Shorewall was detecting such interfaces as UP and later<br>     'ip replace route' commands would fail.<br><br>     It should also be clarified that the 'optional' option is intended<br>     to detect cases where a provider interface is in a state that would<br>     cause 'shorewall [re]start' to fail; it is not intended to<br>     determine whether communication is possible using the interface.<br><br> 9)  Previously, the "shorewall add" command would fail with error<br>     messages indicating that the commands "chain_exists" and<br>     "verify_hosts_file" could not be found.<br><br> 10) Using earlier Shorewall versions, the following sequence of<br>     commands produced inconsistant results:<br><br>     a) shorewall [re] start<br>     b) Modify /etc/shorewall/tcdevices and/or /etc/shorewall/tcclasses<br>     c) shorewall refresh<br>     d) shorewall save<br>     e) shorewall restore (or reboot and shorewall start -f during boot<br>        up)<br><br>     After that series of commands, the state of traffic shaping was as<br>     it was after step a) rather than as it was after step c). The fix<br>     involved re-implementing 'shorewall refresh' as a compile/execute<br>     procedure similar to [re]start. While the entire configuration is<br>     recompiled, only ecn, blacklisting, tcrules and traffic control<br>     will be updated in the running configuration.<br><br> 11) DNAT rules generated under DETECT_DNAT_IPADDRS=Yes may have been<br>     incorrect with the result that the rules didn't work at all.<br><br> Other Shorewall changes in 3.2.3<br><br> 1)  A 'shorewall export' command has been added.<br><br>     shorewall export [ &lt;directory1&gt; ] [user@]&lt;system&gt;:[&lt;directory2&gt;]<br><br>     If &lt;directory1&gt; is omitted, then the current working directory is<br>     assumed.<br><br>     Causes the shorewall configuration in &lt;directory1&gt; to be compiled<br>     into a program called '&lt;directory1&gt;/firewall'. If compilation is<br>     successful, the '&lt;directory1&gt;/firewall' script is copied via scp<br>     to the specified &lt;system&gt;.<br><br>     Example:<br><br>         shorewall export admin@gateway:<br><br>     This command would compile the configuration in the current working<br>     directory then copy the 'firewall' (and 'firewall.conf') files to<br>     admin's home directory on system 'gateway'.<br><br> 2)  Normally, Shorewall tries to protect users from themselves by<br>     preventing PREROUTING and OUTPUT tcrules from being applied to<br>     packets that have been marked by the 'track' option in<br>     /etc/shorewall/providers.<br><br>     If you really know what you are doing and understand packet marking<br>     thoroughly, you can set TC_EXPERT=Yes in shorewall.conf and<br>     Shorewall will not include these cautionary checks.<br><br> 3)  Previously, CLASSIFY tcrules were always processed out of the<br>     POSTROUTING chain. Beginning with this release, they are processed<br>     out of the POSTROUTING chain *except* when the SOURCE is<br>     $FW[:&lt;address&gt;] in which case the rule is processed out of the<br>     OUTPUT chain.<br><br>     See the Migration Considerations section for further information.<br><br> 4)  Previously, if you specified 'detectnets' on an interface with a<br>     default route, Shorewall would ignore the default route with a<br>     warning message. This could lead to systems that were inaccessible<br>     from the net, even from systems listed in the 'routestopped' file.<br><br>     Specifying 'detectnets' on an interface with a default route now<br>     generates a fatal error.<br><br>Shorewall Lite problems corrected in 3.2.3<br><br>1)  A typo in /usr/share/shorewall-lite/functions caused startup errors<br>    on distributions like Bering Uclibc that don't have a true mktemp<br>    utility.<br><br>Other Shorewall Lite changes in 3.2.3<br><br>None.<br></pre>
-<span style="font-weight: bold;"></span> 
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">2006-08-10 Shorewall 3.2.2</span><br>
-<span style="font-weight: bold;"></span> 
-<pre>Problems corrected in 3.0.8<br><br>1)  If the 'upnp' interface option was specified on one or more<br>    interfaces but no forwardUPnP rule was included, the following<br>    diagnostic messages were issued:<br><br>        WARNING:Missing forwardUPnP rule (required by 'upnp' interface option on<br>                eth0)<br>        ERROR: Fatal error in find_logactionchain<br><br>    Given that the fatal error message is obscure if the first WARNING<br>    isn't noticed, the ERROR message has been eliminated with the<br>    result that Shorewall now starts but won't handle UPnP properly.<br><br>2)  If BRIDGING=No in shorewall.conf, then an entry in<br>    /etc/shorewall/hosts such as the following would result in an<br>    obscure failure of an iptables command:<br><br>    loc   br0:eth0<br><br>    Shorewall now detects this case and issues a more helpful error<br>    message:<br><br>    ERROR: BRIDGING=Yes is required for this zone definition: loc br0:eth0<br><br>3)  Users of the Multi-ISP feature may experience this error during startup:<br><br>    /usr/share/shorewall/firewall: line 1393: 20000 + (1 - 1) * 256 +<br>        $rulenum : syntax error: operand expected (error token is<br>        "$rulenum ")<br><br>4)  A more useful diagnostic is now given when a command fails during<br>    setup of traffic shaping.<br><br>5)  Shorewall now checks to see if devices in /etc/shorewall/tcdevices<br>    exist. If a device does not exist, a warning message is issued and<br>    that device's entries in /etc/shorewall/tcclasses are ignored. This<br>    applies to "shorewall start", "shorewall restart" and "shorewall<br>    refresh".<br><br>6)  It is now possible to exclude a single source MAC address using<br>    !&lt;MAC address&gt;. Previously, a startup error occurred.<br><br>7)  Shorewall would use the incorrect shell for compilation in the<br>    following case:<br><br>8)  Reporting of the "Mangle FORWARD Chain" capability was broken. While<br>    Shorewall correctly detected and used the capability, the output of<br>    "shorewall show capabilities" and "shorewall dump" showed the<br>    capability as "Not Available".<br><br>9)  Extension scripts for policy chains (chains with the word 'all' in<br>    their name) were not being run previously.<br><br>-Tom</pre>
-<span style="font-weight: bold;"></span> 
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">2006-07-24 End of support for Shorewall
-2.4<br>
-</span><span style="font-weight: bold;"></span> 
-<pre>Support for Shorewall 2.4 has ended. As always, we will try to help you<br>with your problems but I personally will not spend any time reading old<br>code trying to solve your problem and I will not provide patches for any<br>bugs found in versions earlier than 3.0.<br></pre>
-<span style="font-weight: bold;"></span> 
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">2006-07-21 Shorewall 3.2.1<br>
-</span><span style="font-weight: bold;"></span> 
-<pre>Problems Corrected in Shorewall 3.2.1:<br><br>1)  The output formatting of the 'hits' command under BusyBox 1.2.0 has<br>    been corrected.<br><br>2)  Shorewall no longer requires extended MARK support to use the 'track'<br>    provider option when HIGH_ROUTE_MARKS=No.<br><br>3)  The output of the 'hits' command was previously scrambled if<br>    /etc/services contained spaces as column delimiters rather than<br>    tabs.<br><br>4)  The /usr/share/shorewall/xmodules file was previously just a copy<br>    of /usr/share/shorewall/modules.<br><br>5)  The version number in the comments at the top of shorewall.conf has<br>    been corrected.<br><br>6)  The script generated when the -e option is given to the 'compile'<br>    command is  setting CONFIG_PATH to the value given in the remote<br>    firewall's shorewall.conf processed at compile time. This is<br>    generally incorrect and results in the inability to load any kernel<br>    modules on the firewall during 'shorewall-lite [re]start'.<br><br>Problems Corrected in Shorewall Lite 3.2.1:<br><br>1)  The output formatting of the 'hits' command under BusyBox 1.2.0 has<br>    been corrected.<br><br>2)  The output of the 'hits' command was previously scrambled if<br>    /etc/services contained spaces as column delimiters rather than<br>    tabs.<br><br>3)  The /usr/share/shorewall-lite/xmodules file was previously just a<br>    copy of /usr/share/shorewall-lite/modules.<br><br>4)  The version number in the comments at the top of shorewall.conf has<br>    been corrected.<br></pre>
-<span style="font-weight: bold;"></span> 
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">2006-07-19 Shorewall bridge/firewall support
-change upcoming<br>
-</span><span style="font-weight: bold;"></span> 
-<pre><tt>I regret to announce that Shorewall bridge/firewall support in its</tt><br><tt>current form (BRIDGING=Yes in shorewall.conf) is going away. I will</tt><br><tt>retain the code in Shorewall for the foreseeable future but users</tt><br><tt>migrating to new kernels coming out next year will find that their</tt><br><tt>current bridge configurations no longer work. Shorewall bridge/firewall</tt><br><tt>users upgrading to more immediate new kernel releases (possibly as early</tt><br><tt>as 2.6.18) will find Netfilter warning messages appearing in their</tt><br><tt>kernel log when Shorewall [re]starts.</tt><br><br><tt>The reason that this support is going away is that the underlying</tt><br><tt>Netfilter feature that BRIDGING=Yes depends on (physdev match) is being</tt><br><tt>reduced in scope to the point that it will no longer be possible to use</tt><br><tt>that feature for Shorewall zone definition. There is a significant list</tt><br><tt>of pending Netfilter bug reports than cannot be resolved so long as</tt><br><tt>'physdev match' works the way that it does today.</tt><br><br><tt>While 'physdev match' was a great idea in terms of the function that it</tt><br><tt>provides, it appears impossible to implement that function without</tt><br><tt>breaking other parts of the greater Linux IP stack; in short, 'physdev</tt><br><tt>match' in its current form should never have been released in the first</tt><br><tt>place.</tt><br><br><tt>So -- what can current Shorewall bridge/firewall users do? </tt><br><tt>-----------------------------------------------------------------------</tt><br><tt>a) Configure Shorewall as if you have a simple bridge</tt><br><tt>(<a href="http://www.shorewall.net/SimpleBridge.html">http://www.shorewall.net/SimpleBridge.html</a>) and use ebtables to filter</tt><br><tt>traffic in and out of the individual bridge ports.</tt><br><br><tt>b) Configure Shorewall so that you specifically enumerate the IP</tt><br><tt>addresses of the hosts connected to all but one of the bridge ports.</tt><br><br><tt>Example where br0 connects to 192.168.1.0/24:</tt><br><br><tt>/etc/shorewall/shorewall.conf</tt><br><br><tt>BRIDGING=&lt;doesn't matter&gt;</tt><br><br><tt>/etc/shorewall/zones</tt><br><br><tt>z1 ipv4</tt><br><tt>z2 ipv4</tt><br><br><tt>/etc/shorewall/interfaces</tt><br><br><tt>- br0 detect&nbsp;routeback</tt><br><br><tt>/etc/shorewall/hosts:</tt><br><br><tt>z1 br0:192.168.1.1-192.168.1.15,192.168.1.18,...</tt><br><tt>z2&nbsp;br0:192.168.1.0/24</tt><br><br><tt>In other words, explicitly specify the hosts in the first zone listed</tt><br><tt>in /etc/shorewall/zones (z1 in the above example) then simply specify</tt><br><tt>the entire network for the second zone. If the second zone contains your</tt><br><tt>default gateway, then you would enter 0.0.0.0/0 rather than</tt><br><tt>192.168.1.0/24.</tt><br><br><tt>I will expand these instructions into an article on the web site just as</tt><br><tt>soon as I find the time.</tt><br><br><tt>c) If you have ipset support, you can take the same approach as in b)</tt><br><tt>above but define 'z1' using one or more ipsets rather than with an</tt><br><tt>explicit lists of network/host IP addresses. That will generally result</tt><br><tt>in a smaller ruleset.</tt><br><tt>-----------------------------------------------------------------------</tt><br><tt>I realize that the options available to you are more cumbersome to</tt><br><tt>configure and maintain than what you have today but at the moment, I see</tt><br><tt>no alternatives. I will however continue to ponder the problem, and if I</tt><br><tt>come up with something better I will let you know.</tt><br><br><tt>-Tom</tt></pre>
-<span style="font-weight: bold;"></span> 
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">2006-07-11 Shorewall 3.2.0<br>
-</span><span style="font-weight: bold;"></span> 
-<pre>New Features:<br><br>1)  Shorewall has always been very noisy (lots of messages). No longer.<br><br>    You set the default level of verbosity using the VERBOSITY option in<br>    shorewall.conf. If you don't set it (as would be the case if you use your<br>    old shorewall.conf file) then VERBOSITY defaults to a value of 2 which<br>    results in behavior compatible with previous Shorewall versions.<br>    A value of 1 suppresses some of the output (like the old -q option did)<br>    while a value of 0 makes Shorewall almost silent. A value of -1<br>    suppresses all output except warning and error messages.<br><br>    The value specified in the 3.2 shorewall.conf is 1. So you can make<br>    Shorewall as verbose as previously using a single -v and you can make it<br>    almost silent by using a single -q.<br><br>    If VERBOSITY is set at 2, you can still make a command nearly<br>    silent by using two "q"s (e.g., shorewall -qq restart).<br><br>    In summary, each "q" subtracts one from VERBOSITY while each "v" adds one<br>    to VERBOSITY.<br><br>    The "shorewall show log", "shorewall logwatch" and "shorewall dump"<br>    commands require VERBOSITY to be greater than or equal to 3 to<br>    display MAC addresses.This is consistent with the previous<br>    implementation which required a single -v to enable MAC display but<br>    means that if you set VERBOSITY=0 in shorewall.conf, then you will<br>    need to include -vvv in commands that display log records in order<br>    to have MACs displayed.<br><br>    To make the display of MAC addresses less cumbersome, a '-m' option has<br>    been added to the "show" and logwatch commands:<br><br>        shorewall show -m log<br>        shorewall logwatch -m<br><br>2)  A new 'shorewall compile' command has been added.<br><br>     shorewall compile [ -e ] [ &lt;config directory&gt; ] &lt;script file&gt;<br><br>    where:<br><br>        -e                    Allows the generated script to run<br>                              on a system with Shorewall Lite installed.<br>                              Generates an error if the configuration uses<br>                              an option that would prevent the generated<br>                              script from running on a system other than<br>                              where the 'compile' command is running (see<br>                              additional consideration a) below).<br><br>        &lt;config directory&gt;    Is an optional directory to be searched for<br>                              configuration files prior to those listed<br>                              in CONFIG_DIR in<br>                              /etc/shorewall/shorewall.conf.<br><br>        &lt;script file&gt;         Is the name of the output file.<br><br>    The 'compile' command processes the configuration and generates a<br>    script file which may then be executed to configure the firewall.<br><br>    The generated script supports the following commands:<br><br>        start -   starts the firewall<br>        stop  -   stops the firewall<br>        clear -   clears the firewall (removes all iptables rules)<br>        restart - restarts the firewall<br>        status  - displays the firewall status<br>        version - displays the version of shorewall used to create the<br>                  script<br><br>    The generated script contains error checking and will terminate if an<br>    important command fails. Before terminating:<br><br>    a) The script will check for the existence of the restore script<br>       specified by the RESTOREFILE variable in shorewall.conf. If that<br>       restore script exists, it is executed.<br><br>    b) If the restore script doesn't exist but Shorewall appears to be<br>       installed on the system, the equivalent of an<br>       "/sbin/shorewall stop" command is executed.<br><br>    Some additional considerations:<br><br>    a) When you run 'compile' on one system and then run the generated script<br>       on another system under Shorewall Lite, there are certain limitations.<br><br>       1) A compatible version of Shorewall Lite must be running on the remote<br>          system. Going forward, the goal is that any minor version of<br>          the current major version will be compatible. So if the<br>          program is compiled using Shorewall 3.2.x, any 3.2.y version<br>          or 3.p.q version (where p &gt; 2) of Shorewall Lite will be compatible.<br>       2) The 'detectnets' interface option is not allowed.<br>       3) DYNAMIC_ZONES=Yes is not allowed.<br>       4) You must supply the file /etc/shorewall/capabilities to provide<br>          the compiler with knowledge of the capabilities of the system<br>          where the script is to be run. See below.<br>       5) If your /etc/shorewall/params file contains code other than simple<br>          assignment statements with contant values, then you should move<br>          that code to /etc/shorewall/init. That way, the code will be<br>          executed on the target system when the compiled script is run and<br>          not on the local system at compile time.<br><br>    b) If you run the "shorewall compile" or "shorewall check" commands under<br>       a user other than 'root', then you must supply<br>       /etc/shorewall/capabilities.<br><br>    c) To aid in building /etc/shorewall/capabilities, a 'shorecap' program<br>       is provided in the Shorewall Lite package and is installed in<br>       /usr/share/shorewall-lite/shorecap when you install Shorewall Lite.<br><br>       For instructions about running shorecap, see the comments at the<br>       top of the program file (it's a simple shell script).<br><br>    The "shorewall start" and "shorewall restart" commands have been<br>    rewritten to use compilation. They both compile a temporary program<br>    then run it. This results in a slightly longer elapsed time than the<br>    similar commands required under earlier versions of Shorewall but new<br>    connections are blocked for a much smaller percentage of that time.<br><br>    If an error is found during the compilation phase, /sbin/shorewall<br>    terminates and the Shorewall state is unchanged.<br><br>    Under Shorewall 3.1.5, "shorewall restart" takes roughly 16.5 seconds<br>    on my firewall:<br><br>        real    0m16.599s<br>        user    0m6.292s<br>        sys     0m9.885s<br><br>    Of the elapsed 16.5 seconds, new connections are disabled less than<br>    3.5 seconds. Here are some numbers for comparison:<br><br>    A) shorewall restart (Shorewall 3.0.4)<br><br>        real &nbsp; &nbsp;0m17.540s<br>        user &nbsp; &nbsp;0m5.956s<br>        sys &nbsp; &nbsp; 0m10.737s<br><br>    B) ./foo restart # foo created using "shorewall compile"<br><br>        real    0m3.297s<br>        user    0m1.444s<br>        sys     0m1.728s<br><br>    C) shorewall restore (Shorewall 3.0.4) # Restores from file generated by<br>                                           # "shorewall save"<br><br>        real &nbsp; &nbsp;0m1.164s<br>        user &nbsp; &nbsp;0m0.556s<br>        sys &nbsp; &nbsp; 0m0.608s<br><br>    D) shorewall restore (shorewall 3.1.5)<br><br>        real    0m1.637s<br>        user    0m0.728s<br>        sys     0m0.584s<br><br>    The time difference between B and C reflects the difference between<br>    "iptables-restore" and multiple executions of "iptables". The time<br>    difference between C and D results from the fact that the "restore"<br>    command in Shorewall 3.1 runs the compiled program in a way that<br>    turns all iptables commands into no-ops then invokes<br>    iptables-restore. The system is a 1.4Ghz Celeron with 512MB RAM.<br><br>    As a final part of this change, the "check" command now compiles the<br>    current configuration and writes the compiled output to /dev/null. So<br>    "check" performs all of the same validation that compile does. Note that<br>    there is still no guarantee that the generated script won't encounter<br>    run-time errors.<br><br>2)  The /etc/shorewall/maclist file has a new column layout. The first column<br>    is now DISPOSITION. This column determines what to do with matching<br>    packets and can have the value ACCEPT or DROP (if MACLIST_TABLE=filter, it<br>    can also contain REJECT). This change is upward compatible so your existing<br>    maclist file can still be used.<br><br>    ACCEPT, DROP and REJECT may be optionally followed by a log level to<br>    cause the packet to be logged.<br><br>4)  In macro files, you can now use the reserved words SOURCE and DEST<br>    in the columns of the same names. When Shorewall expands the<br>    macro, it will substitute the SOURCE from the macro invocation for<br>    SOURCE and the DEST from the invocation for DEST. This allows you<br>    to write macros that act in both directions (from source to destination<br>    and from destination to source).<br><br>    Example:<br><br>        macro.FOO:<br><br>            PARAM      SOURCE        DEST      udp     500<br>            PARAM      DEST          SOURCE    udp     500<br><br>        /etc/shorewall/rules:<br><br>            FOO/ACCEPT    fw         net<br><br>        Resulting rules:<br><br>            ACCEPT        fw         net        udp     500<br>            ACCEPT        net        fw         udp     500<br><br>    This new feature has been used to implement the SMBBI macro.<br>    SMBBI is the same as the SMB macro with the exception that<br>    it passes SMB traffic in both directions whereas SMB only<br>    passes that traffic in one direction.<br><br>5)  In the /etc/shorewall/rules file and in actions, you may now specify<br>    'tcp:syn' in the PROTO column. 'tcp:syn' is equivalent to 'tcp' but also<br>    requires that the SYN flag is set and the RST, FIN and ACK flags be<br>    off ("--syn" is added to the iptables rule).<br><br>    As part of this change, Shorewall no longer adds the "--syn" option<br>    to TCP rules that specify QUEUE as their target.<br><br>6)  /sbin/shorewall now supports a "-t" option that causes all progress<br>    messages to be timestamped.<br><br>    Example (VERBOSITY=0 in shorewall.conf):<br><br>    gateway:/etc/shorewall # shorewall -t restart<br>    07:08:51 Compiling...<br>    07:09:05 Shorewall configuration compiled to /var/lib/shorewall/.restart<br>    07:09:05 Restarting Shorewall....<br>    07:09:08 done.<br>    gateway:/etc/shorewall #<br><br>7)  A 'refreshed' extension script has been added -- it is executed after<br>    "shorewall refresh" has finished.<br><br>8)  Two new dynamic blacklisting commands have been added:<br><br>        logdrop -- like 'drop' but causes the dropped packets to be logged.<br><br>        logreject -- like 'reject' but causes the rejected packets to be<br>                     logged.<br><br>    Packets are logged at the BLACKLIST_LOGLEVEL if one was specified at the<br>    last "shorewall [re]start"; otherwise, they are logged at the 'info'<br>    log level.<br><br>9)  A new IMPLICIT_CONTINUE option has been added to shorewall.conf. When<br>    this option is set to "Yes", it causes subzones to be treated differently<br>    with respect to policies.<br><br>    Subzones are defined by following their name with ":" and a list of parent<br>    zones (in /etc/shorewall/zones). Normally, you want to have a set of<br>    special rules for the subzone and if a connection doesn't match any of<br>    those subzone-specific rules then you want the parent zone rules and<br>    policies to be applied. With IMPLICIT_CONTINUE=Yes, that happens<br>    automatically.<br><br>    If IMPLICIT_CONTINUE=No or if IMPLICIT_CONTINUE is not set, then<br>    subzones are not subject to this special treatment.<br><br>    With IMPLICIT_CONTINUE=Yes, an implicit CONTINUE policy may be overridden<br>    by including an explicit policy (one that does not specify "all" in either<br>    the SOURCE or the DEST columns).<br><br>    Example:<br><br>    /etc/shorewall/zones:<br><br>        prnt       ipv4<br>        chld:prnt  ipv4<br><br>    Traffic to/from the 'chld' zone will first pass through the applicable<br>    'chld' rules and if none of those rules match then it will be passed through<br>    the appropriate 'prnt' rules. If the connection request does not match<br>    any of the 'prnt' rules then the relevant 'prnt' policy is applied.<br><br>    If you want the fw-&gt;chld policy to be ACCEPT, simply add this entry to<br>    /etc/shorewall/policy:<br><br>        $FW      chld        ACCEPT<br><br>    Traffic from all other zones to 'chld' will be subject to the implicit<br>    CONTINUE policy.<br><br>10) Shorewall now includes support for explicit routing rules when the<br>    /etc/shorewall/providers file is used. A new file,<br>    /etc/shorewall/route_rules can be used to add routing rules based on<br>    packet source and/or destination.<br><br>    The file has the following columns:<br><br>                SOURCE(optonal) An ip address (network or host) that<br>                                matches the source IP address in a packet.<br>                                May also be specified as an interface<br>                                name optionally followed by ":" and an<br>                                address. If the define 'lo' is specified,<br>                                the packet must originate from the firewall<br>                                itself.<br><br>                DEST(optional)  An ip address (network or host) that<br>                                matches the destination IP address in a packet.<br><br>                                If you choose to omit either SOURCE or DEST,<br>                                place "-" in the column. Note that you<br>                                may not omit both SOURCE and DEST.<br><br>                PROVIDER        The provider to route the traffic through.<br>                                May be expressed either as the provider name<br>                                or the provider number. You may also specify<br>                                the 'main' routing table here, either by<br>                                name or by number (254).<br><br>                PRIORITY<br>                                The rule's priority which determines the order<br>                                in which the rules are processed.<br><br>                                1000-1999   Before Shorewall-generated<br>                                            'MARK' rules<br><br>                                11000- 11999 After 'MARK' rules but before<br>                                            Shorewall-generated rules for<br>                                            provider interfaces.<br><br>                                26000-26999 After provider interface rules but<br>                                            before 'default' rule.<br><br>                                Rules with equal priority are applied in<br>                                the order in which they appear in the file.<br><br>    Example 1: You want all traffic coming in on eth1 to be routed to the ISP1<br>             provider:<br><br>            #PROVIDER   PRIORITY        SOURCE                  DEST<br>            ISP1        1000            eth1<br><br>    Example 2: You use OpenVPN (routed setup /tunX) in combination with multiple<br>               providers. In this case you have to set up a rule to ensure that<br>               the OpenVPN traffic is routed back through the tunX interface(s)<br>               rather than through any of the providers. 10.8.0.0/24 is the<br>               subnet choosen in your OpenVPN configuration (server 10.8.0.0<br>               255.255.255.0)<br><br>        #SOURCE                 DEST            PROVIDER        PRIORITY<br>        -                       10.8.0.0/24     main            1000<br><br>11) Prior to now, it has not been possible to use connection marking in<br>    /etc/shorewall/tcrules if you have a multi-ISP configuration that uses the<br>    'track' option.<br><br>    Beginning with this release, you may now set HIGH_ROUTE_MARKS=Yes in<br>    shorewall.conf to effectively divide the packet mark and connection mark<br>    into two 8-byte mark fields.<br><br>    When you do this:<br><br>        a) The MARK field in the providers file must have a value that is<br>           less than 65536 and that is a multiple of 256 (using hex<br>           representation, the values are 0x0100-0xFF00 with the low-order<br>           8 bits being zero).<br><br>        b) You may only set those mark values in the PREROUTING chain.<br><br>        c) Marks used for traffic shaping must still be in the range of 1-255<br>           and may still not be set in the PREROUTING chain.<br><br>        d) When you SAVE or RESTORE in tcrules, only the TC mark value is<br>           saved or restored. Shorewall handles saving and restoring the<br>           routing (provider) marks.<br><br>12) A TOS column has been added to /etc/shorewall/tcrules. This allows marking<br>    based on the contents of the TOS field in the packet header.<br><br>13) Beginning with this release, the way in which packet marking in the<br>    PREROUTING chain interracts with the 'track' option in /etc/shorewall/providers<br>    has changed in two ways:<br><br>    a)  Packets *arriving* on a tracked interface are now passed to the PREROUTING<br>        marking chain so that they may be marked with a mark other than the<br>        'track' mark (the connection still retains the 'track' mark).<br><br>    b)  When HIGH_ROUTE_MARKS=Yes, you can still clear the mark on packets<br>        in the PREROUTING chain (i.e., you can specify a mark value of zero).<br><br>14) Shorewall will now attempt to detect the MTU of devices listed in<br>    /etc/shorewall/tcdevices and will use the detected MTU in setting<br>    up traffic shaping.<br><br>15) In /etc/shorewall/rules, the values "all-" and "all+-" may now be<br>    used for zone names. "all-" means "All zones except the firewall";<br>    "all+-" means "All zones except the firewall" and intra-zone<br>    traffic is included.<br><br>16) Kernel version 2.6.16 introduces 'xtables', a new common packet<br>    filtering and connection tracking facility that supports both IPv4<br>    and IPv6. Because a different set of kernel modules must be loaded<br>    for xtables, Shorewall now includes two 'modules' files:<br><br>    a) /usr/share/shorewall/modules -- the former<br>    /etc/shorewall/modules<br><br>    b) /usr/share/shorewall/xmodules -- a new file that support<br>    xtables.<br><br>    If you wish to use the new file, then simply execute this command:<br><br>    cp -f /usr/share/shorewall/xmodules /etc/shorewall/modules<br><br>17) Shorewall now checks to see if devices in /etc/shorewall/tcdevices<br>    exist. If a device does not exist, a warning message is issued and<br>    that device's entries in /etc/shorewall/tcclasses are ignored. This<br>    applies to "shorewall start", "shorewall restart" and "shorewall<br>    refresh".<br><br>18) "load" and "reload" commands have been added. These commands allow<br>    a non-root user with ssh access to a remote system running<br>    Shorewall Lite to compile a firewall script on the local system and<br>    to install that script on the remote system.<br><br>    Syntax is:<br><br>           shorewall [re]load [ &lt;directory&gt; ] &lt;system&gt;<br><br>    If &lt;directory&gt; is omitted, the current working directory is<br>    assumed.<br><br>    The command is equivalent to:<br><br>    /sbin/shorewall compile -e &lt;directory&gt; firewall &amp;&amp;\<br>    scp firewall root@&lt;system&gt;:/var/lib/shorewall-lite/ &amp;&amp;\<br>    ssh root@&lt;system&gt; '/sbin/shorewall-lite [re]start' # Note 1<br><br>    In other words, the configuration in the specified (or defaulted)<br>    directory is compiled to a file called firewall in that<br>    directory. If compilation succeeds, then 'firewall' is copied to the<br>    (usually remote) &lt;system&gt; using scp. If the copy succeeds,<br>    Shorewall Lite on &lt;system&gt; is started or restarted via ssh (<br>    load causes Shorewall Lite to be started and 'reload' causes<br>    Shorewall Lite to be re-started)<br><br>    Note 1: In Shorewall Lite 3.2.0 RC4, the 'firewall' script has moved<br>    from /usr/share/shorewall-lite/ to /var/lib/shorewall-lite in<br>    packages from shorewall.net. The package maintainers for the<br>    various distributions are free to choose the directory where the<br>    script will be stored under their distribution by altering the<br>    value of LITEDIR in /usr/share/shorewall/configpath. You can run the<br>    "shorewall show config" command to see how your distribution<br>    defines LITEDIR.<br></pre>
-<span style="font-weight: bold;"></span> 
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">2006-06-21 Shorewall 3.0.8<br>
-</span><span style="font-weight: bold;"></span> 
-<pre>Problems corrected in 3.0.8<br><br>1)  If the 'upnp' interface option was specified on one or more<br>    interfaces but no forwardUPnP rule was included, the following<br>    diagnostic messages were issued:<br><br>        WARNING:Missing forwardUPnP rule (required by 'upnp' interface option on<br>                eth0)<br>        ERROR: Fatal error in find_logactionchain<br><br>    Given that the fatal error message is obscure if the first WARNING<br>    isn't noticed, the ERROR message has been eliminated with the<br>    result that Shorewall now starts but won't handle UPnP properly.<br><br>2)  If BRIDGING=No in shorewall.conf, then an entry in<br>    /etc/shorewall/hosts such as the following would result in an<br>    obscure failure of an iptables command:<br><br>    loc   br0:eth0<br><br>    Shorewall now detects this case and issues a more helpful error<br>    message:<br><br>    ERROR: BRIDGING=Yes is required for this zone definition: loc br0:eth0<br><br>3)  Users of the Multi-ISP feature may experience this error during startup:<br><br>    /usr/share/shorewall/firewall: line 1393: 20000 + (1 - 1) * 256 +<br>        $rulenum : syntax error: operand expected (error token is<br>        "$rulenum ")<br><br>4)  A more useful diagnostic is now given when a command fails during<br>    setup of traffic shaping.<br><br>5)  Shorewall now checks to see if devices in /etc/shorewall/tcdevices<br>    exist. If a device does not exist, a warning message is issued and<br>    that device's entries in /etc/shorewall/tcclasses are ignored. This<br>    applies to "shorewall start", "shorewall restart" and "shorewall<br>    refresh".<br><br>6)  It is now possible to exclude a single source MAC address using<br>    !&lt;MAC address&gt;. Previously, a startup error occurred.<br><br>7)  Shorewall would use the incorrect shell for compilation in the<br>    following case:<br><br>8)  Reporting of the "Mangle FORWARD Chain" capability was broken. While<br>    Shorewall correctly detected and used the capability, the output of<br>    "shorewall show capabilities" and "shorewall dump" showed the<br>    capability as "Not Available".<br><br>9)  Extension scripts for policy chains (chains with the word 'all' in<br>    their name) were not being run previously.<br></pre>
-<span style="font-weight: bold;"></span> 
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">2006-05-27 Shorewall 2.4.9<br>
-</span><span style="font-weight: bold;"></span> 
-<pre>Problems corrected in 2.4.9<br><br>1)  Updated the bogons file to reflect recent IANA allocations.<br><br>2)  If you use SAME or SAME:nodst in the ADDRESS column of /etc/shorewall/masq and<br>    if you set ADD_SNAT_ALIASES=Yes in shorewall.conf, then "shorewall start" will<br>    fail with the error 'Error: an inet prefix is expected rather than "SAME".'.<br><br>3)  It is now possible to exclude a single source MAC address using<br>    !&lt;MAC address&gt;. Previously, a startup error occurred.<br></pre>
-<span style="font-weight: bold;"></span> 
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">2006-05-06 Shorewall 3.0.7<br>
-</span> 
-<pre>Problems corrected in 3.0.7<br><br>1)  Previously, if your kernel did not supply the mangle table FORWARD chain<br>    then "shorewall [re]start" would fail. Now, if your mangle table does<br>    not supply this chain Shorewall will avoid using either that chain or<br>    the mangle table POSTROUTING chain. This change is strictly to stop Shorewall<br>    from blowing up during [re]start on very old kernels (such as 2.4.17<br>    running on a PS2); if your kernel does not support these chains and you<br>    try to mark packets in either of them using entries in<br>    /etc/shorewall/tcrules, [re]start will fail.<br><br>2)  Previously, if there were more than 10 IP addresses on a multi-ISP interface,<br>    some of the routing rules generated by Shorewall were placed after the<br>    default rule which resulted in them not being recognized.<br><br>3)  When install.sh is used to install on a Debian or Ubuntu system, the<br>    SUBSYSLOCK option in shorewall.conf was not being cleared.<br>    It will now be cleared, provided that Perl is installed on the system.<br><br>4)  When exclusion lists appeared in the /etc/shorewall/tcrules file, the<br>    resulting 'exclusion chains' (whose names begin with 'excl_') were not<br>    deleted as part of 'shorewall [re]start'. This meant that 'refresh'<br>    would fail, either the first or second time that it was done since<br>    the last 'shorewall [re]start'.<br><br>Other changes in 3.0.7<br><br>None.<br></pre>
-<!-- Shorewall Release 3.0.5 ENDS-->
-<!-- Shorewall moving to Subversion -->
-<span style="font-weight: bold;"></span> 
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">2006-03-28 Shorewall moved to Subversion <br>
-</span> 
-<pre> Effectively today, Shorewall source code repository was migrated to Subversion SCM.<br><br>Please read <a href="https://sourceforge.net/svn/?group_id=22587">https://sourceforge.net/svn/?group_id=22587 </a>
-and <a href="http://www.shorewall.net/download.htm#SVN"> http://www.shorewall.net/download.htm#SVN </a>
-for more information.</pre>
-<!-- Moving to Subversion ENDS -->
-<!-- Shorewall Release 3.0.5 -->
-<span style="font-weight: bold;"></span> 
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">2006-03-28 Shorewall 3.0.6<br>
-</span> 
-<pre>Problems corrected in 3.0.6<br><br>1)  A typo in the output of "help drop" has been corrected.<br><br>2)  Previously, 'shorewall start' would fail in the presence of a network<br>    interface named 'inet'.<br><br>3)  A shell syntax error was reported when duplicate policies appeared in<br>    /etc/shorewall/policy.<br><br>4)  The iptable_nat and iptable_mangle modules were previously omitted<br>    from /etc/shorewall/modules.<br><br>5)  If you use SAME or SAME:nodst in the ADDRESS column of /etc/shorewall/masq <br>    and if you set ADD_SNAT_ALIASES=Yes in shorewall.conf, then "shorewall <br>    start" will fail with the error 'Error: an inet prefix is expected rather <br>    than "SAME".'.<br><br>6)  Previously, the 'routeback' option was ignored in an entry in the<br>    /etc/shorewall/hosts file that referred to a (set of) bridge port(s).<br><br>    Example:<br><br>            dmz        xenbr0:vif+           routeback<br><br>Other changes in 3.0.6<br><br>1)  A 'refreshed' extension script has been added -- it is executed after<br>    "shorewall refresh" has finished.<br></pre>
-<!-- Shorewall Release 3.0.5 ENDS-->
-<!-- Shorewall Release 3.0.5 -->
-<span style="font-weight: bold;"></span> 
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">2006-02-10 Shorewall 3.0.5<br>
-</span> 
-<pre>Problems corrected in Shorewall 3.0.5<br><br>1)  Previously, if /etc/shorewall/ipsets existed, it was run when Shorewall starts<br>    but not when Shorewall was restored.<br><br>2)  When using the NETKEY IPSEC implementation in kernel 2.6 but without the<br>    policy match patch and the Netfilter/IPSEC patches, previously an<br>    entry in /etc/shorewall/tunnels was not sufficient in cases where:<br><br>    a) gw&lt;-&gt;gw traffic was encrypted<br>    b) The gw&lt;-&gt;gw policy through the tunnel was not ACCEPT<br><br>    Thanks to Tuomo Soini, this has been corrected. By simply including the<br>    remote VPN zone in the GATEWAY ZONE column for the tunnel's entry, no<br>    additional rules are required.<br><br>3)  Extra blank output lines are no longer produced by install.sh (patch<br>    courtesy of Tuomo Soini).<br><br>4)  TCP packets sent to QUEUE by rules in the ESTABLISHED section of the<br>    rules file previously didn't work (they had the "--syn" parameter<br>    added to them which resulted in a rule that no traffic would match).<br><br>    WARNING: If you use the QUEUE target from an action, Shorewall will<br>    still insert --syn if the protocol is tcp. So you don't want to<br>    invoke such an action from the ESTABLISHED section of the rules<br>    file.<br><br>5)  The description of the SOURCE column in /etc/shorewall/rules has been<br>    improved (patch courtesy of Ed Suominen).<br><br>6)  The 'allow', 'drop' and 'reject' commands no longer produce iptables<br>    errors when executed while Shorewall is not started.<br><br>7)  The spelling of "maximize-throughput" has been corrected in the code<br>    that implements tcclasses parsing. Patch courtesy of Paul Traina.<br><br>8)  Shorewall now generates the correct match for devices in<br>    /etc/shorewall/tcdevices that are actually bridge ports.<br><br>New Features in Shorewall 3.0.5<br><br>1)  The facilities available for dealing with the TOS field in<br>    /etc/shorewall/tcclasses has been expended. The OPTIONS field is now may<br>    contain a comma-separates list of the following:<br><br>        tos=0x&lt;value&gt;[/0x&lt;mask&gt;]        (mask defaults to 0xff)<br>                                        - this lets you define a classifier<br>                                        for the given &lt;value&gt;/&lt;mask&gt; combination<br>                                        of the IP packet's TOS/Precedence/DiffSrv<br>                                        octet (aka the TOS byte).  Please note,<br>                                        classifiers override all mark settings,<br>                                        so if you define a classifer for a class,<br>                                        all traffic having that mark will go in it<br>                                        regardless of any mark set on the packet<br>                                        by a firewall/mangle filter.<br><br>                                        NOTE: multiple tos= statements may be<br>                                        applied per class and per interface, but<br>                                        a given value/mask pair is valid for only<br>                                        ONE class per interface.<br><br>        tos-&lt;tosname&gt;                        - aliases for the following TOS octet<br>                                        value and mask encodings.  TOS encodings<br>                                        of the "TOS byte" have been deprecated in<br>                                        favor of diffserve classes, but programs<br>                                        like ssh, rlogin, and ftp still use them.<br><br>                                           tos-minimize-delay          0x10/0x10<br>                                        tos-maximize-throughput         0x08/0x08<br>                                        tos-maximize-reliability 0x04/0x04<br>                                        tos-minimize-cost         0x02/0x02<br>                                        tos-normal-service         0x00/0x1e<br><br>        tcp-ack                         -    defined causes an tc filter to<br>                                        be created that puts all tcp ack<br>                                        packets on that interface that have<br>                                        an size of &lt;=64 Bytes to go in this<br>                                        class. This is useful for speeding up<br>                                        downloads. Please note that the size<br>                                        of the ack packets is limited to 64<br>                                        bytes as some applications (p2p for<br>                                        example) use to make every packet an<br>                                        ack packet which would cause them<br>                                        all into here. We want only packets<br>                                        WITHOUT payload to match, so the size<br>                                        limit.<br><br>                                        NOTE: This option is only valid for<br>                                        ONE class per interface.<br><br>    Note that the semantics of 'tos-&lt;tosname&gt;' have changed slightly. Previously,<br>    these were tested using a mask of 0xff (example: tos-minimize-delay was<br>    equivalent to 0x10/0xff). Now each bit is tested individually.<br><br>    This enhancement is courtesy of Paul Traina.<br></pre>
-<span style="font-weight: bold;"></span> 
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">2006-01-05 Shorewall 3.0.4<br>
-</span> 
-<pre>Problems Corrected in 3.0.4<br><br>1) &nbsp;The shorewall.conf file is once again "console friendly". Patch is<br>&nbsp; &nbsp; courtesy of Tuomo Soini.<br><br>2) &nbsp;A potential security hole has been closed. Previously, Shorewall ACCEPTed<br>&nbsp; &nbsp; all traffic from a bridge port that was sent back out on the same port. If<br>&nbsp; &nbsp; the port was described in /etc/shorewall/hosts using the wildcard "+" (eg,<br>&nbsp; &nbsp; xenbr0:vif+), this could lead to traffic being passed in variance with the<br>&nbsp; &nbsp; supplied policies and rules.<br><br>3) &nbsp;Previously, an intra-zone policy of NONE would cause a startup error. That<br>&nbsp; &nbsp; problem has been corrected.<br><br>4) &nbsp;When RETAIN_ALIASES=Yes, the script produced by "shorewall save" did not<br>&nbsp; &nbsp; add the retained aliases. This means that the following sequence of<br>&nbsp; &nbsp; events resulted in missing aliases:<br><br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; shorewall start<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; shorewall restart<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; shorewall save<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; reboot<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; shorewall -f start (which is the default during boot up)<br><br>5) &nbsp;When a 2.x standard action is invoked with a log level (example<br>&nbsp; &nbsp; "AllowPing:info"), logging does not occur.<br><br>New Features in 3.0.4<br><br>1) &nbsp;By popular demand, the 'Limit' action described at<br>&nbsp; &nbsp; http://www1.shorewall.net/PortKnocking.html#Limit has been made a standard<br>&nbsp; &nbsp; action. Limit requires 'recent match' support in your kernel and iptables.<br><br>2) &nbsp;DISABLE_IPV6 no longer disabled local (loopback) IPV6 traffic. This<br>&nbsp; &nbsp; change is reported to improve Java startup time on some distributions.<br><br>3) &nbsp;Shorewall now contains support for wildcard ports. In<br>&nbsp; &nbsp; /etc/shorewall/hosts, you may specify the port name with trailing "+" then <br>&nbsp; &nbsp; use specific port names in rules.<br><br>&nbsp; &nbsp; Example:<br><br>&nbsp; &nbsp; /etc/shorewall/hosts<br><br>&nbsp; &nbsp; &nbsp; &nbsp; vpn &nbsp; &nbsp; &nbsp;br0:tap+<br><br>&nbsp; &nbsp; /etc/shorewall/rules<br><br>&nbsp; &nbsp; &nbsp; &nbsp; DROP &nbsp; &nbsp; &nbsp;vpn:tap0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;vpn:tap1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;udp &nbsp; &nbsp;9999<br><br>4) &nbsp;For the benefit of those who run Shorewall on distributions that don't <br>&nbsp; &nbsp; autoload kernel modules, /etc/shorewall/modules now contains load commands <br>&nbsp; &nbsp; for a wide range of Netfilter modules.<br></pre>
-<span style="font-weight: bold;"></span> 
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">2005-12-13 Shorewall 3.0.3<br>
-</span> 
-<pre>Problems Corrected in 3.0.3<br><br>1) The comments in the /etc/shorewall/shorewall.conf and<br>   /etc/shorewall/hosts files have been changed to clarify when<br>   BRIDGING=Yes is required when dealing with bridges.<br><br>2) Thanks to Tuomo Soini, formatting of the comments in the tcdevices<br>   and tcclasses files has been cleaned up.<br><br>3) Specifying 'trace' on the 'safe-start' and 'safe-restart' command no<br>   longer fails.<br><br>4) The output of "shorewall help restore" has been corrected. It previously<br>   printed incorrect syntax for that command.<br><br>5) The README.txt file in the tarball was stale and contained incorrect<br>   information. It has been corrected.<br><br>6) The shorewall.conf default setting of CLEAR_TC was previously "No". Given<br>   that the default setting of TC_ENABLED is "Internal", the setting of<br>   CLEAR_TC has been changed to the more appropriate value of "Yes".<br><br>7) Specifying an interface name in the SOURCE column of /etc/shorewall/tcrules<br>   resulted in a startup error.<br><br>8) When the 'install.sh' script is used on Debian, it now creates<br>   /var/log/shorewall-init.log. And if perl is installed on the system then<br>   STARTUP_ENABLED=Yes is specified in shorewall.conf (the user must still<br>   set startup=1 in /etc/default/shorewall).<br><br>New Features in 3.0.3 <br>
-
-1) A "shorewall show macros" command has been added. This command displays
-   a list of the standard macros along with a brief description of each.
-
-2) The '-q' option is now supported with 'safe-start' and 'safe-restart'.
-
-3) The value "-" is now allowed in the ADDRESS/SUBNET column of
-   /etc/shorewall/blacklist. That value is equivalent to specifying
-   0.0.0.0/0 in that column.
-
-4) The output of "shorewall show tc" and "shorewall show classifiers" is
-   now included in the output from "shorewall dump". This will aid us in
-   analyzing traffic shaping problems.
-
-5) You can now specify 'none' in the COPY column of /etc/shorewall/providers
-   to signal that you want Shorewall to only copy routes through the interface
-   listed in the INTERFACE column.
-
-   Note: This works on older versions of Shorewall as well. It is
-         now documented.
-
-6) An 'ipdecimal' command has been added to /sbin/shorewall. This command
-   converts between dot-quad and decimal.
-
-   Example:
-
-    gateway:/etc/openvpn# shorewall ipdecimal 192.168.1.4
-        3232235780
-    gateway:/etc/openvpn# shorewall ipdecimal 3232235780
-        192.168.1.4
-    gateway:/etc/openvpn#
-
-7) /etc/init.d/shorewall now supports a 'reload' command which is
-   synonymous with the 'restart' command.</pre>
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">2005-12-12 Shorewall 2.4.7</span><br>
-<br>
-Problems Corrected in 2.4.7<br>
-<br>
-1)&nbsp;&nbsp;When MACLIST_TABLE=mangle and an interface is enabled for DHCP
-(the<br>
-&nbsp;&nbsp;&nbsp; 'dhcp' option is specified in /etc/shorewall/interfaces)
-then broadcasts<br>
-&nbsp;&nbsp;&nbsp; on UDP port 67 to address 255.255.255.255 from address
-0.0.0.0 were being<br>
-&nbsp;&nbsp;&nbsp; dropped and logged. While this did not prevent the client
-from acquiring<br>
-&nbsp;&nbsp;&nbsp; an IP address, it could result in lots of log messages.<br>
-<br>
-2)&nbsp;&nbsp;Entries for openvpn tunnels (including openvpnclient and<br>
-&nbsp;&nbsp;&nbsp; openvpnserver) that specify a port but no protocol cause
-startup<br>
-&nbsp;&nbsp;&nbsp; errors as follows:<br>
-<br>
-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;iptables
-v1.3.3: unknown protocol `1194' specified<br>
-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Try
-`iptables -h' or 'iptables --help' for more information.<br>
-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ERROR:
-Command "/usr/sbin/iptables -A net2fw -p 1194 -s<br>
-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0.0.0.0/0
---sport 1194 -j ACCEPT" Failed<br>
-<br>
-&nbsp;&nbsp;&nbsp; The problem may be worked around by specifying the
-protocol as well<br>
-&nbsp;&nbsp;&nbsp; (e.g., "openvpn:udp:3455).<br>
-<br>
-3)&nbsp;&nbsp;If the previous firewall configuration included a policy other
-than<br>
-&nbsp;&nbsp;&nbsp; ACCEPT in the nat, mangle or raw tables then Shorewall
-would not set<br>
-&nbsp;&nbsp;&nbsp; the policy to ACCEPT. This could result in a ruleset that
-rejected or<br>
-&nbsp;&nbsp;&nbsp; dropped all traffic.<br>
-<br>
-4)&nbsp;&nbsp;Specifying an interface name in the SOURCE column <br>
-&nbsp;&nbsp;&nbsp; of /etc/shorewall/tcrules resulted in a startup error.<br>
-<span style="font-weight: bold;"></span> 
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;"></span><span
-style="font-weight: bold;">2005-12-01 End of Support for Shorewall versions
-2.0 and 2.2<br>
-<br>
-</span>Effective today, versions 2.0 and 2.2 are no longer supported. This
-means that if you find a bug in one of these releases, we won't fix it and if
-you ask for help with one of these releases, we will not spend much time
-trying to solve your issue.<br>
-
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">2005-11-25 Shorewall 3.0.2<br>
-</span> 
-<pre>Problems Corrected in 3.0.2<br><br>1) A couple of typos in the one-interface sample configuration have<br>   been corrected.<br><br>2) The 3.0.1 version of Shorewall was incompatible with old versions of<br>   the Linux kernel (2.4.7 for example). The new code ignores errors<br>   produced when Shorewall 3.x is run on these ancient kernels.<br><br>3) Arch Linux installation routines has been improved.<br><br>New Features in 3.0.2<br><br>1) A new Webmin macro has been added. This macro assumes that Webmin is<br>   running on its default port (10000).<br></pre>
-<span style="font-weight: bold;"></span> 
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">2005-11-18 Shorewall 3.0.1</span><br>
-
-<pre>Problems Corrected in 3.0.1 <br>
-
-1) If the previous firewall configuration included a policy other than
-   ACCEPT in the nat, mangle or raw tables then Shorewall would not set
-   the policy to ACCEPT. This could result in a ruleset that rejected or
-   dropped all traffic.
-
-2) The Makefile was broken such that 'make' didn't always work correctly.
-
-3) If the SOURCE or DEST column in a macro body was non-empty and a dash
-   ("-") appeared in the corresponding column of an invocation of that
-   macro, then an invalid rule was generated.
-
-4) The comments in the /etc/shorewall/blacklist file have been updated to
-   clarify that the PORTS column refers to destination port number/service
-   names.
-
-5) When CLAMPMSS is set to a value other than "No" and FASTACCEPT=Yes, the
-   order of the rules generated was incorrect causing RELATED TCP connections
-   to not have CLAMPMSS applied.
-
-New Features in 3.0.1
-
-1)  To make the macro facility more flexible, Shorewall now examines the
-    contents of the SOURCE and DEST columns in both the macro body and in
-    the invocation and tries to create the intended rule. If the value in
-    the invocation appears to be an address (IP or MAC) or the name of an
-    ipset, then it is placed after the value in the macro body. Otherwise,
-    it is placed before the value in the macro body.
-
-    Example 1:
-
-    /etc/shorewall/macro.foo:
-
-    PARAM        -            192.168.1.5      tcp    http
-
-    /etc/shorewallrules:
-
-    foo/ACCEPT   net          loc
-
-    Effective rule:
-
-    ACCEPT       net          loc:192.168.1.5   tcp   http
-
-    Example 2:
-
-    /etc/shorewall/macro.bar:
-
-    PARAM        net           loc              tcp    http
-
-    /etc/shorewall/rules:
-
-    bar/ACCEPT   -             192.168.1.5
-
-    Effective rule:
-
-    ACCEPT       net           loc:192.168.1.5  tcp    http</pre>
-
-<p></p>
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">11/11/2005 Shorewall 3.0.0</span><br>
-
-<pre>New Features in Shorewall 3.0.0<br><br>1) Error and warning messages are made easier to spot by using<br>   capitalization (e.g., ERROR: and WARNING:).<br><br>2) A new option 'critical' has been added to<br>   /etc/shorewall/routestopped. This option can be used to enable<br>   communication with a host or set of hosts during the entire<br>   "shorewall [re]start/stop" process. Listing a host with this option<br>   differs from listing it without the option in several ways:<br><br>   a) The option only affect traffic between the listed host(s) and the<br>   firewall itself.<br><br>   b) If there are any entries with 'critical', the firewall<br>   will be completely opened briefly during start, restart and stop but<br>   there will be no chance of any packets to/from the listed host(s)<br>   being dropped or rejected.<br><br>   Possible uses for this option are:<br><br>   a) Root file system is NFS mounted. You will want to list the NFS server<br>   in the 'critical' option.<br><br>   b) You are running Shorewall in a Crossbeam environment<br>   (www.crossbeam.com). You will want to list the Crossbeam interface<br>   in this option<br><br>3) A new 'macro' feature has been added.<br><br>   Macros are very similar to actions and can be used in similar<br>   ways. The differences between actions and macros are as follows:<br><br>   a) An action creates a separate chain with the same name as the<br>      action (when logging is specified on the invocation of an action,<br>      a chain beginning with "%" followed by the name of the action and<br>      possibly followed by a number is created). When a macro is<br>      invoked, it is expanded in-line and no new chain is created.<br><br>   b) An action may be specified as the default action for a policy;<br>      macros cannot be specified this way.<br><br>   c) Actions must be listed in either /usr/share/shorewall/actions.std<br>      or in /etc/shorewall/actions. Macros are defined simply by<br>      placing their definition file in the CONFIG_PATH.<br><br>   d) Actions are defined in a file with a name beginning with<br>      "action." and followed by the name of the action. Macro files are<br>      defined in a file with a name beginning with "macro.".<br><br>   e) Actions may invoke other actions. Macros may not directly invoke<br>      other macros although they may invoke other macros indirectly<br>      through an action.<br><br>   f) DNAT[-] and REDIRECT[-] rules may not appear in an action. They<br>      are allowed in a macro with the restriction that the a macro<br>      containing one of these rules may not be invoked from an action.<br><br>   g) The values specified in the various columns when you invoke a<br>      macro are substituted in the corresponding column in each rule in<br>      the macro. The first three columns get special treatment:<br><br>      ACTION         If you code PARAM as the action in a macro then<br>                 when you invoke the macro, you can include the<br>                 name of the macro followed by a slash ("/") and<br>                 an ACTION (either built-in or user-defined. All<br>                 instances of PARAM in the body of the macro will be<br>                 replaced with the ACTION.<br><br>                 Any logging applied when the macro is invoked is<br>                 applied following the same rules as for actions.<br><br>      SOURCE and<br>      DEST         If the rule in the macro file specifies a value and<br>                 the invocation of the rule also specifies a value then<br>                 the value in the invocation is appended to the value<br>                 in the rule using ":" as a separator.<br><br>                 Example:<br><br>                 /etc/shorewall/macro.SMTP<br><br>                 PARAM                -        loc        tcp        25<br><br>                 /etc/shorewall/rules:<br><br>                 SMTP/DNAT:info                net        192.168.1.5<br><br>                 Would be equivalent to the following in the rules file:<br><br>                 DNAT:info           net        loc:192.168.1.5        tcp        25<br><br>      Rest         Any value in the invocation replaces the value in the<br>                 rule in the macro.<br><br>    One additional restriction applies to the mixing of macros and<br>    actions. Macros that are invoked from actions cannot themselves<br>    invoke other actions.<br><br>4)  If you have 'make' installed on your firewall, then when you use<br>    the '-f' option to 'shorewall start' (as happens when you reboot),<br>    if your /etc/shorewall/ directory contains files that were modified<br>    after Shorewall was last restarted then Shorewall is started using<br>    the config files rather than using the saved configuration.<br><br>5)  The 'arp_ignore' option has been added to /etc/shorewall/interfaces<br>    entries. This option sets<br>    /proc/sys/net/ipv4/conf/&lt;interface&gt;/arp_ignore. By default, the<br>    option sets the value to 1. You can also write arp_ignore=&lt;value&gt;<br>    where value is one of the following:<br><br>        1 - reply only if the target IP address is local address<br>        configured on the incoming interface<br><br>        2 - reply only if the target IP address        is local address<br>        configured on the incoming interface and both with the sender's<br>        IP address are part from same subnet on this interface<br><br>        3 - do not reply for local addresses configured with scope<br>        host, only resolutions for global and link addresses are<br>        replied<br><br>        4-7 - reserved<br><br>         8 - do not reply for all local addresses<br><br>    WARNING -- DO NOT SPECIFY arp_ignore FOR ANY INTERFACE INVOLVED IN<br>    PROXY ARP.<br><br>6)  In /etc/shorewall/rules, "all+" in the SOURCE or DEST column works<br>    like "all" but also includes intrazone traffic. So the rule:<br><br>         ACCEPT     loc                 all+         tcp           22<br><br>    would allow SSH traffic from loc-&gt;loc whereas<br><br>         ACCEPT     loc                 all         tcp           22<br><br>    does not.<br><br>7)  A new FASTACCEPT option has been added to shorewall.conf.<br><br>    Normally, Shorewall defers accepting ESTABLISHED/RELATED packets<br>    until these packets reach the chain in which the original connection<br>    was accepted. So for packets going from the 'loc' zone to the 'net'<br>    zone, ESTABLISHED/RELATED packets are ACCEPTED in the 'loc2net'<br>    chain.<br><br>    If you set FASTACCEPT=Yes, then ESTABLISHED/RELEATED packets are<br>    accepted early in the INPUT, FORWARD and OUTPUT chains. If you set<br>    FASTACCEPT=Yes then you may not include rules in the ESTABLISHED or<br>    RELATED sections of /etc/shorewall/rules.<br><br>8)  Shorewall now generates an error if the 'norfc1918' option is<br>    specified for an interface with an RFC 1918 address.<br><br>9)  You may now specify "!" followed by a list of addresses in the<br>    SOURCE and DEST columns of entries in /etc/shorewall/rules,<br>    /etc/shorewall/tcrules and in action files and Shorewall will<br>    generate the rule that you expect.<br><br>    Example 1 (/etc/shorewall/rules):<br><br>    #ACTION    SOURCE                                DEST        PROTO     DEST PORT(S)<br>    ACCEPT     loc:!192.168.1.0/24,10.0.0.0/8        net        tcp          80<br><br>    That rule would allow loc-&gt;net HTTP access except for the local<br>    networks 192.168.1.0/24 and 10.0.0.0/8.<br><br>    Example 2 (/etc/shorewall/rules):<br><br>    #ACTION    SOURCE                                DEST        PROTO     DEST PORT(S)<br>    ACCEPT     loc:10.0.0.0/24!10.0.0.4,10.0.0.22 \<br>                                                net        tcp          80<br><br>    That rule would allow loc-&gt;net HTTP access from the local<br>    network 10.0.0.0/24 except for hosts 10.0.0.4 and 10.0.0.22.<br><br>10) Tunnel types "openvpnserver" and "openvpnclient" have been added<br>    to reflect the introduction of client and server OpenVPN<br>    configurations in OpenVPN 2.0.<br><br>11) The COMMAND variable is now set to 'restore' in restore<br>    scripts. The value of this variable is sometimes of interest to<br>    programmers providing custom /etc/shorewall/tcstart scripts.<br><br>12) Previously, if you defined any intra-zone rule(s) then any traffic<br>    not matching the rule(s) was subject to normal policies (which<br>    usually turned out to involve the all-&gt;all REJECT policy). Now, the<br>    intra-zone ACCEPT policy will still be in effect in the presence of<br>    intra-zone rules. That policy can still be overridden by an<br>    explicit policy in your /etc/shorewall/policy file.<br><br>    Example:<br><br>    /etc/shorewall/rules:<br><br>    DNAT        loc:!192.168.1.4  loc:192.168.1.4:3128        tcp        80<br><br>    Any other loc-&gt;loc traffic will still be accepted. If you want to<br>    also log that other loc-&gt;loc traffic at the info log level then<br>    insert this into /etc/shorewall/policy:<br><br>    #SOURCE        DEST        POLICY        LOG LEVEL<br>    loc                loc        ACCEPT        info<br><br>13) Prior to Shorewall 2.5.3, the rules file only controlled packets in<br>    the Netfilter states NEW and INVALID. Beginning with this release,<br>    the rules file can also deal with packets in the ESTABLISHED and<br>    RELATED states.<br><br>    The /etc/shorewall/rules file may now be divided into<br>    "sections". Each section is introduced by a line that begins with<br>    the keyword SECTION followed by the section name. Sections<br>    are as listed below and must appear in the order shown.<br><br>    ESTABLISHED<br><br>        Rules in this section apply to packets in the ESTABLISHED<br>        state.<br><br>    RELATED<br><br>        Rules in this section apply to packets in the RELATED state.<br><br>    NEW<br><br>        Rules in this section apply to packets in the NEW and INVALID<br>        states.<br><br>    Rules in the ESTABLISHED and RELATED sections are limited to the<br>    following ACTIONs:<br><br>        ACCEPT, DROP, REJECT, QUEUE, LOG and User-defined actions.<br><br>    Macros may be used in these sections provided that they expand to<br>    only these ACTIONs.<br><br>    At the end of the ESTABLISHED and RELATED sections, there is an<br>    implicit "ALLOW   all          all all" rule.<br><br>    RESTRICTION: If you specify FASTACCEPT=Yes in<br>    /etc/shorewall.shorewall.conf then the ESTABLISHED and RELATED<br>    sections must be empty.<br><br>14) The value 'ipp2p' is once again allowed in the PROTO column of<br>    the rules file. It is recommended that rules specifying 'ipp2p'<br>    only be included in the ESTABLISHED section of the file.<br><br><br>15) Shorewall actions lack a generalized way to pass parameters to an<br>    extension script associated with an action. To work around this<br>    lack, some users have used the log tag as a parameter. This works<br>    but requires that a log level other than 'none' be specified when<br>    the action is invoked. Beginning with this release, you can invoke<br>    an action with 'none'.<br><br>    Example:<br><br>        #ACTION                                SOURCE          DEST<br>        A:none:these,are,parameters     $FW                net<br><br>    When /etc/shorewall/A is invoked, the LEVEL variable will be empty<br>    but the TAG variable will contain "these,are,parameters" which<br>    can be easily parsed to isolate "these", "are" and "parameters":<br><br>        ifs=$IFS<br>        IFS=,<br>        set -- $TAG<br>        IFS=$ifs<span style="font-weight: bold;">2</span><br><br>    Now, $1 = these, $2 = are and $3 = parameters<br><br>16) The "shorewall check" command now checks the /etc/shorewall/masq,<br>    /etc/shorewall/blacklist, /etc/shorewall/proxyarp,<br>    /etc/shorewall/nat and /etc/shorewall/providers files.<br><br>17) Arne Bernin's "tc4shorewall" package has been integrated into<br>    Shorewall.<br><br>    See: http://www.shorewall.net/3.0/traffic_shaping.htm for details.<br><br>    Thanks, Arne!<br><br>18) When /usr/share/shorewall/functions is loaded it now sets<br><span style="font-weight: bold;">2</span><br>         SHOREWALL_LIBRARY=Loaded<br><br>    Application code such as /etc/shorewall/tcstart may test that<br>    variable to determine if the library has been loaded into the<br>    current shell process.<br><br>19) The install.sh script now does a much cleaner job of backing up the<br>    current installation. It copies the directories /etc/shorewall,<br>    /usr/share/shorewall and /var/lib/shorewall to a directory of the<br>    same name with "-$VERSION.bkout" appended. The init script and<br>    /sbin/shorewall are backed up to the /usr/share/shorewall and<br>    /var/lib/shorewall directories respectively. This makes it very<br>    simple to remove the backups:<br><br>           rm -rf /etc/shorewall-*.bkout<br>           rm -rf /usr/share/shorewall-*.bkout<br>           rm -rf /var/lib/shorewall-*.bkout<br><br>20) A new '-n' option has been added to the "start", "restart",<br>    "restore",  "stop" and "try" commands. This option instructs<br>    Shorewall to not alter the routing in any way.<br><br>    This option is useful when you have a multi-ISP environment because<br>    it prevents the route cache from being flushed which preserves the<br>    mapping of end-point address pairs to routes.<br><br>21) The output of "shorewall dump" now includes a capabilities report<br>    such as the one produced by "shorewall show capabilities".<br><br>22) The "plain" zone type has been replaced by "ipv4". The types<br>    "IPv4" and "IPV4" are synonyms for "ipv4". In addition, "IPSEC",<br>    "ipsec4" and "IPSEC4" are recognized synonyms for "ipsec".<br><br>23) The NEWNOTSYN and LOGNEWNOTSYN options in shorewall.conf have been<br>    removed as have the 'newnotsyn' options in /etc/shorewall/interfaces<br>    and /etc/shorewall/hosts. See the Migration Considerations for<br>    instructions if you wish to block "new-not-syn" TCP packets.<br><br>24) The "shorewall show zones" command now displays the zone type. You<br>    must have restarted Shorewall using this release before this feature<br>    will work correctly.<br><br>25) The multi-ISP code now requires that that you set MARK_IN_FORWARD_CHAIN=Yes<br>    in shorewall.conf. This is done to ensure that "shorewall refresh" will<br>    work correctly.<br><br>26) Shorewall now supports UDP IPP2P matching. In addition to the "ipp2p"<br>    keyword in the PROTOCOL column of the relevant files, the following<br>    values may be specified:<br><br>        ipp2p:tcp           Equivalent to ipp2p and matches TCP traffic<br>                            only.<br>        ipp2p:udp           Matches UDP traffic.<br>        ipp2p:all           Matches both UDP and TCP traffic. You may<br>                            not specify a SOURCE PORT with this PROTOCOL.<br><br>27) Normally MAC verification triggered by the 'maclist' interface and host<br>    options is done out of the INPUT and FORWARD chains of the filter table.<br>    Users have reported that under some circumstances, MAC verification is<br>    failing for forwarded packets when the packets are being forwarded out<br>    of a bridge.<br><br>    To work around this problem, a MACLIST_TABLE option has been added to<br>    shorewall.conf. The default value is MACLIST_TABLE=filter which results<br>    in the current behavior. If MACLIST_TABLE=mangle then filtering will<br>    take place out of the PREROUTING chain of the mangle table. Because<br>    the REJECT target may not be used in the PREROUTING chain, the settings<br>    MACLIST_DISPOSITION=REJECT and MACLIST_TABLE=mangle are incompatible.<br><br>28) The sample configurations are now packaged with the product. They are<br>    in the Samples directory on the tarball and are in the RPM they are<br>    in the Samples sub-directory of the Shorewall documentation<br>    directory.<br></pre>
-<span style="font-weight: bold;"></span> 
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">10/31/2005 Shorewall 2.4.6<br>
-<br>
-</span>Problems Corrected in 2.4.6<br>
-
-<ol>
-  <li>"shorewall refresh" would fail if there were entries in
-    /etc/shorewall/tcrules with non-empty USER/GROUP or TEST columns.</li>
-  <li>An unprintable character in a comment caused /sbin/shorewall to fail
-    when used with a light-weight shell like 'dash'.</li>
-  <li>When using some flavors of 'ash', certain /sbin/shorewall commands
-    produced 'ipset: not found' messages.</li>
-  <li>Support for OpenVPN TCP tunnels was released in Shorewall 2.2.0 but the
-    implementation was incomplete. It has now been completed and is
-    documented in the /etc/shorewall/tunnels file.</li>
-  <li>The test that Shorewall uses to detect the availability of the owner
-    match capability has been changed to avoid the generation of ipt_owner
-    messages under kernel 2.6.14.</li>
-</ol>
-New Features in 2.4.6<br>
-
-<ol>
-  <li>Normally MAC verification triggered by the 'maclist' interface and host
-    options is done out of the INPUT and FORWARD chains of the filter table.
-    Users have reported that under some circulstances, MAC verification is
-    failing for forwarded packets when the packets are being forwarded out of
-    a bridge.<br>
-    <br>
-    To work around this problem, a MACLIST_TABLE option has been added to
-    shorewall.conf. The default value is MACLIST_TABLE=filter which results
-    in the current behavior. If MACLIST_TABLE=mangle then filtering will take
-    place out of the PREROUTING chain of the mangle table. Because the REJECT
-    target may not be used in the PREROUTING chain, the settings
-    MACLIST_DISPOSITION=REJECT and MACLIST_TABLE=mangle are incompatible.</li>
-  <li>A "dump" command has been added to /sbin/shorewall for compatibility
-    with Shorewall 3.0. In 2.4.6, the "dump" command provides the same output
-    as the "status".<br>
-  </li>
-</ol>
-<hr style="width: 100%; height: 2px;">
-Shorewall 2.4.5<br>
-<br>
-Problems Corrected in 2.4.5<br>
-
-<ol>
-  <li>In previous versions, when the command is 'start', 'restart' or 'stop'
-    then OUTPUT traffic to hosts listed in /etc/shorewall/routestopped is not
-    enabled if ADMINISABSENTMINDED=Yes. That traffic is now enabled
-    independent of the setting of ADMINISABSENTMINDED.</li>
-  <li>Although it was documented that icmp types could be used in the tcrules
-    file, the code did not support it. Thanks to Jorge Molina, that problem
-    is now corrected.</li>
-  <li>In a multi-ISP configuration, fwmark routing rules now have a higher
-    priority than source IP rules. This allows entries in tcrules to be more
-    effective in controlling routing.</li>
-  <li>Previously, not all of the mangle chains were flushed during "shorewall
-    restart".</li>
-</ol>
-<span style="font-weight: bold;">09/12/2005 Shorewall 2.4.4<br>
-</span><br>
-Problems Corrected<br>
-
-<ol>
-  <li>An incorrect comment in the /etc/shorewall/proxyarp file has been
-    removed.</li>
-  <li>The message generated when a duplicate policy has been entered is now
-    more informative. Previously, only the POLICY column contents appeared in
-    the message. Now the SOURCE, DEST and POLICY column contents are
-  shown.</li>
-  <li>Shorewall now clears the Netfilter "raw" table during "shorewall
-    [re]start", "shorewall stop" and "shorewall clear" processing.</li>
-</ol>
-New Features<br>
-
-<ol>
-  <li>Tunnel types "openvpnserver" and "openvpnclient" have been added to
-    reflect the introduction of client and server OpenVPN configurations in
-    OpenVPN 2.0.</li>
-  <li>The COMMAND variable is now set to 'restore' in restore scripts. The
-    value of this variable is sometimes of interest to programmers providing
-    custom /etc/shorewall/tcstart scripts.<br>
-  </li>
-</ol>
-<span style="font-weight: bold;">08/16/2005 Shorewall 2.4.3<br>
-</span><br>
-Problems Corrected:<br>
-
-<ol>
-  <li>Shorewall is no longer dependent on the 'which' utility.</li>
-  <li>The 'shorewall add' command failed if there existed a zone in the
-    configuration that specified the 'ipsec' option in
-  /etc/shorewall/hosts.</li>
-  <li>Shorewall is no longer dependent on /bin/echo.</li>
-  <li>A CLASSIFY rule&nbsp; with $FW in the SOURCE column (tcrules) no longer
-    results in a "shorewall start" error.</li>
-  <li>You may now use port lists in the DEST PORT and SOURCE PORT columns of
-    the /etc/shorewall/accounting file.</li>
-  <li>The "shorewall show capabilities" command now accurately reports the
-    availability of "Packet type match" independent of the setting of PKTTYPE
-    in shorewall.conf.</li>
-  <li>Thanks to Tuomo Soini, all of the files have been siginificantly
-    cleaned up in terms of formatting and extra white-space.<br>
-  </li>
-</ol>
-New Features:<br>
-
-<ol>
-  <li>New Allow.Submission and Allow.NTPbrd actions have been added. Users of
-    the Allow.NTP action that use NTP broadcasting should switch to use of
-    Allow.NTPbrd instead.</li>
-  <li>The kernel version string is now included in the output of "shorewall
-    status".<br>
-  </li>
-</ol>
-<span style="font-weight: bold;">07/30/2005 Shorewall 2.2.6<br>
-<br>
-</span>Problems Corrected:<br>
-
-<ol>
-  <li><a href="#20050717">MACLIST_TTL Vulnerability</a> fix.</li>
-  <li>TCP_FLAGS_LOG_LEVEL=ULOG breaks with recent versions of iptables.</li>
-  <li>The bogons file has been updated to reflect recent IANA
-  allocations.</li>
-</ol>
-<span style="font-weight: bold;">07/21/2005 Shorewall 2.4.2<br>
-<br>
-</span>Problems Corrected:<br>
-
-<ol>
-  <li>The /etc/shorewall/hosts file now includes information about defining a
-    zone using one or more ipsets.</li>
-  <li>A <a href="#20050717">vulnerability involving MACLIST_TTL &gt; 0 or
-    MACLIST_DISPOSITION=ACCEPT</a> has been corrected.</li>
-  <li>It is now possible to specify !&lt;address&gt; in the SUBNET column of
-    /etc/shorewall/masq. Previously, it was necessary to write
-    0.0.0.0/0!&lt;address&gt;.</li>
-  <li>When &lt;network1&gt;!&lt;network2&gt; was specified in the SUBNET
-    column of /etc/shorewall/masq, IPSEC policies were not correctly applied
-    to the resulting rules. This usually resulted in IPSEC not working
-    through the interface specified in the INTERFACES column.<br>
-  </li>
-</ol>
-New Features:<br>
-
-<ol>
-  <li>A 'loose' provider option has been added. If you wish to be able to use
-    marking to specify the gateway used by connections originating on the
-    firewall itself, the specify 'loose' for each provider. It has bee
-    reported that 'loose' may break the effect of 'track' so beware if you
-    need 'track' functionality (you shouldn't be originating many connections
-    from your firewall to the net anyway).<br>
-    <br>
-    To use 'loose', you also need to add two entries in
-    /etc/shorewall/masq:<br>
-
-    <pre><span style="font-family: monospace;">#INTERFACE           SUBNET          ADDRESS<br>
-   $IF_ISP1             $IP_ISP2        $IP_ISP1<br>
-   $IF_ISP2             $IP_ISP1        $IP_ISP2</span>
- </pre>
-    where:<br>
-
-    <pre>        $IF_ISP1        is the interface to ISP 1.<br>
-        $IF_ISP2        is the interface to ISP 2.<br>
-        $IP_ISP1        is the IP address of $IF_ISP1<br>
-        $IP_ISP2        is the IP address of $IF_ISP2
- </pre>
-  </li>
-  <li>/sbin/shorewall now issues a warning each time that it finds that
-    startup is disabled.</li>
-  <li>A new COPY column has been added to the /etc/shorewall/providers file.
-    Normally, when a table name/number is given in the DUPLICATE column, the
-    entire table (less default routes) is copied. The COPY column allows you
-    to limit the routes copied to those that go through an interface listed
-    in COPY. For example, if you enter eth0 in INTERFACE, "eth1,eth2" in COPY
-    and 'main' in DUPLICATE then the new table created will contain those
-    routes through the interfaces eth0, eth1 and eth2.<br>
-  </li>
-</ol>
-<hr style="width: 100%; height: 2px;">
-
-<h2><a name="20050717"></a><font color="#ff0000">07/17/2005 Security
-vulnerability in MACLIST processing</font></h2>
-
-<h3>Description</h3>
-
-<p>A security vulnerability has been discovered which affects all supported
-stable versions of Shorewall.&nbsp; This vulnerability enables a client
-accepted by MAC address filtering to bypass any other rule.&nbsp; If
-MACLIST_TTL is set to a value greater than 0 or MACLIST_DISPOSITION is set to
-"ACCEPT" in /etc/shorewall/shorewall.conf (default is MACLIST_TTL=0 and
-MACLIST_DISPOSITION=REJECT), and a client is positively identified through
-its MAC address, it bypasses all other policies/rules in place, thus gaining
-access to all open services on the firewall.</p>
-
-<h3>Fix</h3>
-
-<h4>Workaround</h4>
-
-<p>For Shorewall 2.2.x or 2.4.x, set MACLIST_TTL=0 or
-MACLIST_DISPOSITION=REJECT in /etc/shorewall/shorewall.conf.&nbsp; For
-Shorewall 2.0.x, set MACLIST_DISPOSITION=REJECT in
-/etc/shorewall/shorewall.conf.&nbsp; MACLIST filtering is of limited value on
-Internet-connected hosts, and the Shorewall team recommends this approach to
-be used if possible.</p>
-
-<h4>Upgrade</h4>
-
-<p>For Shorewall 2.4.x, a fixed version of the 'firewall' script is available
-at: <a
-href="http://shorewall.net/pub/shorewall/2.4/shorewall-2.4.1/errata/firewall">http://shorewall.net/pub/shorewall/2.4/shorewall-2.4.1/errata/firewall</a>
-and its mirrors, <a
-href="http://www.shorewall.net/pub/shorewall/2.4/shorewall-2.4.1/errata/firewall">http://www.shorewall.net/pub/shorewall/2.4/shorewall-2.4.1/errata/firewall</a>
-and <a
-href="http://slovakia.shorewall.net/pub/shorewall/2.4/shorewall-2.4.1/errata/firewall">http://slovakia.shorewall.net/pub/shorewall/2.4/shorewall-2.4.1/errata/firewall</a>.</p>
-
-<p>For Shorewall 2.2.x, a fixed version of the 'firewall' script is available
-at: <a
-href="http://shorewall.net/pub/shorewall/2.2/shorewall-2.2.5/errata/firewall">http://shorewall.net/pub/shorewall/2.2/shorewall-2.2.5/errata/firewall</a>
-and its mirrors, <a
-href="http://www.shorewall.net/pub/shorewall/2.2/shorewall-2.2.5/errata/firewall">http://www.shorewall.net/pub/shorewall/2.2/shorewall-2.2.5/errata/firewall</a>
-and <a
-href="http://slovakia.shorewall.net/pub/shorewall/2.2/shorewall-2.2.5/errata/firewall">http://slovakia.shorewall.net/pub/shorewall/2.2/shorewall-2.2.5/errata/firewall</a>.</p>
-
-<p>For Shorewall 2.0.x, a fixed version of the 'firewall' script is available
-at: <a
-href="http://shorewall.net/pub/shorewall/errata/2.0.17/firewall">http://shorewall.net/pub/shorewall/errata/2.0.17/firewall</a>
-and its mirrors, <a
-href="http://www.shorewall.net/pub/shorewall/errata/2.0.17/firewall">http://www.shorewall.net/pub/shorewall/errata/2.0.17/firewall</a>
-and <a
-href="http://slovakia.shorewall.net/pub/shorewall/errata/2.0.17/firewall">http://slovakia.shorewall.net/pub/shorewall/errata/2.0.17/firewall</a>.</p>
-
-<p>Users of any version before 2.0.17 are urged to upgrade to a supported
-version of Shorewall (preferably 2.4.1) before using the fixed files.&nbsp;
-Only the most recent version of the 2.0.x and 2.2.x streams will be supported
-by the development team, and the 1.x branches are no longer maintained at
-all.&nbsp; Future releases of Shorewall will include this fix.</p>
-
-<p>This information was based on <a
-href="http://seclists.org/lists/fulldisclosure/2005/Jul/0409.html">Patrick
-Blitz's post to the Full Disclosure mailing list</a>.&nbsp; Thanks to
-Supernaut (supernaut at ns dot sympatico dot ca) for reporting this bug.<br>
-</p>
-
-<p><span style="font-weight: bold;">Version Upgrade<br>
-</span></p>
-
-<p>The vulnerability is corrected in Shorewall 2.4.2 and in Shorewall
-2.2.6.<br>
-</p>
-<hr style="width: 100%; height: 2px;">
-<span style="font-weight: bold;">07/13/2005 Shorewall 2.4.1<br>
-</span><br>
-Problems Corrected:<br>
-
-<ol>
-  <li>Shell variables may now be used in the zones file.</li>
-  <li>The /usr/share/shorewall/bogons file has been updated to reflect recent
-    IANA allocations.</li>
-  <li>Shorewall now detects an error where multiple providers specify the
-    'track' option on the same interface.</li>
-  <li>The remnants of the GATEWAY column in /etc/shorewall/interfaces have
-    been removed. This column appeared briefly in one of the Beta versions
-    and was immediately removed but some vestiges remained.</li>
-  <li>Shorewall now correctly restores a load-balancing default route during
-    processing of the 'shorewall restore' and 'shorewall -f start' commands.
-    The latter command is normally executed by the Shorewall init script
-    during reboot.</li>
-  <li>A log level of "None!" is now allowed on builtin actions such as ACCEPT
-    and DROP.</li>
-  <li>Previously, LIMIT:BURST parameters in /etc/shorewall/policy were not
-    correctly applied when the policy was QUEUE.</li>
-  <li>The 'chkconfig' command on FC4 and Mandriva previously created symbolic
-    links with incorrect names ("S-1shorewall"). The init script has been
-    changed to prevent this incorrect behavior.</li>
-  <li>DHCP traffic forwarded through a bridge could, under some
-    configurations, be filtered by the 'maclist' option even though the
-    'dhcp' option was specified. This has been corrected.<br>
-  </li>
-</ol>
-<span style="font-weight: bold;">06/05/2005 Shorewall 2.4.0<br>
-<br>
-Note:</span> Because of the short time that has elapsed since the release of
-Shorewall 2.2.0, Shorewall 2.0 will be supported until 1 December 2005 or
-until the release of Shorewall 2.6.0, whichever occurs first.<br>
-<br>
-New Features:<br>
-
-<ol>
-  <li>Shorewall 2.4.0 includes support for multiple internet interfaces to
-    different ISPs.<br>
-    <br>
-    The file /etc/shorewall/providers may be used to define the different
-    providers. It can actually be used to define alternate routing tables so
-    uses like transparent proxy can use the file as well.<br>
-    <br>
-    Columns are:<br>
-    <br>
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    NAME&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    The provider name.</span><br style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    NUMBER&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The provider
-    number -- a number between 1 and 15</span><br
-    style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    MARK&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; A
-    FWMARK value used in your /etc/shorewall/tcrules file to direct packets
-    for this provider.</span><br style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    DUPLICATE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The name of an existing
-    table to duplicate. May</span> <span style="font-family: monospace;">be
-    'main' or the name of a previous provider.</span><br
-    style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    INTERFACE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The name of the network
-    interface to the</span> <span style="font-family: monospace;">provider.
-    Must be listed in</span><span
-    style="font-family: monospace;">/etc/shorewall/interfaces.</span><br
-    style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    GATEWAY&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The IP address of
-    the provider's gateway router.</span> <span
-    style="font-family: monospace;">If you enter "detect" here then
-    Shorewall<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    will</span> <span style="font-family: monospace;">attempt to determine
-    the gateway IP address</span> <span
-    style="font-family: monospace;">automatically.</span><br
-    style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    OPTIONS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; A comma-separated
-    list selected from the</span> <span
-    style="font-family: monospace;">following:</span><br
-    style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    track&nbsp;&nbsp; If specified, connections FROM this interface
-    are</span> <span style="font-family: monospace;">to be tracked so that
-    responses may be<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    routed</span> <span style="font-family: monospace;">back out this same
-    interface.</span><br style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    You want specify 'track' if internet hosts will be</span> <span
-    style="font-family: monospace;">connecting to local servers through<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    this</span> <span style="font-family: monospace;">provider.</span><br
-    style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    Because of limitations in the 'ip' utility and</span> <span
-    style="font-family: monospace;">policy routing, you may not use the SAVE
-    or</span><span style="font-family: monospace;"><br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    RESTORE tcrules options or use connection</span><span
-    style="font-family: monospace;">marking on any traffic to or from
-    this</span><br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    interface. For traffic control purposes, you</span> <span
-    style="font-family: monospace;">must mark packets in the FORWARD chain
-    (or</span><span style="font-family: monospace;"><br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    better yet, use the CLASSIFY target).</span><br
-    style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    balance The providers that have 'balance' specified will</span> <span
-    style="font-family: monospace;">get outbound traffic load-balanced
-    among<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    them. By</span> <span style="font-family: monospace;">default, all
-    interfaces with 'balance' specified</span> <span
-    style="font-family: monospace;">will have the same weight (1).<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    You can change the</span><span style="font-family: monospace;">weight of
-    the route out of the interface by</span> <span
-    style="font-family: monospace;">specifiying balance=&lt;weight&gt;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    where &lt;weight&gt; is</span><span style="font-family: monospace;">the
-    desired route weight.</span><br style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Example:&nbsp; You run squid in your
-    DMZ on IP address 192.168.2.99. Your DMZ interface is eth2<br>
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    #NAME&nbsp;&nbsp; NUMBER&nbsp; MARK DUPLICATE&nbsp; INTERFACE
-    GATEWAY&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; OPTIONS</span><br
-    style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    Squid&nbsp;&nbsp; 1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    1&nbsp;&nbsp;&nbsp;
-    -&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    eth2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.2.99&nbsp; -</span><br>
-    <br>
-    Use of this feature requires that your kernel and iptabls support
-    CONNMARK target and conntrack match support. It does NOT require the
-    ROUTE target extension.<br>
-    <br>
-    WARNING: The current version of iptables (1.3.1) is broken with respect
-    to CONNMARK and iptables-save/iptables-restore. This means that if you
-    configure multiple ISPs, "shorewall restore" may fail. You must patch
-    your iptables using the patch at <a
-    href="http://shorewall.net/pub/shorewall/contrib/iptables/CONNMARK.diff">http://shorewall.net/pub/shorewall/contrib/iptables/CONNMARK.diff</a>.<br>
-    <br>
-  </li>
-  <li>Shorewall 2.3.0 supports the 'cmd-owner' option of the owner match
-    facility in Netfilter. Like all owner match options, 'cmd-owner' may only
-    be applied to traffic that originates on the firewall.<br>
-    <br>
-    The syntax of the USER/GROUP column in the following files has been
-    extended:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /etc/shorewall/accounting<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /etc/shorewall/rules<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /etc/shorewall/tcrules<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    /usr/share/shorewall/action.template<br>
-    <br>
-    To specify a command, prefix the command name with "+".<br>
-    <br>
-    &nbsp;&nbsp; Examples:<br>
-    <br>
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    +mozilla-bin&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    #The program is named "mozilla-bin"</span><br
-    style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    joe+mozilla-bin&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #The
-    program is named "mozilla-bin" and</span><br
-    style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    #is being run by user "joe"</span><br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    joe:users+mozilla-bin&nbsp;&nbsp; #The program is named "mozilla-bin"
-    and</span><br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    #is being run by user "joe" with</span><br
-    style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    #effective group "users".</span><br style="font-family: monospace;">
-    <br>
-    &nbsp;&nbsp; Note that this is not a particularly robust feature and I
-    would never advertise it as a "Personal Firewall" equivalent. Using
-    symbolic links, it's easy to alias command names to be anything you
-    want.<br>
-    <br>
-  </li>
-  <li>Support has been added for ipsets (see <a
-    href="http://people.netfilter.org/kadlec/ipset/">http://people.netfilter.org/kadlec/ipset/</a>).<br>
-    <br>
-    In most places where a host or network address may be used, you may also
-    use the name of an ipset prefaced by "+".<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Example: "+Mirrors"<br>
-    <br>
-    The name of the set may be optionally followed by:<br>
-    <br>
-    a) a number from 1 to 6 enclosed in square brackets ([]) -- this number
-    indicates the maximum number of ipset binding levels that are to be
-    matched. Depending on the context where the ipset name is used, either
-    all "src" or all "dst" matches will be used.<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Example: "+Mirrors[4]"<br>
-    <br>
-    b) a series of "src" and "dst" options separated by commas and inclosed
-    in square brackets ([]). These will be passed directly to iptables in the
-    generated --set clause. See the ipset documentation for details.<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Example:
-    "+Mirrors[src,dst,src]"<br>
-    <br>
-    Note that "+Mirrors[4]" used in the SOURCE column of the rules file is
-    equivalent to "+Mirrors[src,src,src,src]".<br>
-    <br>
-    To generate a negative match, prefix the "+" with "!" as in
-    "!+Mirrors".<br>
-    <br>
-    Example 1: Blacklist all hosts in an ipset named "blacklist"<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    /etc/shorewall/blacklist<br>
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    #ADDRESS/SUBNET&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    PROTOCOL&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; PORT</span><br
-    style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    +blacklist</span><br style="font-family: monospace;">
-    <br>
-    Example 2: Allow SSH from all hosts in an ipset named "sshok:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    /etc/shorewall/rules<br>
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    #ACTION&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    SOURCE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DEST&nbsp;&nbsp;&nbsp;&nbsp;
-    PROTO&nbsp;&nbsp;&nbsp; DEST PORT(S)</span><br
-    style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    ACCEPT&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    +sshok&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    fw&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    22</span><br style="font-family: monospace;">
-    <br>
-    Shorewall can automatically capture the contents of your ipsets for you.
-    If you specify SAVE_IPSETS=Yes in /etc/shorewall/shorewall.conf then
-    "shorewall save" will save the contents of your ipsets. The file where
-    the sets are saved is formed by taking the name where the Shorewall
-    configuration is stored and appending "-ipsets". So if you enter the
-    command "shorewall save standard" then your Shorewall configuration will
-    be saved in var/lib/shorewall/standard and your ipset contents will be
-    saved in /var/lib/shorewall/standard-ipsets. Assuming the default
-    RESTOREFILE setting, if you just enter "shorewall save" then your
-    Shorewall configuration will be saved in /var/lib/shorewall/restore and
-    your ipset contents will be saved in
-    /var/lib/shorewall/restore-ipsets.<br>
-    <br>
-    Regardless of the setting of SAVE_IPSETS, the "shorewall -f start" and
-    "shorewall restore" commands will restore the ipset contents
-    corresponding to the Shorewall configuration restored provided that the
-    saved Shorewall configuration specified exists.<br>
-    <br>
-    For example, "shorewall restore standard" would restore the ipset
-    contents from /var/lib/shorewall/standard-ipsets provided that
-    /var/lib/shorewall/standard exists and is executable and that
-    /var/lib/shorewall/standard-ipsets exists and is executable.<br>
-    <br>
-    Also regardless of the setting of SAVE_IPSETS, the "shorewall forget"
-    command will purge the saved ipset information (if any) associated with
-    the saved shorewall configuration being removed.<br>
-    <br>
-    You can also associate ipset contents with Shorewall configuration
-    directories using the following command:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipset -S &gt; &lt;config
-    directory&gt;/ipsets<br>
-    <br>
-    Example:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipset -S &gt;
-    /etc/shorewall/ipsets<br>
-    <br>
-    When you start or restart Shorewall (including using the 'try' command)
-    from the configuration directory, your ipsets will be configured from the
-    saved ipsets file. Once again, this behavior is independent of the
-    setting of SAVE_IPSETS.<br>
-    <br>
-    Ipsets are well suited for large blacklists. You can maintain your
-    blacklist using the 'ipset' utility without ever having to restart or
-    refresh Shorewall. If you use the SAVE_IPSETS=Yes feature just be sure to
-    "shorewall save" after altering the blacklist ipset(s).<br>
-    <br>
-    Example /etc/shorewall/blacklist:<br>
-    <br>
-    <span style="font-family: monospace;">&nbsp;&nbsp;
-    #ADDRESS/SUBNET&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    PROTOCOL&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; PORT</span><br
-    style="font-family: monospace;">
-    <span style="font-family: monospace;">&nbsp;&nbsp;
-    +Blacklist[src,dst]</span><br style="font-family: monospace;">
-    <span style="font-family: monospace;">&nbsp;&nbsp;
-    +Blacklistnets[src,dst]</span><br style="font-family: monospace;">
-    <br>
-    Create the blacklist ipsets using:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipset -N Blacklist
-    iphash<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipset -N
-    Blacklistnets nethash<br>
-    <br>
-    Add entries<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipset -A Blacklist
-    206.124.146.177<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipset -A Blacklistnets
-    206.124.146.0/24<br>
-    <br>
-    To allow entries for individual ports<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipset -N SMTP portmap --from 1 --to
-    31<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipset -A SMTP 25<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipset -A Blacklist
-    206.124.146.177<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipset -B Blacklist 206.124.146.177
-    -b SMTP<br>
-    <br>
-    Now only port 25 will be blocked from 206.124.146.177.<br>
-    <br>
-  </li>
-  <li>Shorewall 2.4.0 can now configure routing if your kernel and iptables
-    support the ROUTE target extension. This extension is available in
-    Patch-O-Matic-ng. This feature is *EXPERIMENTAL* since the Netfilter team
-    have no intention of ever releasing the ROUTE target extension to
-    kernel.org.<br>
-    <br>
-    Routing is configured using the /etc/shorewall/routes file. Columns in
-    the file are as follows:<br>
-    <br>
-    <span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    SOURCE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    Source of the packet. May be any of the</span> <span
-    style="font-family: monospace;">following:</span><br
-    style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    - A host or network address</span><br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    - A network interface name.</span><br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    - The name of an ipset prefaced with "+"</span><br
-    style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    - $FW (for packets originating on the firewall)</span><br
-    style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    - A MAC address in Shorewall format</span><br
-    style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    - A range of IP addresses (assuming that your</span> <span
-    style="font-family: monospace;">kernel and iptables support range
-    match)</span><br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    - A network interface name followed by ":"</span> <span
-    style="font-family: monospace;">and an address or address
-    range.</span><br style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    DEST&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    Destination of the packet. May be any of the</span> <span
-    style="font-family: monospace;">following:</span><br
-    style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    - A host or network address</span><br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    - A network interface name (determined from</span><br
-    style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    routing table(s))</span><br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    - The name of an ipset prefaced with "+"</span><br
-    style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    - A network interface name followed by ":"</span><br
-    style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    and an address or address range.</span><br
-    style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    PROTO&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    Protocol - Must be "tcp", "udp", "icmp",</span> <span
-    style="font-family: monospace;">"ipp2p", a number, or "all". "ipp2p"
-    requires</span><span style="font-family: monospace;"><br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    ipp2p match support in your kernel and</span><span
-    style="font-family: monospace;">iptables.</span><br
-    style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    PORT(S)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Destination
-    Ports. A comma-separated list of</span> <span
-    style="font-family: monospace;">Port names (from /etc/services), port<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    numbers</span> <span style="font-family: monospace;">or port ranges; if
-    the protocol is "icmp", this</span><span
-    style="font-family: monospace;">column is interpreted as the<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    destination</span> <span
-    style="font-family: monospace;">icmp-type(s).</span><br
-    style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    If the protocol is ipp2p, this column is</span> <span
-    style="font-family: monospace;">interpreted as an ipp2p option without
-    the</span><span style="font-family: monospace;"><br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    leading "--" (example "bit" for bit-torrent).</span> <span
-    style="font-family: monospace;">If no PORT is given, "ipp2p" is
-    assumed.</span><br style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    This column is ignored if PROTOCOL = all but</span> <span
-    style="font-family: monospace;">must be entered if any of the
-    following<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    field</span> <span style="font-family: monospace;">is supplied. In that
-    case, it is suggested that</span> <span
-    style="font-family: monospace;">this field contain "-"</span><br
-    style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    SOURCE PORT(S)&nbsp; (Optional) Source port(s). If omitted,</span> <span
-    style="font-family: monospace;">any source port is acceptable. Specified
-    as a</span><span style="font-family: monospace;"><br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    comma-separated list of port names, port</span> <span
-    style="font-family: monospace;">numbers or port ranges.</span><br
-    style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    TEST&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    Defines a test on the existing packet or</span> <span
-    style="font-family: monospace;">connection mark.</span><br
-    style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    The rule will match only if the test returns</span> <span
-    style="font-family: monospace;">true. Tests have the format</span><span
-    style="font-family: monospace;"><br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    [!]&lt;value&gt;[/&lt;mask&gt;][:C]</span><br
-    style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    Where:</span><br style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    !&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Inverts the test (not equal)</span>
-    <span style="font-family: monospace;">&lt;value&gt; Value of the packet
-    or</span><span style="font-family: monospace;"><br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    connection mark.</span><br style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    &lt;mask&gt;&nbsp; A mask to be applied to the</span> <span
-    style="font-family: monospace;">mark before testing</span><br
-    style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    :C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Designates a connection</span> <span
-    style="font-family: monospace;">mark. If omitted, the packet</span> <span
-    style="font-family: monospace;">mark's value<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    is tested.</span><br style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    INTERFACE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The interface that the
-    packet is to be routed</span> <span style="font-family: monospace;">out
-    of. If you do not specify this<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    field then</span> <span style="font-family: monospace;">you must place
-    "-" in this column and enter an</span> <span
-    style="font-family: monospace;">IP address in the GATEWAY<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    column.</span><br style="font-family: monospace;">
-    <br style="font-family: monospace;">
-    <span
-    style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    GATEWAY&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The gateway that
-    the packet is to be forewarded</span> <span
-    style="font-family: monospace;">through.</span><br
-    style="font-family: monospace;">
-    <br style="font-family: monospace;">
-  </li>
-  <li>Normally when Shorewall is stopped, starting or restarting then
-    connections are allowed from hosts listed in /etc/shorewall/routestopped
-    to the firewall and to other hosts listed in
-    /etc/shorewall/routestopped.<br>
-    <br>
-    A new 'source' option is added for entries in that file which will cause
-    Shorewall to allow traffic from the host listed in the entry to ANY other
-    host. When 'source' is specified in an entry, it is unnecessary to also
-    specify 'routeback'.<br>
-    <br>
-    Similarly, a new 'dest' option is added which will cause Shorewall to
-    allow traffic to the host listed in the entry from ANY other host. When
-    'source' is specified in an entry, it is unnecessary to also specify
-    'routeback'.<br>
-    <br>
-  </li>
-  <li>This change was implemented by Lorenzo Martignoni. It provides two new
-    commands: "safe-start" and "safe-restart".<br>
-    <br>
-    <span style="font-weight: bold;">safe-start</span> starts Shorewall then
-    prompts you to ask you if everything looks ok. If you answer "no" or if
-    you don't answer within 60 seconds, a "shorewall clear" is executed.<br>
-    <br>
-    <span style="font-weight: bold;">safe-restart</span> saves your current
-    configuration to /var/lib/shorewall/safe-restart then issues a "shorewall
-    restart"; It then prompts you to ask if you if you want to accept the new
-    configuration. If you answer "no" or if you don't answer within 60
-    seconds, the configuration is restored to its prior state.<br>
-    <br>
-    These new commands require either that your /bin/sh supports the "-t"
-    option to the 'read' command or that you have /bin/bash installed.<br>
-  </li>
-</ol>
-<span style="font-weight: bold;">05/20/2005&nbsp; Shorewall CVS Repository
-has Moved to Sourceforge<br>
-<br>
-</span> The CVS repository may now be accessed at <a target="_top"
-href="http://sourceforge.net/cvs/?group_id=22587">http://sourceforge.net/cvs/?group_id=22587</a>.<br>
-<span style="font-weight: bold;"><br>
-05/20/2005 Shorewall 2.2.5<br>
-<br>
-</span> This will be my last 2.2 release. It contains a couple of small bug
-fixes that I hadn't yet released.<br>
-<br>
--Tom<br>
-<br>
-Problems Corrected:<br>
-
-<ol>
-  <li>Previously, if PKTTYPE=No in shorewall.conf then pkttype match would
-    still be used if the kernel supported it.</li>
-  <li>A typo in the 'tunnel' script has been corrected (Thanks to Patrik
-    Varmeck&Atilde;&frac12;).</li>
-  <li>A warning is now generated if an invalid short zone name is used in
-    /etc/shorewall/zones.<br>
-  </li>
-</ol>
-<span style="font-weight: bold;">05/18/2005 Tom stepping away from Shorewall
-development and support<br>
-</span> <br>
-It is with regret that I announce that my involvement in Shorewall
-development and support is officially ending.<br>
-<br>
-Unlike the originators of other successful open source projects, I have not
-been able to attract a core of people who believe in Shorewall and who are
-willing to make sacrifices to ensure it's success. That is my weakness and I
-accept it. But is means that I have been left with trying to develop,
-document, and support Shorewall almost single-handedly. I cannot do it any
-more.<br>
-<br>
-I will clean up what I have for a 2.3 release and place it on the server as
-my last Shorewall release -- Shorewall 2.4.0.<br>
-<br>
-Discussions aimed at continuing Shorewall development under new leadership
-are continuing.<br>
-<br>
-Shorewall will always be a part of my life that I look back on with
-fondness.<br>
-<br>
-Regards,<br>
-<br>
--Tom<br>
-
-
-<p><span style="font-weight: bold;">05/02/2005 Shorewall 2.2.4<br>
-</span></p>
-
-<p>Problems Corrected:<br>
-</p>
-<ol>
-  <li>The error message:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Error: No appropriate chain for zone
-    &lt;z1&gt; to zone &lt;z2&gt;<br>
-    <br>
-    has been changed to one that is more self-explanatory:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Error: No policy defined for zone
-    &lt;z1&gt; to zone &lt;z2&gt;</li>
-  <li>When only an interface name appeared in the HOST(S) column of an
-    /etc/shorewall/hosts file entry, a misleading iptables error message
-    resulted. Now the following message is generated:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Error: Invalid HOST(S) column
-    contents: &lt;column contents&gt;</li>
-</ol>
-New Features:<br>
-
-<ol>
-  <li>Support has been added for UPnP using linux-igd&nbsp; (<a
-    href="http://linux-idg.sourceforge.net/">http://linux-idg.sourceforge.net</a>).
-    UPnP is required by a number of popular applications including MSN
-  IM.</li>
-</ol>
-
-<div style="margin-left: 40px;">
-<span style="font-weight: bold;">WARNING</span>:<br>
-
-
-<div style="margin-left: 40px;">
-From a security architecture viewpoint, UPnP is a disaster. It assumes
-that:<br>
-
-<ol style="list-style-type: lower-alpha;">
-  <li>All local systems and their users are completely trustworthy.</li>
-  <li>No local system is infected with any worm or trojan.</li>
-</ol>
-</div>
-
-<div style="margin-left: 40px;">
-If either of these assumptions are not true then UPnP can be used to totally
-defeat your firewall and to allow incoming connections to arbitrary local
-systems on any port whatsoever.<br>
-In short: <span style="font-weight: bold;">USE UPnP AT YOUR OWN
-RISK</span>.<br>
-</div>
-
-<div style="margin-left: 40px;">
-<br>
-</div>
-</div>
-
-<div style="margin-left: 40px;">
-<span style="font-weight: bold;">WARNING</span>:<br>
-
-
-<div style="margin-left: 40px;">
-The linux-igd project appears to be inactive and the web site does not
-display correctly on any open source browser that I've tried.<br>
-<br>
-Building and installing linux-igd is not for the faint of heart. You must
-download the source from CVS and be prepared to do quite a bit of fiddling
-with the include files from libupnp (which is required to build and/or run
-linux-igd).<br>
-<br>
-</div>
-</div>
-
-<div style="margin-left: 40px;">
-Configuring linux-igd:<br>
-
-
-<div style="margin-left: 40px;">
-In /etc/upnpd.conf, you will want:<br>
-<br>
-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-insert_forward_rules = yes<br>
-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-prerouting_chain_name = UPnP<br>
-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-forward_chain_name = forwardUPnP<br>
-<br>
-</div>
-</div>
-
-<div style="margin-left: 40px;">
-Shorewall Configuration:<br>
-
-
-<div style="margin-left: 40px;">
-In /etc/shorewall/interfaces, you need the 'upnp' option on your external
-interface.<br>
-<br>
-If your fw-&gt;loc policy is not ACCEPT then you need this rule:<br>
-<br>
-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-allowoutUPnP&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-fw&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; loc<br>
-<br>
-Note: To use 'allowoutUPnP', your iptables and kernel must support the 'owner
-match' feature (see the output of "shorewall check").<br>
-<br>
-If your loc-&gt;fw policy is not ACCEPT then you need this rule:<br>
-<br>
-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-allowinUPnP&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-loc&nbsp;&nbsp;&nbsp;&nbsp; fw<br>
-<br>
-You MUST have this rule:<br>
-<br>
-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-forwardUPnP&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-net&nbsp;&nbsp;&nbsp;&nbsp; loc<br>
-<br>
-</div>
-</div>
-
-<div style="margin-left: 40px;">
-&nbsp;&nbsp; You must also ensure that you have a route to 224.0.0.0/4 on you
-internal (local) interface.<br>
-</div>
-<ol start="2" style="list-style-type: decimal;">
-  <li>A new 'started' extension script has been added.&nbsp; The difference
-    between this extension script and /etc/shorewall/start is that this one
-    is invoked after delayed loading of the blacklist
-    (DELAYBLACKLISTLOAD=Yes) and after the 'shorewall' chain has been created
-    (thus signaling that the firewall is completely up.<br>
-    <br>
-    /etc/shorewall/started should not change the firewall configuration
-    directly but may do so indirectly by running /sbin/shorewall with the
-    'nolock' option.<br>
-    <br>
-  </li>
-  <li>By default, shorewall is started with the "-f" (fast) option when your
-    system boots. You can override that setting by setting the OPTIONS
-    variable in /etc/sysconfig/shorewall (SUSE/Redhat) or
-    /etc/default/shorewall (Debian/Bering). If neither file exists, feel free
-    to create one or the other.<br>
-    <br>
-    Example: If you want Shorewall to always use the config files even if
-    there is a saved configuration, then specify:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; OPTIONS=""<br>
-    <br>
-  </li>
-  <li>Shorewall now has support for the SAME target. This change affects the
-    /etc/shorewall/masq and /etc/shorewall/rules file.<br>
-    <br>
-    SAME is useful when you specify multiple target IP addresses (in the
-    ADDRESSES column of /etc/shorewall/masq or in the DEST column of
-    /etc/shorewall/rules).<br>
-    <br>
-    If you use normal SNAT then multiple connections from a given local host
-    to hosts on the internet can be assigned different source IP addresses.
-    This confuses some applications that use multiple connections. To correct
-    this problem, prefix the list of address ranges in the ADDRESS column
-    with "SAME:"<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    Example:&nbsp;&nbsp; SAME:206.124.146.176-206.124.146.180<br>
-    <br>
-    If you want each internal system to use the same IP address from the list
-    regardless of which internet host it is talking to then prefix the ranges
-    with "SAME:nodst:".<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    Example:&nbsp;&nbsp; SAME:nodst:206.124.146.176-206.124.146.180<br>
-    <br>
-    Note that it is not possible to map port numbers when using SAME.<br>
-    <br>
-    In the rules file, when multiple connections from an internet host match
-    a SAME rule then all of the connections will be sent to the same internal
-    server. SAME rules are very similar to DNAT rules with the keyword SAME
-    replacing DNAT. As in the masq file, changing the port number is not
-    supported.<br>
-    <br>
-  </li>
-  <li>A "shorewall show capabilities" command has been added to report the
-    capabilities of your kernel and iptables.<br>
-    <br>
-    &nbsp;&nbsp; Example:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; gateway:~# shorewall show capabilities<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Loading
-    /usr/share/shorewall/functions...<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Processing /etc/shorewall/params ...<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Processing
-    /etc/shorewall/shorewall.conf...<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Loading Modules...<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Shorewall has detected the following
-    iptables/netfilter capabilities:<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    NAT: Available<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    Packet Mangling: Available<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    Multi-port Match: Available<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    Extended Multi-port Match: Available<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    Connection Tracking Match: Available<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    Packet Type Match: Not available<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    Policy Match: Available<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    Physdev Match: Available<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    IP range Match: Available<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    Recent Match: Available<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    Owner Match: Available<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; gateway:~#<br>
-    <br>
-  </li>
-  <li>A "-v" option has been added to /sbin/shorewall. Currently, this option
-    only affects the "show log" command (e.g., "shorewall -v show log") and
-    the "monitor" command. In these commands, it causes the MAC address in
-    the log message (if any) to be displayed. As previously, when "-v" is
-    omitted, the MAC address is suppressed.<br>
-    <br>
-  </li>
-  <li>In /etc/shorewall/rules, a value of 'none' in either the SOURCE or DEST
-    columns now causes the rule to be ignored. This is most useful when used
-    with shell variables:<br>
-    <br>
-    Example:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /etc/shorewall/rules:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    AllowFTP&nbsp;&nbsp;&nbsp;
-    $FTP_CLIENTS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; fw<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; When FTP_CLIENTS is set to
-    'none', the above rule is ignored.&nbsp; Otherwise, the rule is evaluated
-    and generates Netfilter rules.<br>
-    <br>
-  </li>
-  <li>The installer now detects that it is running on a Slackware system and
-    adjusts the DEST and INIT variables accordingly.<br>
-  </li>
-</ol>
-
-<p><span style="font-weight: bold;">05/01/2005 Tom spoke at LinuxFest NW 2005
--- Bellingham Technical College, Bellingham Washington<br>
-</span><br>
-Tom's presentation was entitled "Shorewall and Native IPSEC" and is available
-for download <a href="http://shorewall.net/LinuxFest.pdf">here (PDF
-Format)</a>.<br>
-<br>
-<span style="font-weight: bold;">04/07/2005 Shorewall 2.2.3<br>
-</span><br>
-Problems Corrected:<br>
-</p>
-<ol>
-  <li>If a zone is defined in /etc/shorewall/hosts using
-    &lt;interface&gt;:!&lt;network&gt; in the HOSTS column then startup
-    errors occur on "shorewall [re]start".</li>
-  <li>Previously, if "shorewall status" was run on a system whose kernel
-    lacked advanced routing support (CONFIG_IP_ADVANCED_ROUTER),&nbsp; then
-    no routing information was displayed.</li>
-</ol>
-New Features:<br>
-
-<ol>
-  <li>A new extension script "continue" has been added. This script is
-    invoked after Shorewall has set the built-in filter chains policy to
-    DROP, deleted any existing Netfilter rules and user chains and has
-    enabled existing connections. It is useful for enabling certain
-    communication while Shorewall is being [re]started. Be sure to delete any
-    rules that you add here in your /etc/shorewall/start file.</li>
-  <li>There has been ongoing confusion about how the
-    /etc/shorewall/routestopped file works. People understand how it works
-    with the 'shorewall stop' command but when they read that 'shorewall
-    restart' is logically equivalent to 'shorewall stop' followed by
-    'shorewall start' then they erroneously conclude that
-    /etc/shorewall/routestopped can be used to enable new connections during
-    'shorewall restart'. Up to now, it cannot -- that file is not processed
-    during either 'shorewall start' or 'shorewall restart'.<br>
-    <br>
-    Beginning with Shorewall version 2.2.3, /etc/shorewall/routestopped will
-    be processed TWICE during 'shorewall start' and during 'shorewall
-    restart'. It will be processed early in the command execution to add
-    rules allowing new connections while the command is running and it will
-    be processed again when the command is complete to remove the rules added
-    earlier.<br>
-    <br>
-    The result of this change will be that during most of [re]start, new
-    connections will be allowed in accordance with the contents of
-    /etc/shorewall/routestopped.</li>
-  <li>The performance of configurations with a large numbers of entries in
-    /etc/shorewall/maclist can be improved by setting the new MACLIST_TTL
-    variable in /etc/shorewall/shorewall.conf.<br>
-    <br>
-    If your iptables and kernel support the "Recent Match" (see the output of
-    "shorewall check" near the top), you can cache the results of a 'maclist'
-    file lookup and thus reduce the overhead associated with MAC
-    Verification.<br>
-    <br>
-    When a new connection arrives from a 'maclist' interface, the packet
-    passes through then list of entries for that interface in
-    /etc/shorewall/maclist. If there is a match then the source IP address is
-    added to the 'Recent' set for that interface. Subsequent connection
-    attempts from that IP address occuring within $MACLIST_TTL seconds will
-    be accepted without having to scan all of the entries. After $MACLIST_TTL
-    from the first accepted connection request from an IP address, the next
-    connection request from that IP address will be checked against the
-    entire list.<br>
-    <br>
-    If MACLIST_TTL is not specified or is specified as empty (e.g,
-    MACLIST_TTL="" or is specified as zero then 'maclist' lookups will not be
-    cached.</li>
-  <li>You can now specify QUEUE as a policy and you can designate a common
-    action for QUEUE policies in /etc/shorewall/actions. This is useful for
-    sending packets to something like Snort Inline.<br>
-  </li>
-</ol>
-<span style="font-weight: bold;">03/31/2005 Shorewall 2.0.17<br>
-<br>
-</span> Problems Corrected:<br>
-
-<ol>
-  <li>Invoking the 'rejNotSyn' action results in an error at startup.</li>
-  <li>The UDP and TCP port numbers in /usr/share/shorewall/action.AllowPCA
-    were reversed.</li>
-  <li>If a zone is defined in /etc/shorewall/hosts using &lt;<span
-    style="font-style: italic;">interface</span>&gt;:!&lt;<span
-    style="font-style: italic;">network</span>&gt; in the HOSTS column then
-    startup errors occur on "shorewall [re]start".<br>
-  </li>
-</ol>
-<span style="font-weight: bold;">03/12/2005 Shorewall 2.2.2<br>
-</span> <br>
-Problems Corrected:<br>
-
-<ol>
-  <li>The SOURCE column in the /etc/shorewall/tcrules file now correctly
-    allows IP ranges (assuming that your iptables and kernel support
-    ranges).<br>
-  </li>
-  <li>If A is a user-defined action and you have file /etc/shorewall/A then
-    when that file is invoked by Shorewall during [re]start, the $TAG value
-    may be incorrect.</li>
-  <li>Previously, if an iptables command generating a logging rule failed,
-    the Shorewall [re]start was still successful. This error is now
-    considered fatal and Shorewall will be either restored from the last save
-    (if any) or it will be stopped.</li>
-  <li>The port numbers for UDP and TCP were previously reversed in the
-    /usr/share/shorewall/action.AllowPCA file.</li>
-  <li>Previously, the 'install.sh' script did not update the
-    /usr/share/shorewall/action.* files.</li>
-  <li>Previously, when an interface name appeared in the DEST column of
-    /etc/shorewall/tcrules, the name was not validated against the set of
-    defined interfaces and bridge ports.<br>
-  </li>
-</ol>
-New Features:<br>
-
-<ol>
-  <li>The SOURCE column in the /etc/shorewall/tcrules file now allows $FW to
-    be optionally followed by ":" and a host/network address or address
-  range.</li>
-  <li>Shorewall now clears the output device only if it is a terminal. This
-    avoids ugly control sequences being placed in files when /sbin/shorewall
-    output is redirected.</li>
-  <li>The output from 'arp -na' has been added to the 'shorewall status'
-    display.</li>
-  <li>The 2.6.11 Linux kernel and iptables 1.3.0 now allow port ranges to
-    appear in port lists handled by "multiport match". If Shorewall detects
-    this capability, it will use "multiport match" for port lists containing
-    port ranges. Be cautioned that each port range counts for TWO ports and a
-    port list handled with "multiport match" can still specify a maximum of
-    15 ports.<br>
-    <br>
-    As always, if a port list in /etc/shorewall/rules is incompatible with
-    "multiport match", a separate iptables rule will be generated for each
-    element in the list.</li>
-  <li>Traditionally, the RETURN target in the 'rfc1918' file has caused
-    'norfc1918' processing to cease for a packet if the packet's source IP
-    address matches the rule. Thus, if you have:<br>
-    <br>
-    <span style="font-family: monospace;">&nbsp;&nbsp;
-    SUBNETS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    TARGET</span><br style="font-family: monospace;">
-    <span style="font-family: monospace;">&nbsp;&nbsp;
-    192.168.1.0/24&nbsp;&nbsp; RETURN</span><br>
-    <br>
-    then traffic from 192.168.1.4 to 10.0.3.9 will be accepted even though
-    you also have:<br>
-    <br>
-    <span style="font-family: monospace;">&nbsp;&nbsp;
-    SUBNETS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    TARGET</span><br style="font-family: monospace;">
-    <span style="font-family: monospace;">&nbsp;&nbsp;
-    10.0.0.0/8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; logdrop</span><br>
-    <br>
-    Setting RFC1918_STRICT=Yes in shorewall.conf will cause such traffic to
-    be logged and dropped since while the packet's source matches the RETURN
-    rule, the packet's destination matches the 'logdrop' rule.<br>
-    <br>
-    If not specified or specified as empty (e.g., RFC1918_STRICT="") then
-    RFC1918_STRICT=No is assumed.<br>
-    <br>
-    WARNING: RFC1918_STRICT=Yes requires that your kernel and iptables
-    support 'Connection Tracking' match.<br>
-  </li>
-</ol>
-
-<p><span style="font-weight: bold;">02/15/2005 Shorewall 2.2.1<br>
-<br>
-</span> This release rolls up the fixes for bugs found in the first 2-3 weeks
-of deployment of Shorewall 2.2.<br>
-</p>
-<ol>
-  <li>The /etc/shorewall/policy file contained a misleading comment and both
-    that file and the /etc/shorewall/zones file lacked examples.</li>
-  <li>Shorewall previously used root's default umask which could cause files
-    in /var/lib/shorewall to be world-readable. Shorewall now uses umask
-  0177.</li>
-  <li>In log messages produced by logging a built-in action, the packet
-    disposition was displayed incorrectly.<br>
-    <br>
-    &nbsp;&nbsp; Example:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    rejNotSyn:ULOG&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; all&nbsp;&nbsp;&nbsp;&nbsp;
-    all&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    tcp<br>
-    <br>
-    &nbsp;&nbsp; produces the log message:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Feb 12
-    23:57:08 server Shorewall:rejNotSyn:ULOG: ...<br>
-    <br>
-    &nbsp;&nbsp; rather than<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Feb 12
-    23:57:08 server Shorewall:rejNotSyn:REJECT: ...<br>
-    <br>
-  </li>
-  <li>The comments regarding built-in actions in
-    /usr/share/shorewall/actions.std have been corrected.</li>
-  <li>The /etc/shorewall/policy file in the LRP package was missing the
-    'all-&gt;all' policy.<br>
-  </li>
-</ol>
-<span style="font-weight: bold;">02/05/2005 End of Support for Shorewall
-1.4<br>
-<br>
-</span> Effective today, support for Shorewall 1.4 has been discontinued. See
-the link at the top of this article for&nbsp; upgrade information.<br>
-<br>
-<span style="font-weight: bold;">02/01/2005 Shorewall 2.0.16<br>
-</span> <br>
-This release back-ports the DROPINVALID shorewall.conf option from 2.2.0.<br>
-
-<ol>
-  <li>Recent 2.6 kernels include code that evaluates TCP packets based on TCP
-    Window analysis. This can cause packets that were previously classified
-    as NEW or ESTABLISHED to be classified as INVALID.<br>
-    <br>
-    The new kernel code can be disabled by including this command in your
-    /etc/shorewall/init file:<br>
-    <br>
-    echo 1 &gt; /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal<br>
-    <br>
-    Additional kernel logging about INVALID TCP packets may be obtained by
-    adding this command to /etc/shorewall/init:<br>
-    <br>
-    echo 1 &gt; /proc/sys/net/ipv4/netfilter/ip_conntrack_log_invalid<br>
-    <br>
-    Traditionally, Shorewall has dropped INVALID TCP packets early. The new
-    DROPINVALID option allows INVALID packets to be passed through the normal
-    rules chains by setting DROPINVALID=No.<br>
-    <br>
-    If not specified or if specified as empty (e.g., DROPINVALID="") then
-    DROPINVALID=Yes is assumed.</li>
-</ol>
-
-<p><span style="font-weight: bold;">02/01/2005 Shorewall 2.2.0<br>
-<br>
-</span> New Features:<br>
-</p>
-<ol>
-  <li>ICMP packets that are in the INVALID state are now dropped by the
-    Reject and Drop default actions. They do so using the new 'dropInvalid'
-    builtin action. An 'allowInvalid' builtin action is also provided which
-    accepts packets in that state.</li>
-  <li>The /etc/shorewall/masq file INTERFACE column now allows additional
-    options.<br>
-    <br>
-    Normally MASQUERADE/SNAT rules are evaluated after one-to-one NAT rules
-    defined in the /etc/shorewall/nat file. If you preceed the interface name
-    with a plus sign ("+") then the rule will be evaluated before one-to-one
-    NAT.<br>
-    <br>
-    Examples:<br>
-    <br>
-    +eth0<br>
-    +eth1:192.0.2.32/27<br>
-    <br>
-    Also, the effect of ADD_SNAT_ALIASES=Yes can be negated for an entry by
-    following the interface name by ":" but no digit.<br>
-    <br>
-    Examples:<br>
-    <br>
-    eth0:<br>
-    eth1::192.0.2.32/27<br>
-    +eth3:<br>
-    <br>
-  </li>
-  <li>Similar to 2), the /etc/shorewall/nat file INTERFACE column now allows
-    you to override the setting of ADD_IP_ALIASES=Yes by following the
-    interface name with ":" but no digit.</li>
-  <li>All configuration files in the Shorewall distribution with the
-    exception of shorewall.conf are now empty. In particular, the
-    /etc/shorewall/zones, /etc/shorewall/policy and /etc/shorewall/tos files
-    now have no active entries. Hopefully this will stop the questions on the
-    support and development lists regarding why the default entries are the
-    way they are.</li>
-  <li>Previously, including a log level (and optionally a log tag) on a rule
-    that specified a user-defined (or Shorewall-defined) action would log all
-    traffic passed to the action. Beginning with this release, specifying a
-    log level in a rule that specifies a user- or Shorewall-defined action
-    will cause each rule in the action to be logged with the specified level
-    (and tag).<br>
-    <br>
-    The extent to which logging of action rules occurs is goverend by the
-    following:</li>
-  <li style="list-style: none"><ul>
-      <li>When you invoke an action and specify a log level, only those rules
-        in the action that have no log level will be changed to log at the
-        level specified at the action invocation.<br>
-        <br>
-        Example:<br>
-        <br>
-        /etc/shorewall/action.foo:<br>
-        <br>
-        ACCEPT&nbsp;&nbsp;&nbsp; -&nbsp;&nbsp;&nbsp; -&nbsp;&nbsp;&nbsp;
-        tcp&nbsp;&nbsp;&nbsp; 22<br>
-        bar:info<br>
-        <br>
-        /etc/shorewall/rules:<br>
-        <br>
-        foo:debug&nbsp;&nbsp;&nbsp; fw&nbsp;&nbsp;&nbsp; net<br>
-        <br>
-        Logging in the invoked 'foo' action will be:<br>
-        <br>
-        ACCEPT:debug&nbsp;&nbsp;&nbsp; -&nbsp;&nbsp;&nbsp;
-        -&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp; 22<br>
-        bar:info<br>
-        <br>
-      </li>
-      <li>If you follow the log level with "!" then logging will be at that
-        level for all rules recursively invoked by the action<br>
-        <br>
-        Example: /etc/shorewall/action.foo:<br>
-        <br>
-        <b>Update:</b> I've been informed by Mandrake Development that this
-        problem has been corrected in Mandrake 10.0 Final (the problem still
-        exists in the 10.0 Community release).<br>
-        ACCEPT&nbsp;&nbsp;&nbsp; -&nbsp;&nbsp;&nbsp; -&nbsp;&nbsp;&nbsp;
-        tcp&nbsp;&nbsp;&nbsp; 22<br>
-        bar:info<br>
-        <br>
-        /etc/shorewall/rules:<br>
-        <br>
-        foo:debug!&nbsp;&nbsp;&nbsp; fw&nbsp;&nbsp;&nbsp; net<br>
-        <br>
-        Logging in the invoke 'foo' action will be:<br>
-        <br>
-        ACCEPT:debug&nbsp;&nbsp;&nbsp; -&nbsp;&nbsp;&nbsp;
-        -&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp; 22<br>
-        bar:debug!<br>
-        <br>
-      </li>
-    </ul>
-  </li>
-</ol>
-
-<div style="margin-left: 40px;">
-This change has an effect on extension scripts used with user-defined
-actions. If you define an action 'acton' and you have an /etc/shorewall/acton
-script then when that script is invoked, the following three variables will
-be set for use by the script:<br>
-<br>
-
-
-<div style="margin-left: 40px;">
-$CHAIN = the name of the chain where your rules are to be placed. When
-logging is used on an action invocation, Shorewall creates a chain with a
-slightly different name from the action itself.<br>
-$LEVEL = Log level. If empty, no logging was specified.<br>
-$TAG&nbsp;&nbsp; = Log Tag.<br>
-<br>
-</div>
-Example:<br>
-<br>
-/etc/shorewall/rules:<br>
-&nbsp;&nbsp;&nbsp;<br>
-acton:info:test<br>
-<br>
-Your /etc/shorewall/acton file will be run with:<br>
-<br>
-
-
-<div style="margin-left: 40px;">
-$CHAIN="%acton1<br>
-$LEVEL="info"<br>
-$TAG="test"<br>
-</div>
-</div>
-<br>
-
-<ol start="6">
-  <li>The /etc/shorewall/startup_disabled file is no longer created when
-    Shorewall is first installed. Rather, the variable STARTUP_ENABLED is set
-    to 'No' in /etc/shorewall/shorewall.conf. In order to get Shorewall to
-    start, that variable's value must be set to 'Yes'. This change
-    accomplishes two things:</li>
-  <li style="list-style: none"><ul>
-      <li>It prevents Shorewall from being started prematurely by the user's
-        initialization scripts.</li>
-      <li>It causes /etc/shorewall/shorewall.conf to be modified so that it
-        won't be replaced by upgrades using RPM.<br>
-        <br>
-      </li>
-    </ul>
-  </li>
-  <li>Support has been added for the 2.6 Kernel IPSEC implementation. To use
-    this support, you must have installed the IPSEC policy match patch and
-    the four IPSEC/Netfilter patches from Patch-0-Matic-ng. The policy match
-    patch affects both your kernel and iptables. There are two ways to
-    specify that IPSEC is to be used when communicating with a set of hosts;
-    both methods involve the new /etc/shorewall/ipsec file:</li>
-  <li style="list-style: none"><ol style="list-style-type: lower-alpha;">
-      <li>If encrypted communication is used with all hosts in a zone, then
-        you can designate the zone as an "ipsec" zone by placing 'Yes" in the
-        IPSEC ONLY column in /etc/shorewall/ipsec:<br>
-        <br>
-        <span style="font-family: monospace;">#ZONE&nbsp;&nbsp;&nbsp;
-        &nbsp;&nbsp;&nbsp; IPSEC&nbsp;&nbsp;&nbsp; OPTIONS ...</span><br
-        style="font-family: monospace;">
-        <span style="font-family: monospace;">#&nbsp;&nbsp;&nbsp;
-        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp; ONLY</span><br
-        style="font-family: monospace;">
-        <span style="font-family: monospace;">vpn&nbsp;&nbsp;&nbsp;
-        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Yes</span><br>
-        <br>
-        The hosts in the zone (if any) must be specified in
-        /etc/shorewall/hosts but you do not need to specify the 'ipsec'
-        option on the entries in that file (see below). Dynamic zones
-        involving IPSEC must use that technique.<br>
-        <br>
-        Example:Under 2.4 Kernel FreeS/Wan:<br>
-        <br>
-        /etc/shorewall/zones:<br>
-        <br>
-        <span style="font-family: monospace;">net&nbsp;&nbsp;&nbsp;
-        Net&nbsp;&nbsp;&nbsp; The big bad Internet</span><br
-        style="font-family: monospace;">
-        <span style="font-family: monospace;">vpn&nbsp;&nbsp;&nbsp;
-        VPN&nbsp;&nbsp;&nbsp; Remote Network</span><br>
-        <br>
-        /etc/shorewall/interfaces:<br>
-        <br>
-        <span style="font-family: monospace;">net&nbsp;&nbsp;&nbsp;
-        eth0&nbsp;&nbsp;&nbsp; ...</span><br style="font-family: monospace;">
-        <span style="font-family: monospace;">vpn&nbsp;&nbsp;&nbsp;
-        ipsec0&nbsp;&nbsp;&nbsp; ...</span><br>
-        <br>
-        Under 2.6 Kernel with this new support:<br>
-        <br>
-        /etc/shorewall/zones:<br>
-        <br>
-        <span style="font-family: monospace;">net&nbsp;&nbsp;&nbsp;
-        Net&nbsp;&nbsp;&nbsp; The big bad Internet</span><br
-        style="font-family: monospace;">
-        <span style="font-family: monospace;">vpn&nbsp;&nbsp;&nbsp;
-        VPN&nbsp;&nbsp;&nbsp; Remote Network</span><br>
-        <br>
-        /etc/shorewall/interfaces:<br>
-        <br>
-        <span style="font-family: monospace;">net&nbsp;&nbsp;&nbsp;
-        eth0&nbsp;&nbsp;&nbsp; ...</span><br>
-        <br>
-        /etc/shorewall/hosts:<br>
-        <br>
-        <span style="font-family: monospace;">vpn&nbsp;&nbsp;&nbsp;
-        eth0:0.0.0.0/0</span><br>
-        <br>
-        /etc/shorewall/ipsec<br>
-        <br>
-        <span style="font-family: monospace;">vpn&nbsp;&nbsp;&nbsp; Yes<br>
-        <br>
-        </span></li>
-      <li>If only part of the hosts in a zone require encrypted
-        communication, you may use of the new 'ipsec' option in
-        /etc/shorewall/hosts to designate those hosts.<br>
-        <br>
-        Example:<br>
-        <br>
-        Under 2.4 Kernel FreeS/Wan:<br>
-        <br>
-        /etc/shorewall/zones:<br>
-
-        <pre>net    Net    The big bad Internet<br>
-loc    Local  Extended local zone</pre>
-        /etc/shorewall/interfaces:<br>
-        <br>
-        <span style="font-family: monospace;">net&nbsp;&nbsp;&nbsp;
-        eth0&nbsp;&nbsp;&nbsp; ...</span><br style="font-family: monospace;">
-        <span style="font-family: monospace;">loc&nbsp;&nbsp;&nbsp;
-        eth1&nbsp;&nbsp;&nbsp; ...</span><br style="font-family: monospace;">
-        <span style="font-family: monospace;">loc&nbsp;&nbsp;&nbsp;
-        ipsec0&nbsp;&nbsp;&nbsp; ...</span><br>
-        <br>
-        Under 2.6 Kernel with this new support:<br>
-        <br>
-        /etc/shorewall/zones:<br>
-        <br>
-        <span style="font-family: monospace;">net&nbsp;&nbsp;&nbsp;
-        &nbsp;&nbsp;&nbsp; Net&nbsp;&nbsp;&nbsp; The big bad
-        Internet</span><br style="font-family: monospace;">
-        <span
-        style="font-family: monospace;">vpn&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-        &nbsp; VPN&nbsp;&nbsp;&nbsp; Remote Network</span><br>
-        <br>
-        /etc/shorewall/interfaces:<br>
-        <br>
-        <span style="font-family: monospace;">net&nbsp;&nbsp;&nbsp;
-        eth0&nbsp;&nbsp;&nbsp; ...</span><br style="font-family: monospace;">
-        <span style="font-family: monospace;">loc&nbsp;&nbsp;&nbsp;
-        eth1&nbsp;&nbsp;&nbsp; ...</span><br>
-        <br>
-        /etc/shorewall/hosts:<br>
-        <br>
-        <span style="font-family: monospace;">vpn&nbsp;&nbsp;&nbsp;
-        eth0:0.0.0.0/0&nbsp;&nbsp;&nbsp; ipsec,...</span> </li>
-    </ol>
-  </li>
-</ol>
-
-<div style="margin-left: 40px;">
-Regardless of which technique you choose, you can specify additional SA
-options for the zone in the /etc/shorewall/ipsec entry.<br>
-<br>
-The OPTIONS, IN OPTIONS and OUT OPTIONS columns specify the input-output,
-input and output characteristics of the security associations to be used to
-decrypt (input) or encrypt (output) traffic to/from the zone.<br>
-<br>
-The available options are:<br>
-</div>
-
-<div style="margin-left: 2em">
-<ul>
-  <li>reqid[!]=&lt;number&gt; where &lt;number&gt; is specified using
-    setkey(8) using the 'unique:&lt;number&gt;' option for the SPD level.</li>
-  <li>spi[!]=&lt;number&gt; where &lt;number&gt; is the SPI of the SA. Since
-    different SAs are used to encrypt and decrypt traffic, this option should
-    only be listed in the IN OPTIONS and OUT OPTIONS columns.</li>
-  <li>proto[!]=ah|esp|ipcomp</li>
-  <li>mss=&lt;number&gt; (sets the MSS value in TCP SYN packets and is not
-    related to policy matching)</li>
-  <li>mode[!]=transport|tunnel</li>
-  <li>tunnel-src[!]=&lt;address&gt;[/&lt;mask&gt;] (only available with
-    mode=tunnel)</li>
-  <li>tunnel-dst[!]=&lt;address&gt;[/&lt;mask&gt;] (only available with
-    mode=tunnel). Because tunnel source and destination are dependent on the
-    direction of the traffic, these options should only appear in the IN
-    OPTIONS and OUT OPTIONS columns.</li>
-  <li>strict&nbsp; (if specified, packets must match all policies; policies
-    are delimited by 'next').</li>
-  <li>next&nbsp;&nbsp;&nbsp; (only available with strict)</li>
-</ul>
-</div>
-
-<div style="margin-left: 40px;">
-Examples:<br>
-<br>
-<span style="font-family: monospace;">#ZONE&nbsp;&nbsp;&nbsp; IPSEC&nbsp;
-OPTIONS&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;
-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; IN&nbsp;&nbsp;&nbsp;
-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; OUT</span><br style="font-family: monospace;">
-<span
-style="font-family: monospace;">#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-ONLY&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;
-&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;
-OPTIONS&nbsp;&nbsp;&nbsp;&nbsp; OPTIONS</span><br
-style="font-family: monospace;">
-<span style="font-family: monospace;">vpn&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-Yes&nbsp;&nbsp;&nbsp; mode=tunnel,proto=esp&nbsp;&nbsp;&nbsp;
-spi=1000&nbsp;&nbsp;&nbsp; spi=1001</span><br style="font-family: monospace;">
-<span style="font-family: monospace;">loc&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-No&nbsp;&nbsp;&nbsp;&nbsp; reqid=44,mode=transport</span><br>
-<br>
-The /etc/shorewall/masq file has a new IPSEC column added. If you specify Yes
-or yes in that column then the unencrypted packets will have their source
-address changed. Otherwise, the unencrypted packets will not have their
-source addresses changed. This column may also contain a comma-separated list
-of the options specified above in which case only those packets that will be
-encrypted by an SA matching the given options will have their source address
-changed.<br>
-</div>
-<ol start="8">
-  <li>To improve interoperability, tunnels of type 'ipsec' no longer enforce
-    the use of source port 500 for ISAKMP and OpenVPN tunnels no longer
-    enforce use of the specified port as both the source and destination
-    ports.</li>
-  <li>A new 'allowBcast' builtin action has been added -- it silently allows
-    broadcasts and multicasts.</li>
-  <li>The -c option in /sbin/shorewall commands is now deprecated. The
-    commands where -c was previously allowed now permit you to specify a
-    configuration directory after the command:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; shorewall check&nbsp;&nbsp; [
-    &lt;configuration-directory&gt; ]<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; shorewall restart [
-    &lt;configuration-directory&gt; ]<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; shorewall start&nbsp;&nbsp; [
-    &lt;configuration-directory&gt; ]<br>
-    <br>
-  </li>
-  <li>Normally, when SNAT or MASQUERADE is applied to a tcp or udp
-    connection, Netfilter attempts to retain the source port number. If it
-    has to change to port number to avoid&nbsp; &lt;source
-    address&gt;,&lt;source port&gt; conflicts, it tries to do so within port
-    ranges ( &lt; 512, 512-1023, and &gt; 1023). You may now specify an
-    explicit range of source ports to be used by following the address or
-    address range (if any) in the ADDRESS column with ":" and a port range in
-    the format &lt;low-port&gt;-&lt;high-port&gt;. You must specify either
-    "tcp" or "udp" in the PROTO column.<br>
-    <br>
-    Examples 1 -- MASQUERADE with tcp source ports 4000-5000:<br>
-    <br>
-    <span style="font-family: monospace;">&nbsp;&nbsp;&nbsp; #INTERFACE
-    SUBNET&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;
-    ADDRESS&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; PROTO</span><br
-    style="font-family: monospace;">
-    <span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;
-    eth0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.0/24&nbsp;
-    :4000-5000&nbsp;&nbsp;&nbsp;&nbsp; tcp</span><br
-    style="font-family: monospace;">
-    <br>
-    Example 2 -- SNAT with udp source ports 7000-8000:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; <span style="font-family: monospace;">#INTERFACE
-    SUBNET&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;
-    ADDRESS&nbsp;&nbsp;&nbsp;
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    PROTO</span><br style="font-family: monospace;">
-    <span style="font-family: monospace;">&nbsp;&nbsp;
-    eth0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    10.0.0.0/8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    192.0.2.44:7000-8000&nbsp;&nbsp;&nbsp; udp<br>
-    <br>
-    </span></li>
-  <li>You may now account by user/group ID for outbound traffic from the
-    firewall itself with entries in /etc/shorewall/accounting. Such
-    accounting rules must be placed in the OUTPUT chain. See the comments at
-    the top of /etc/shorewall/accounting for details.</li>
-  <li>Shorewall now verifies that your kernel and iptables have physdev match
-    support if BRIDGING=Yes in shorewall.conf.</li>
-  <li>Beginning with this release, if your kernel and iptables have iprange
-    match support (see the output from "shorewall check"), then with the
-    exception of the /etc/shorewall/netmap file, anywhere that a network
-    address may appear an IP address range of the form &lt;low
-    address&gt;-&lt;high address&gt; may also appear.</li>
-  <li>Support has been added for the iptables CLASSIFY target. That target
-    allows you to classify packets for traffic shaping directly rather than
-    indirectly through fwmark. Simply enter the &lt;major&gt;:&lt;minor&gt;
-    classification in the first column of /etc/shorewall/tcrules:<br>
-    <br>
-    Example:<br>
-    <br>
-    <span
-    style="font-family: monospace;">#MARK/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    SOURCE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    DEST&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; PROTO&nbsp;&nbsp;&nbsp;&nbsp;
-    PORT(S)</span><br style="font-family: monospace;">
-    <span style="font-family: monospace;">#CLASSIFY</span><br
-    style="font-family: monospace;">
-    <span style="font-family: monospace;">1:30&nbsp;&nbsp;&nbsp;
-    &nbsp;&nbsp;&nbsp; -&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;
-    &nbsp;&nbsp;&nbsp; eth0&nbsp;&nbsp;&nbsp; &nbsp; tcp&nbsp;&nbsp;&nbsp;
-    &nbsp;&nbsp; 25</span><br>
-    <br>
-    Note that when using this form of rule, it is acceptable to include the
-    name of an interface in the DEST column.<br>
-    <br>
-    Marking using the CLASSIFY target always occurs in the POSTROUTING chain
-    of the mangle table and is not affected by the setting of
-    MARK_IN_FORWARD_CHAIN in shorewall.conf.</li>
-  <li>During "shorewall start", IP addresses to be added as a consequence of
-    ADD_IP_ALIASES=Yes and ADD_SNAT_ALIASES=Yes are quietly deleted when
-    /etc/shorewall/nat and /etc/shorewall/masq are processed then they are
-    re-added later. This is done to help ensure that the addresses can be
-    added with the specified labels but can have the undesirable side effect
-    of causing routes to be quietly deleted. A new RETAIN_ALIASES option has
-    been added to shorewall.conf; when this option is set to Yes, existing
-    addresses will not be deleted. Regardless of the setting of
-    RETAIN_ALIASES, addresses added during "shorewall start" are still
-    deleted at a subsequent "shorewall stop" or "shorewall restart".</li>
-  <li>Users with a large black list (from /etc/shorewall/blacklist) may want
-    to set the new DELAYBLACKLISTLOAD option in shorewall.conf. When
-    DELAYBLACKLISTLOAD=Yes, Shorewall will enable new connections before
-    loading the blacklist rules. While this may allow connections from
-    blacklisted hosts to slip by during construction of the blacklist, it can
-    substantially reduce the time that all new connections are disabled
-    during "shorewall [re]start".</li>
-  <li>Using the default LOGFORMAT, chain names longer than 11 characters
-    (such as in user-defined actions) may result in log prefix truncation. A
-    new shorewall.conf action&nbsp; LOGTAGONLY has been added to deal with
-    this problem. When LOGTAGONLY=Yes, logging rules that specify a log tag
-    will substitute the tag for the chain name in the log prefix.<br>
-    <br>
-    Example -- file /etc/shorewall/action.thisisaverylogactionname:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; Rule:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span
-    style="font-family: monospace;">DROP:info:ftp&nbsp;&nbsp;&nbsp;
-    0.0.0.0/0&nbsp;&nbsp;&nbsp; 0.0.0.0/0&nbsp;&nbsp;&nbsp;
-    tcp&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; 21</span><br>
-    &nbsp;&nbsp;&nbsp;<br>
-    &nbsp;&nbsp;&nbsp; Log prefix with LOGTAGONLY=No:<br>
-    <br>
-    &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; <span
-    style="font-family: monospace;">Shorewall:thisisaverylongacti</span><br>
-    <br>
-    &nbsp;&nbsp;&nbsp; Log prefix with LOGTAGONLY=Yes:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span
-    style="font-family: monospace;">Shorewall:ftp:DROP</span><br>
-    <br>
-  </li>
-  <li>Shorewall now resets the 'accept_source_route' flag for all interfaces.
-    If you wish to accept source routing on an interface, you must specify
-    the new 'sourceroute' interface option in /etc/shorewall/interfaces.</li>
-  <li>The default Drop and Reject actions now invoke the new standard action
-    'AllowICMPs'. This new action accepts critical ICMP types:<br>
-    &nbsp;&nbsp;&nbsp;<br>
-    &nbsp;&nbsp;&nbsp; Type 3 code 4 (fragmentation needed)<br>
-    &nbsp;&nbsp;&nbsp; Type 11&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; (TTL
-    exceeded)<br>
-    <br>
-  </li>
-  <li>Explicit control over the kernel's Martian logging is now provided
-    using the new 'logmartians' interface option. If you include
-    'logmartians' in the interface option list then logging of Martian
-    packets on will be enabled on the specified interface. If you wish to
-    globally enable martian logging, you can set LOG_MARTIANS=Yes in
-    shorewall.conf.</li>
-  <li>You may now cause Shorewall to use the '--set-mss' option of the TCPMSS
-    target. In other words, you can cause Shorewall to set the MSS field of
-    SYN packets passing through the firewall to the value you specify. This
-    feature extends the existing CLAMPMSS option in
-    /etc/shorewall/shorewall.conf by allowing that option to have a numeric
-    value as well as the values "Yes" and "No".<br>
-    <br>
-    Example:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; CLAMPMSS=1400<br>
-    <br>
-  </li>
-  <li>Shorewall now includes support for the ipp2p match facility. This is a
-    departure from my usual policy in that the ipp2p match facility is
-    included in Patch-O-Matic-NG and is unlikely to ever be included in the
-    kernel.org source tree. Questions about how to install the patch or how
-    to build your kernel and/or iptables should not be posted on the
-    Shorewall mailing lists.<br>
-    <br>
-    In the following files, the "PROTO" or "PROTOCOL" column may contain
-    "ipp2p":<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /etc/shorewall/rules<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /etc/shorewall/tcrules<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /etc/shorewall/accounting<br>
-    <br>
-    When the PROTO or PROTOCOL column contains "ipp2p" then the DEST PORT(S)
-    or PORT(S) column may contain a recognized ipp2p option; for a list of
-    the options and their meaning, at a root prompt:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; iptables -m ipp2p --help<br>
-    <br>
-    You must not include the leading "--" on the option; Shorewall will
-    supply those characters for you. If you do not include an option then
-    "ipp2p" is assumed (Shorewall will generate "-m ipp2p --ipp2p").</li>
-  <li>Shorewall now has support for the CONNMARK target from iptables. See
-    the /etc/shorewall/tcrules file for details.</li>
-  <li>A new debugging option LOGALLNEW has been added to shorewall.conf. When
-    set to a log level, this option causes Shorewall to generaate a logging
-    rule as the first rule in each builtin chain.<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; - The table name is used as the chain name in the log
-    prefix.<br>
-    &nbsp;&nbsp;&nbsp; - The chain name is used as the target in the log
-    prefix.<br>
-    <br>
-    Example: Using the default LOGFORMAT, the log prefix for logging from the
-    nat table's PREROUTING chain is:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; &nbsp;<span
-    style="font-family: monospace;">Shorewall:nat:PREROUTING</span><br>
-    <br>
-    IMPORTANT: There is no rate limiting on these logging rules so use
-    LOGALLNEW at your own risk; it may cause high CPU and disk utilization
-    and you may not be able to control your firewall after you enable this
-    option.<br>
-    <br>
-    DANGER: DO NOT USE THIS OPTION IF THE RESULTING LOG MESSAGES WILL BE SENT
-    TO ANOTHER SYSTEM.<br>
-    <br>
-  </li>
-  <li>The SUBNET column in /etc/shorewall/rfc1918 has been renamed SUBNETS
-    and it is now possible to specify a list of addresses in that column.</li>
-  <li>The AllowNNTP action now also allows NNTP over SSL/TLS (NNTPS).</li>
-  <li>For consistency, the CLIENT PORT(S) column in the tcrules file has been
-    renamed SOURCE PORT(S).</li>
-  <li>The contents of /proc/sys/net/ip4/icmp_echo_ignore_all is now shown in
-    the output of "shorewall status".</li>
-  <li>A new IPTABLES option has been added to shorewall.conf. IPTABLES can be
-    used to designate the iptables executable to be used by Shorewall. If not
-    specified, the iptables executable determined by the PATH setting is
-  used.</li>
-  <li>You can now use the "shorewall show zones" command to display the
-    current contents of the zones. This is particularly useful if you use
-    dynamic zones (DYNAMIC_ZONES=Yes in shorewall.conf).<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; Example:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span
-    style="font-family: monospace;">ursa:/etc/shorewall # shorewall show
-    zones</span><br style="font-family: monospace;">
-    <span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;
-    Shorewall-2.2.0-Beta7 Zones at ursa - Sat Nov 27 11:18:25 PST
-    2004</span><br style="font-family: monospace;">
-    <span style="font-family: monospace;">&nbsp;</span><br
-    style="font-family: monospace;">
-    <span style="font-family: monospace;">&nbsp;&nbsp;&nbsp; loc</span><br
-    style="font-family: monospace;">
-    <span style="font-family: monospace;">&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;
-    eth0:192.168.1.0/24</span><br style="font-family: monospace;">
-    <span style="font-family: monospace;">&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;
-    eth1:1.2.3.4</span><br style="font-family: monospace;">
-    <span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;
-    net&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;</span><br
-    style="font-family: monospace;">
-    <span style="font-family: monospace;">&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;
-    eth0:0.0.0.0/0</span><br style="font-family: monospace;">
-    <span style="font-family: monospace;">&nbsp;&nbsp;&nbsp; WiFi</span><br
-    style="font-family: monospace;">
-    <span style="font-family: monospace;">&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;
-    eth1:0.0.0.0/0</span><br style="font-family: monospace;">
-    <span style="font-family: monospace;">&nbsp;&nbsp;&nbsp; sec</span><br
-    style="font-family: monospace;">
-    <span style="font-family: monospace;">&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;
-    eth1:0.0.0.0/0</span><br style="font-family: monospace;">
-    <span style="font-family: monospace;">&nbsp;</span><br
-    style="font-family: monospace;">
-    <span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;
-    ursa:/etc/shorewall #</span><br>
-    <br>
-  </li>
-  <li>Variable expansion may now be used with the INCLUDE directive.<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; Example:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; /etc/shorewall/params<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; <span
-    style="font-family: monospace;">FILE=/etc/foo/bar</span><br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Any other config file:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; <span
-    style="font-family: monospace;">INCLUDE $FILE</span><br>
-    <br>
-  </li>
-  <li>The output of "shorewall status" now includes the results of "ip -stat
-    link ls". This helps diagnose performance problems caused by link
-  errors.</li>
-  <li>Previously, when rate-limiting was specified in /etc/shorewall/policy
-    (LIMIT:BURST column), any traffic which exceeded the specified rate was
-    silently dropped. Now, if a log level is given in the entry (LEVEL
-    column) then drops are logged at that level at a rate of 5/min with a
-    burst of 5.</li>
-  <li>Recent 2.6 kernels include code that evaluates TCP packets based on TCP
-    Window analysis. This can cause packets that were previously classified
-    as NEW or ESTABLISHED to be classified as INVALID.<br>
-    <br>
-    The new kernel code can be disabled by including this command in your
-    /etc/shorewall/init file:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; <span style="font-family: monospace;">echo 1 &gt;
-    /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal</span><br>
-    <br>
-    Additional kernel logging about INVALID TCP packets may be obtained by
-    adding this command to /etc/shorewall/init:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; <span style="font-family: monospace;">echo 1 &gt;
-    /proc/sys/net/ipv4/netfilter/ip_conntrack_log_invalid</span><br>
-    <br>
-    Traditionally, Shorewall has dropped INVALID TCP packets early. The new
-    DROPINVALID option allows INVALID packets to be passed through the normal
-    rules chains by setting DROPINVALID=No.<br>
-    <br>
-    If not specified or if specified as empty (e.g., DROPINVALID="") then
-    DROPINVALID=Yes is assumed.<br>
-    <br>
-  </li>
-  <li>The "shorewall add" and "shorewall delete" commands now accept a list
-    of hosts to add or delete.<br>
-    <br>
-    Examples:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; <span style="font-family: monospace;">shorewall add
-    eth1:1.2.3.4 eth1:2.3.4.5 z12</span><br style="font-family: monospace;">
-    <span style="font-family: monospace;">&nbsp;&nbsp; shorewall delete
-    eth1:1.2.3.4 eth1:2.3.4.5 z12</span><br>
-    <br>
-    &nbsp;&nbsp;&nbsp; The above commands may also be written:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; <span style="font-family: monospace;">shorewall add
-    eth1:1.2.3.4,2.3.4.5 z12</span><br style="font-family: monospace;">
-    <span style="font-family: monospace;">&nbsp;&nbsp; shorewall delete
-    eth1:1.2.3.4,2.3.4.5 z12</span><br>
-    &nbsp;&nbsp;<br>
-  </li>
-  <li>TCP OpenVPN tunnels are now supported using the 'openvpn' tunnel type.
-    OpenVPN entries in /etc/shorewall/tunnels have this format:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; <span
-    style="font-family: monospace;">openvpn[:{tcp|udp}][:&lt;port&gt;]&nbsp;&nbsp;&nbsp;
-    &lt;zone&gt;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;
-    &lt;gateway&gt;</span><br>
-    <br>
-    Examples:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span
-    style="font-family: monospace;">openvpn:tcp&nbsp;&nbsp;&nbsp;
-    &nbsp;&nbsp;&nbsp;&nbsp; net&nbsp;&nbsp;&nbsp; 1.2.3.4&nbsp;&nbsp;&nbsp;
-    # TCP tunnel on port 1194</span><br style="font-family: monospace;">
-    <span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;
-    openvpn:3344&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; net&nbsp;&nbsp;&nbsp;
-    1.2.3.4&nbsp;&nbsp;&nbsp; # UDP on port 3344</span><br
-    style="font-family: monospace;">
-    <span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;
-    openvpn:tcp:4455&nbsp;&nbsp;&nbsp; net&nbsp;&nbsp;&nbsp;
-    1.2.3.4&nbsp;&nbsp;&nbsp; # TCP on port 4455</span><br>
-    <br>
-  </li>
-  <li>A new 'ipsecvpn' script is included in the tarball and in the RPM. The
-    RPM installs the file in the Documentation directory
-    (/usr/share/doc/packages/shorewall-2.2.0-0RC1).<br>
-    <br>
-    This script is intended for use on Roadwarrior laptops for establishing
-    an IPSEC SA to/from remote networks. The script has some limitations:</li>
-</ol>
-
-<div style="margin-left: 2em">
-<ul>
-  <li>Only one instance of the script may be used at a time.</li>
-  <li>Only the first SPD accessed will be instantiated at the remote gateway.
-    So while the script creates SPDs to/from the remote gateway and each
-    network listed in the NETWORKS setting at the front of the script, only
-    one of these may be used at a time.</li>
-</ul>
-</div>
-<ol start="39">
-  <li>The output of "shorewall status" now lists the loaded netfilter kernel
-    modules.</li>
-  <li>The range of UDP ports opened by the AllowTrcrt action has been
-    increased to 33434:33524.</li>
-  <li>The IANA has recently registered port 1194 for use by OpenVPN. In
-    previous versions of Shorewall (and OpenVPN), the default port was 5000
-    but has been changed to 1194 to conform to the new OpenVPN default.</li>
-</ol>
-
-<p><span style="font-weight: bold;">01/17/2005 - Shorewall 2.2.0 RC5<br>
-<br>
-</span> Problems Corrected:<br>
-</p>
-<ol>
-  <li>The AllowTrcrt action has been changed to allow up to 30 hops (same as
-    default for 'traceroute'). Previously, the action was documented as
-    allowing 20 hops but actually only allowed for 6 hops.<br>
-  </li>
-  <li>Using some lightweight shells, valid entries in /etc/shorewall/ecn
-    produce startup errors.</li>
-</ol>
-New Features:<br>
-
-<ol>
-  <li>A new AllowInvalid standard built-in action has been added. This action
-    accepts packets that are in the INVALID connection-tracking state.</li>
-</ol>
-<span style="font-weight: bold;"><a name="Mirrors"></a>01/16/2005 - New
-Shorewall Mirrors<br>
-<br>
-</span> Thanks to Lorenzo Martignoni and Nick Slikey, there are now Shorewall
-<a href="shorewall_mirrors.htm">mirrors</a> in Milan Italy and in Austin
-Texas. Thanks Lorenzo and Nick!<br>
-<span style="font-weight: bold;"><br>
-<a name="2_0_15"></a>01/12/2005 - Shorewall 2.0.15<br>
-</span> <br>
-Problems Corrected:<br>
-
-<ol>
-  <li>The range of ports opened by the AllowTrcrt action has been expanded to
-    33434:33524 to allow for a maximum of 30 hops.</li>
-  <li>Code mis-ported from 2.2.0 in release 2.0.14 caused the following error
-    during "shorewall start" where SYN rate-limiting is present in
-    /etc/shorewall/policy:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Bad argument `DROP'<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Try `iptables -h' or 'iptables --help' for
-    more information.<br>
-  </li>
-</ol>
-<span style="font-weight: bold;"><a name="2_2_0_RC4"></a>01/06/2005 -
-Shorewall 2.2.0 RC4<br>
-</span> <br>
-New Features:<br>
-
-<ol>
-  <li>A listing of loaded iptables kernel modules is now included in the
-    output of "shorewall status".<br>
-  </li>
-</ol>
-Problems Corrected.<br>
-
-<ol>
-  <li>Several problems associated with processing the IPSEC colummn in
-    /etc/shorewall/masq have been corrected.<br>
-  </li>
-</ol>
-<span style="font-weight: bold;"><a name="2_0_14"></a>01/03/2005 - Shorewall
-2.0.14<br>
-</span> <br>
-New Features:<br>
-
-<ol>
-  <li>Previously, when rate-limiting was specified in /etc/shorewall/policy
-    (LIMIT:BURST column), any traffic which exceeded the specified rate was
-    silently dropped. Now, if a log level is given in the entry (LEVEL
-    column) then drops are logged at that level at a rate of 5/min with a
-    burst of 5.<br>
-  </li>
-</ol>
-Problems Corrected:<br>
-
-<ol>
-  <li>A typo in the /etc/shorewall/interfaces file has been fixed.</li>
-  <li>"bad variable" error messages occurring during "shorewall stop" and
-    "shorewall clear" have been eliminated.</li>
-  <li>A misleading typo in /etc/shorewall/tunnels has been corrected. The
-    TYPE column for an IPIP tunnel should contain "ipip" rather than "ip".<br>
-  </li>
-</ol>
-<span style="font-weight: bold;"><a name="MandrakeRPMS"></a>12/31/2004 -
-Mandrake-specific RPMs available<br>
-<br>
-</span> Jack Coates has generously volunteered to provide Shorewall RPMs for
-use under Mandrake. You can download Jack's RPMs from <a target="_top"
-href="http://www.monkeynoodle.org/tmp/">http://www.monkeynoodle.org/tmp/</a><br>
-<br>
-<span style="font-weight: bold;"><a name="Redhat_Fedora"></a>12/31/2004 -
-Redhat/Fedora-specific RPMs available<br>
-</span> <br>
-Simon Matter has graciously volunteered to provide RPMs tailored for Redhat
-and Fedora. You can download Simon's RPMs from <a target="_top"
-href="http://www.invoca.ch/pub/packages/shorewall/">http://www.invoca.ch/pub/packages/shorewall/</a><br>
-<br>
-Thanks, Simon!<br>
-<br>
-<span style="font-weight: bold;"><a name="2_2_0_RC3"></a>12/30/2004 -
-Shorewall 2.2.0 RC3<br>
-</span> <br>
-Problems Corrected:<br>
-
-<ol>
-  <li>The following error message could appear during "shorewall stop" or
-    "shorewall clear":<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    local: lo:: bad variable name<br>
-    <br>
-  </li>
-  <li>The rate limiting example in /etc/shorewall/rules has been changed to
-    use the RATE LIMIT column.</li>
-  <li>Entries in /etc/shorewall/masq with the INTERFACE column containing
-    &lt;ifname&gt;:: (e.g., "eth0::") would generate a progress message but
-    would not generate an iptables rule.</li>
-  <li>A misleading typo in /etc/shorewall/tunnels has been corrected.<br>
-  </li>
-</ol>
-
-<p><br>
-</p>
-
-<p><span style="font-weight: bold;">12/24/2004 - Shorewall 2.2.0 RC2<br>
-<br>
-</span> New Features:<br>
-</p>
-<ol>
-  <li>By popular demand, the default port for Open VPN tunnels is now 1194
-    (the IANA-reserved port number for Open VPN).</li>
-</ol>
-<span style="font-weight: bold;"><a name="2_2_0_RC1"></a>12/19/2004 -
-Shorewall 2.2.0 RC1<br>
-<br>
-</span> Problems Corrected:<br>
-
-<ol>
-  <li>The syntax of the add and delete command has been clarified in the help
-    summary produced by /sbin/shorewall.</li>
-</ol>
-New Features:<br>
-
-<ol>
-  <li>TCP OpenVPN tunnels are now supported using the 'openvpn' tunnel type.
-    OpenVPN entries in /etc/shorewall/tunnels have this format:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; openvpn[:{tcp|udp}][:&lt;port&gt;]&nbsp;&nbsp;&nbsp;
-    &lt;zone&gt;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &lt;gateway&gt;<br>
-    <br>
-    Examples:<br>
-
-    <pre>    openvpn:tcp         net    1.2.3.4    # TCP tunnel on port 5000<br>
-    openvpn:3344        net    1.2.3.4    # UDP on port 3344<br>
-    openvpn:tcp:4455    net    1.2.3.4    # TCP on port 4455</pre>
-  </li>
-  <li>A new 'ipsecvpn' script is included in the tarball and in the RPM. The
-    RPM installs the file in the Documentation directory
-    (/usr/share/doc/packages/shorewall-2.2.0-0RC1).<br>
-    <br>
-    This script is intended for use on Roadwarrior laptops for establishing
-    an IPSEC SA to/from remote networks. The script has some limitations:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; - Only one instance of the script may be used at a
-    time.<br>
-    &nbsp;&nbsp;&nbsp; - Only the first SPD accessed will be instantiated at
-    the remote gateway. So while the script creates SPDs to/from the remote
-    gateway and each network listed in the NETWORKS setting at the front of
-    the script, only one of these may be used at a time.<br>
-  </li>
-</ol>
-<span style="font-weight: bold;"><a name="2_2_0_Beta8"></a>12/11/2004 -
-Shorewall 2.2.0 Beta 8<br>
-<br>
-</span> Problems Corrected:<br>
-
-<ol>
-  <li>A typo in the /etc/shorewall/interfaces file has been corrected.</li>
-  <li>Previously, the "add" and "delete" commands were generating incorrect
-    policy matches when policy match support was available.</li>
-</ol>
-New Features:<br>
-
-<ol>
-  <li>Recent 2.6 kernels include code that evaluates TCP packets based on TCP
-    Window analysis. This can cause packets that were previously classified
-    as NEW or ESTABLISHED to be classified as INVALID.<br>
-    <br>
-    The new kernel code can be disabled by including this command in your
-    /etc/shorewall/init file:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; echo 1 &gt;
-    /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal<br>
-    <br>
-    Additional kernel logging about INVALID TCP packets may be obtained by
-    adding this command to /etc/shorewall/init:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; echo 1 &gt;
-    /proc/sys/net/ipv4/netfilter/ip_conntrack_log_invalid<br>
-    <br>
-    Traditionally, Shorewall has dropped INVALID TCP packets early. The new
-    DROPINVALID option allows INVALID packets to be passed through the normal
-    rules chains by setting DROPINVALID=No.<br>
-    <br>
-    If not specified or if specified as empty (e.g., DROPINVALID="") then
-    DROPINVALID=Yes is assumed.<br>
-    <br>
-  </li>
-  <li>The "shorewall add" and "shorewall delete" commands now accept a list
-    of hosts to add or delete.<br>
-    <br>
-    Examples:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; shorewall add eth1:1.2.3.4 eth1:2.3.4.5 z12<br>
-    &nbsp;&nbsp;&nbsp; shorewall delete eth1:1.2.3.4 eth1:2.3.4.5 z12<br>
-    <br>
-    The above commands may also be written:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; shorewall add eth1:1.2.3.4,2.3.4.5 z12<br>
-    &nbsp;&nbsp;&nbsp; shorewall delete eth1:1.2.3.4,2.3.4.5 z12<br>
-    &nbsp;&nbsp;<br>
-  </li>
-</ol>
-<span style="font-weight: bold;"><a name="2_2_0_Beta7"></a>12/04/2004 -
-Shorewall 2.2.0 Beta 7<br>
-</span> <br>
-Problems Corrected:<br>
-
-<ol>
-  <li>The "shorewall add" and "shorewall delete" commands now work in a
-    bridged environment. The syntax is:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; shorewall
-    add &lt;interface&gt;[:&lt;port&gt;]:&lt;address&gt; &lt;zone&gt;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; shorewall
-    delete &lt;interface&gt;[:&lt;port&gt;]:&lt;address&gt; &lt;zone&gt;<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; Examples:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; shorewall
-    add br0:eth2:192.168.1.3 OK<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; shorewall
-    delete br0:eth2:192.168.1.3 OK<br>
-    <br>
-  </li>
-  <li>Previously, "shorewall save" created an out-of-sequence restore script.
-    The commands saved in the user's /etc/shorewall/start script were
-    executed prior to the Netfilter configuration being restored. This has
-    been corrected so that "shorewall save" now places those commands at the
-    end of the script.<br>
-    <br>
-    To accomplish this change, the "restore base" file
-    (/var/lib/shorewall/restore-base) has been split into two files:<br>
-    &nbsp;<br>
-    /var/lib/shorewall/restore-base -- commands to be executed before
-    Netfilter the configuration is restored.<br>
-    &nbsp;<br>
-    /var/lib/shorewall/restore-tail -- commands to be executed after the
-    Netfilter configuration is restored.<br>
-    <br>
-  </li>
-  <li>Previously, traffic from the firewall to a dynamic zone member host did
-    not need to match the interface specified when the host was added to the
-    zone. For example, if eth0:1.2.3.4 is added to dynamic zone Z then
-    traffic out of any firewall interface to 1.2.3.4 will obey the fw-&gt;Z
-    policies and rules. This has been corrected.</li>
-  <li>Shorewall uses the temporary chain 'fooX1234' to probe iptables for
-    detrmining which features are supported. Previously, if that chain
-    happened to exist when Shorewall was run, capabilities were
-  mis-detected.</li>
-</ol>
-New Features:<br>
-
-<ol>
-  <li>You can now use the "shorewall show zones" command to display the
-    current contents of the zones. This is particularly useful if you use
-    dynamic zones (DYNAMIC_ZONES=Yes in shorewall.conf).<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp; Example:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ursa:/etc/shorewall #
-    shorewall show zones<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Shorewall-2.2.0-Beta7 Zones at
-    ursa - Sat Nov 27 11:18:25 PST 2004<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; loc<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    eth0:192.168.1.0/24<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    eth1:1.2.3.4<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; net<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    eth0:0.0.0.0/0<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; WiFi<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    eth1:0.0.0.0/0<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; sec<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    eth1:0.0.0.0/0<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ursa:/etc/shorewall #<br>
-    <br>
-  </li>
-  <li>Variable expansion may now be used with the INCLUDE directive.<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp; Example:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /etc/shorewall/params<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    FILE=/etc/foo/bar<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Any other config file:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    INCLUDE $FILE<br>
-    <br>
-  </li>
-  <li>The output of "shorewall status" now includes the results of "ip -stat
-    link ls". This helps diagnose performance problems caused by link
-  errors.</li>
-  <li>Previously, when rate-limiting was specified in /etc/shorewall/policy
-    (LIMIT:BURST column), any traffic which exceeded the specified rate was
-    silently dropped. Now, if a log<br>
-    level is given in the entry (LEVEL column) then drops are logged at that
-    level at a rate of 5/min with a burst of 5.<br>
-  </li>
-</ol>
-<span style="font-weight: bold;"><a name="2_0_13"></a>12/02/2004 - Shorewall
-2.0.13<br>
-<br>
-</span> Problems Corrected:<br>
-
-<ol>
-  <li>A typo in /usr/share/shorewall/firewall caused the "shorewall add" to
-    issue an error message:<br>
-
-    <pre class="programlisting">/usr/share/shorewall/firewall: line 1: match_destination_hosts: command not found</pre>
-  </li>
-</ol>
-<span style="font-weight: bold;"><a name="2_0_12"></a>12/01/2004 - Shorewall
-2.0.12<br>
-</span> <br>
-Problems Corrected:<br>
-
-<ol>
-  <li>A typo in shorewall.conf (NETNOTSYN) has been corrected.</li>
-  <li>The "shorewall add" and "shorewall delete" commands now work in a
-    bridged environment. The syntax is:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; shorewall add
-    &lt;interface&gt;[:&lt;bridge port&gt;][:&lt;address&gt;] &lt;zone&gt;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; shorewall delete
-    &lt;interface&gt;[:&lt;bridge port&gt;][:&lt;address&gt;] &lt;zone&gt;<br>
-    &nbsp;<br>
-    Examples:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; shorewall add br0:eth2:192.168.1.3 OK<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; shorewall delete br0:eth2:192.168.1.3
-    OK<br>
-    <br>
-  </li>
-  <li>Previously, "shorewall save" created an out-of-sequence restore script.
-    The commands saved in the user's /etc/shorewall/start script were
-    executed prior to the Netfilter configuration being restored. This has
-    been corrected so that "shorewall save" now places those commands at the
-    end of the script.<br>
-    &nbsp;<br>
-    To accomplish this change, the "restore base" file
-    (/var/lib/shorewall/restore-base) has been split into two files:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; /var/lib/shorewall/restore-base -- commands to be executed
-    before the Netfilter configuration is restored.<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; /var/lib/shorewall/restore-tail -- commands to be executed
-    after the Netfilter configuration is restored.<br>
-    <br>
-  </li>
-  <li>Previously, traffic from the firewall to a dynamic zone member host did
-    not need to match the interface specified when the host was added to the
-    zone. For example, if eth0:1.2.3.4 is added to dynamic zone Z then
-    traffic out of any firewall interface to 1.2.3.4 will obey the fw-&gt;Z
-    policies and rules. This has been corrected.</li>
-</ol>
-New Features:<br>
-
-<ol>
-  <li>Variable expansion may now be used with the INCLUDE directive.<br>
-    &nbsp;<br>
-    Example:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /etc/shorewall/params<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    FILE=/etc/foo/bar<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Any other config file:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    INCLUDE $FILE<br>
-  </li>
-</ol>
-<span style="font-weight: bold;"><a name="2_2_0_Beta6"></a>11/26/2004 -
-Shorewall 2.2.0 Beta 6<br>
-<br>
-</span> Beta 5 was more or less DOA. Here's Beta 6.<br>
-<br>
-Problems Corrected:<br>
-
-<ol>
-  <li>Fixed a number of problems associated with not having an IPTABLES value
-    assigned in shorewall.conf</li>
-  <li>Corrected a 'duplicate chain' error on "shorewall add" when the 'mss'
-    option is present in /etc/shorewall/ipsec.<br>
-  </li>
-</ol>
-<span style="font-weight: bold;"><a name="2_2_0_Beta5"></a>11/26/2004 -
-Shorewall 2.2.0 Beta 5<br>
-</span> <br>
-Problems corrected:<br>
-
-<ol>
-  <li>A typo in shorewall.conf (NETNOTSYN) has been corrected.</li>
-</ol>
-New Features:<br>
-
-<ol>
-  <li>For consistency, the CLIENT PORT(S) column in the tcrules file has been
-    renamed SOURCE PORT(S).</li>
-  <li>The contents of /proc/sys/net/ip4/icmp_echo_ignore_all is now shown in
-    the output of "shorewall status".</li>
-  <li>A new IPTABLES option has been added to shorewall.conf. IPTABLES can be
-    used to designate the iptables executable to be used by Shorewall. If not
-    specified, the iptables executable determined by the PATH setting is
-    used.<br>
-  </li>
-</ol>
-<span style="font-weight: bold;"><a name="2_0_11"></a>11/23/2004 - Shorewall
-2.0.11<br>
-</span> <br>
-Problems corrected:<br>
-
-<ol>
-  <li>The INSTALL file now include special instructions for Slackware
-  users.</li>
-  <li>The bogons file has been updated.</li>
-  <li>Service names are replaced by port numbers in /etc/shorewall/tos.</li>
-  <li>A typo in the install.sh file that caused an error during a new install
-    has been corrected.</li>
-</ol>
-New Features:<br>
-
-<ol>
-  <li>The AllowNNTP action now allows NNTP over SSL/TLS (NTTPS).<br>
-  </li>
-</ol>
-<span style="font-weight: bold;"><a name="2_2_0_Beta4"></a>11/19/2004 -
-Shorewall 2.2.0 Beta 4<br>
-</span> <br>
-Problems Corrected:<br>
-
-<ol>
-  <li>A cut and paste error resulted in some nonsense in the description of
-    the IPSEC column in /etc/shorewall/masq.</li>
-  <li>A typo in /etc/shorewall/rules has been corrected.</li>
-  <li>The bogons file has been updated.</li>
-  <li>The "shorewall add" command previously reported success but did nothing
-    -- now it works.</li>
-</ol>
-New Features:<br>
-
-<ol>
-  <li>The AllowNNTP action now allows NNTP over SSL/TLS (NNTPS).<br>
-  </li>
-</ol>
-<span style="font-weight: bold;"><a name="2_2_0_Beta3"></a>11/09/2004 -
-Shorewall 2.2.0 Beta 3<br>
-</span> <br>
-Problems Corrected:<br>
-
-<ol>
-  <li>Missing '#' in the rfc1918 file has been corrected.</li>
-  <li>The INSTALL file now includes special instructions for Slackware
-  users.</li>
-</ol>
-New Features:<br>
-
-<ol>
-  <li>In CLASSIFY rules (/etc/shorewall/tcrules), an interface name may now
-    appear in the DEST column as in:<br>
-
-    <pre>        #MARK/      SOURCE       DEST      PROTO     PORT(S)<br>
-        #CLASSIFY<br>
-        1:30        -            eth0      tcp       25</pre>
-  </li>
-</ol>
-<span style="font-weight: bold;"><a name="2_2_0_Beta2"></a>11/02/2004 -
-Shorewall 2.2.0 Beta 2<br>
-<br>
-</span> Problems Corrected:<br>
-
-<ol>
-  <li>The "shorewall check" command results in the (harmless) error
-    message:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /usr/share/shorewall/firewall:
-    line 2753:<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    check_dupliate_zones: command not found<br>
-    <br>
-  </li>
-  <li>The AllowNTP standard action now allows outgoing responses to
-    broadcasts.</li>
-  <li>A clarification has been added to the hosts file's description of the
-    'ipsec' option pointing out that the option is redundent if the zone
-    named in the ZONE column has been designated an IPSEC zone in the
-    /etc/shorewall/ipsec file.</li>
-</ol>
-New Features:<br>
-
-<ol>
-  <li>The SUBNET column in /etc/shorewall/rfc1918 has been renamed SUBNETS
-    and it is now possible to specify a list of addresses in that column.<br>
-  </li>
-</ol>
-<span style="font-weight: bold;"><a name="2_0_10"></a>10/25/2004 - Shorewall
-2.0.10<br>
-</span> <br>
-Problems Corrected:<br>
-
-<ol>
-  <li>The GATEWAY column was previously ignored in 'pptpserver' entries in
-    /etc/shorewall/tunnels.</li>
-  <li>When log rule numbers are included in the LOGFORMAT, duplicate rule
-    numbers could previously be generated.</li>
-  <li>The /etc/shorewall/tcrules file now includes a note to the effect that
-    rule evaluation continues after a match.</li>
-  <li>The error message produced if Shorewall couldn't obtain the routes
-    through an interface named in the SUBNET column of /etc/shorewall/masq
-    was less than helpful since it didn't include the interface name.<br>
-  </li>
-</ol>
-New Features:<br>
-
-<ol>
-  <li>The "shorewall status" command has been enhanced to include the values
-    of key /proc settings:<br>
-    <br>
-    Example from a two-interface firewall:<br>
-    <br>
-    /proc<br>
-    <br>
-    &nbsp;&nbsp; /proc/sys/net/ipv4/ip_forward = 1<br>
-    &nbsp;&nbsp; /proc/sys/net/ipv4/conf/all/proxy_arp = 0<br>
-    &nbsp;&nbsp; /proc/sys/net/ipv4/conf/all/arp_filter = 0<br>
-    &nbsp;&nbsp; /proc/sys/net/ipv4/conf/all/rp_filter = 0<br>
-    &nbsp;&nbsp; /proc/sys/net/ipv4/conf/default/proxy_arp = 0<br>
-    &nbsp;&nbsp; /proc/sys/net/ipv4/conf/default/arp_filter = 0<br>
-    &nbsp;&nbsp; /proc/sys/net/ipv4/conf/default/rp_filter = 0<br>
-    &nbsp;&nbsp; /proc/sys/net/ipv4/conf/eth0/proxy_arp = 0<br>
-    &nbsp;&nbsp; /proc/sys/net/ipv4/conf/eth0/arp_filter = 0<br>
-    &nbsp;&nbsp; /proc/sys/net/ipv4/conf/eth0/rp_filter = 0<br>
-    &nbsp;&nbsp; /proc/sys/net/ipv4/conf/eth1/proxy_arp = 0<br>
-    &nbsp;&nbsp; /proc/sys/net/ipv4/conf/eth1/arp_filter = 0<br>
-    &nbsp;&nbsp; /proc/sys/net/ipv4/conf/eth1/rp_filter = 0<br>
-    &nbsp;&nbsp; /proc/sys/net/ipv4/conf/lo/proxy_arp = 0<br>
-    &nbsp;&nbsp; /proc/sys/net/ipv4/conf/lo/arp_filter = 0<br>
-    &nbsp;&nbsp; /proc/sys/net/ipv4/conf/lo/rp_filter = 0<br>
-  </li>
-</ol>
-<br>
-<span style="font-weight: bold;"><a name="2_2_0_Beta1"></a>10/24/2004 -
-Shorewall 2.2.0 Beta1<br>
-<br>
-</span> The first beta in the 2.2 series is now available. Download location
-is:<br>
-<br>
-
-
-<div style="margin-left: 40px;">
-<a
-href="http://shorewall.net/pub/shorewall/2.2-Beta/shorewall-2.2.0-Beta1">http://shorewall.net/pub/shorewall/2.2-Beta/shorewall-2.2.0-Beta1</a><br>
-<a target="_top"
-href="ftp://shorewall.net/pub/shorewall/2.2-Beta/shorewall-2.2.0-Beta1">ftp://shorewall.net/pub/shorewall/2.2-Beta/shorewall-2.2.0-Beta1</a><br>
-</div>
-
-<p>The features available in this release and the migration considerations
-are covered in the <a
-href="http://shorewall.net/pub/shorewall/2.2-Beta/shorewall-2.2.0-Beta1/releasenotes.txt">release
-notes</a>. Highlights include:<br>
-</p>
-<ol>
-  <li>The behavior produced by specifying a log level in an action invocation
-    is now much more rational. Previously, all packets sent to the action
-    were logged; now each rule within the invoked action behaves as if
-    logging had been specified on it.</li>
-  <li>Support for the 2.6 Kernel's native IPSEC implementation is now
-    available.</li>
-  <li>Support for ipp2p is included.</li>
-  <li>Support for the iptables CONNMARK facility is now included in
-  Shorewall.</li>
-  <li>A new LOGALLNEW option facilitates problem analysis.</li>
-  <li>Users with a large static blacklist can now defer loading the blacklist
-    until after the rest of the ruleset has been enabled. Doing so can
-    decrease substantially the amount of time that connections are disabled
-    during <span style="font-weight: bold;">shorewall [re]start</span>.</li>
-  <li>Support for the iptables 'iprange match' feature has been enabled.
-    Users whose kernel and iptables contain this feature can use ip address
-    ranges in most places in their Shorewall configuration where a CIDR
-    netowrk can be used.</li>
-  <li>Accepting of source routing and martian logging may now be
-    enabled/disabled on each interface.</li>
-  <li>Shorewall now supports the CLASSIFY iptable target.</li>
-</ol>
-
-<p><span style="font-weight: bold;"><a name="2_0_9"></a>9/23/2004 - Shorewall
-2.0.9<br>
-</span><br>
-Problems Corrected:<br>
-</p>
-<ol>
-  <li>Previously, an empty PROTO column or a value of "all" in that column
-    would cause errors when processing the /etc/shorewall/tcrules file.</li>
-</ol>
-New Features:<br>
-
-<ol>
-  <li>The "shorewall status" command now includes the output of "brctl show"
-    if the bridge tools are installed.<br>
-  </li>
-</ol>
-
-<p><a name="SupportChange"><b>9/20/2004 &acirc;&#x80;&#x93; Change in
-Shorewall Support</b></a></p>
-
-<p style="">Friends,</p>
-
-<p style="">The demands that my job and my personal life are currently
-placing on me are such that supporing Shorewall to the extent that I have
-been doing is just not possible any more.</p>
-
-<p style="">I will continue to be active on the development list and will
-continue to develop Shorewall if at all possible.</p>
-
-<p style="">I will also continue to read the user's list and will help with
-problems that interest me. But I am no longer going to hop on every problem
-as soon as I see it.</p>
-
-<p style="">This change means that I'm going to have to depend on you folks
-to help each other; I'm confident that we can make this work.</p>
-
-<p><a name="2_0_8"></a><b>8/22/2004 - Shorewall 2.0.8<br>
-</b><br>
-Problems Corrected:</p>
-<ol>
-  <li><p>Entries in the USER/GROUP column of an action file (made from
-    action.template) may be ignored or cause odd errors.</p>
-  </li>
-</ol>
-
-<p><a name="2_0_7"></a><b>7/29/2004 - Shorewall 2.0.7<br>
-<br>
-</b> Problems Corrected:</p>
-<ol>
-  <li><p style="margin-bottom: 0in;">The PKTTYPE option introduced in version
-    2.0.6 is now used when generating rules to REJECT packets. Broadcast
-    packets are silently dropped rather than being rejected with an ICMP
-    (which is a protocol violation) and users whose kernels have broken
-    packet type match support are likely to see messages reporting this
-    violation. Setting PKTTYPE=No should cause these messages to cease.</p>
-  </li>
-  <li><p style="margin-bottom: 0in;">Multiple interfaces with the 'blacklist'
-    option no longer result in an error message at startup.</p>
-  </li>
-  <li><p>The following has been added to /etc/shorewall/bogons:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0&nbsp;&nbsp; RETURN<br>
-    <br>
-    This prevents the 'nobogons' option from logging DHCP 'DISCOVER'
-    broadcasts.</p>
-  </li>
-</ol>
-
-<p>New Features:</p>
-<ol>
-  <li><p>To improve supportability, the "shorewall status" command now
-    includes IP and Route configuration information.<br>
-    <br>
-    &nbsp;&nbsp; Example:<br>
-    <br>
-    &nbsp;&nbsp; <font face="monospace">IP Configuration</font><br>
-    <br>
-    &nbsp;&nbsp; <font face="monospace">1: lo: &lt;LOOPBACK,UP&gt; mtu 16436
-    qdisc noqueue</font><br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font face="monospace">link/loopback
-    00:00:00:00:00:00 brd 00:00:00:00:00:00</font><br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font face="monospace">inet 127.0.0.1/8
-    brd 127.255.255.255 scope host lo</font><br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font face="monospace">inet6 ::1/128 scope
-    host</font><br>
-    &nbsp;&nbsp; <font face="monospace">2: eth0:
-    &lt;BROADCAST,MULTICAST,PROMISC,UP&gt; mtu 1500 qdisc pfifo_fast qlen
-    1000</font><br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font face="monospace">link/ether
-    00:a0:c9:15:39:78 brd ff:ff:ff:ff:ff:ff</font><br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font face="monospace">inet6
-    fe80::2a0:c9ff:fe15:3978/64 scope link</font><br>
-    &nbsp;&nbsp; <font face="monospace">3: eth1:
-    &lt;BROADCAST,MULTICAST,PROMISC,UP&gt; mtu 1500 qdisc pfifo_fast qlen
-    1000</font><br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font face="monospace">link/ether
-    00:a0:c9:a7:d7:bf brd ff:ff:ff:ff:ff:ff</font><br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font face="monospace">inet6
-    fe80::2a0:c9ff:fea7:d7bf/64 scope link</font><br>
-    &nbsp;&nbsp; <font face="monospace">5: sit0@NONE: &lt;NOARP&gt; mtu 1480
-    qdisc noop</font><br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font face="monospace">link/sit 0.0.0.0
-    brd 0.0.0.0</font><br>
-    &nbsp;&nbsp; <font face="monospace">6: eth2:
-    &lt;BROADCAST,MULTICAST,PROMISC,UP&gt; mtu 1500 qdisc pfifo_fast qlen
-    1000</font><br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font face="monospace">link/ether
-    00:40:d0:07:3a:1b brd ff:ff:ff:ff:ff:ff</font><br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font face="monospace">inet6
-    fe80::240:d0ff:fe07:3a1b/64 scope link</font><br>
-    &nbsp;&nbsp; <font face="monospace">7: br0:
-    &lt;BROADCAST,MULTICAST,NOTRAILERS,UP&gt; mtu 1500 qdisc
-    noqueue</font><br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font face="monospace">link/ether
-    00:40:d0:07:3a:1b brd ff:ff:ff:ff:ff:ff</font><br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font face="monospace">inet 192.168.1.3/24
-    brd 192.168.1.255 scope global br0</font><br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font face="monospace">inet6
-    fe80::240:d0ff:fe07:3a1b/64 scope link</font><br>
-    <br>
-    &nbsp;&nbsp; <font face="monospace">Routing Rules</font><br>
-    <br>
-    &nbsp;&nbsp; <font face="monospace">0:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; from
-    all lookup local</font><br>
-    &nbsp;&nbsp; <font face="monospace">32765:&nbsp; from all
-    fwmark&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ca lookup www.out</font><br>
-    &nbsp;&nbsp; <font face="monospace">32766:&nbsp; from all lookup
-    main</font><br>
-    &nbsp;&nbsp; <font face="monospace">32767:&nbsp; from all lookup
-    default</font><br>
-    <br>
-    &nbsp;&nbsp; <font face="monospace">Table local:</font><br>
-    <br>
-    &nbsp;&nbsp; <font face="monospace">broadcast 192.168.1.0 dev br0&nbsp;
-    proto kernel&nbsp; scope link&nbsp; src 192.168.1.3</font><br>
-    &nbsp;&nbsp; <font face="monospace">broadcast 127.255.255.255 dev
-    lo&nbsp; proto kernel&nbsp; scope link&nbsp; src 127.0.0.1</font><br>
-    &nbsp;&nbsp; <font face="monospace">local 192.168.1.3 dev br0&nbsp; proto
-    kernel&nbsp; scope host&nbsp; src 192.168.1.3</font><br>
-    &nbsp;&nbsp; <font face="monospace">broadcast 192.168.1.255 dev br0&nbsp;
-    proto kernel&nbsp; scope link&nbsp; src 192.168.1.3</font><br>
-    &nbsp;&nbsp; <font face="monospace">broadcast 127.0.0.0 dev lo&nbsp;
-    proto kernel&nbsp; scope link&nbsp; src 127.0.0.1</font><br>
-    &nbsp;&nbsp; <font face="monospace">local 127.0.0.1 dev lo&nbsp; proto
-    kernel&nbsp; scope host&nbsp; src 127.0.0.1</font><br>
-    &nbsp;&nbsp; <font face="monospace">local 127.0.0.0/8 dev lo&nbsp; proto
-    kernel&nbsp; scope host&nbsp; src 127.0.0.1</font><br>
-    <br>
-    &nbsp;&nbsp; <font face="monospace">Table www.out:</font><br>
-    <br>
-    &nbsp;&nbsp; <font face="monospace">default via 192.168.1.3 dev
-    br0</font><br>
-    <br>
-    &nbsp;&nbsp; <font face="monospace">Table main:</font><br>
-    <br>
-    &nbsp;&nbsp; <font face="monospace">192.168.1.0/24 dev br0&nbsp; proto
-    kernel&nbsp; scope link&nbsp; src 192.168.1.3</font><br>
-    &nbsp;&nbsp; <font face="monospace">default via 192.168.1.254 dev
-    br0</font><br>
-    <br>
-    &nbsp;&nbsp; <font face="monospace">Table default:</font></p>
-  </li>
-</ol>
-
-<p><a name="2_0_6"></a><b>7/16/2004 - Shorewall 2.0.6<br>
-<br>
-</b> Problems Corrected:</p>
-<ul>
-  <li><p style="margin-bottom: 0in;">Some users have reported the packet type
-    match option in iptables/Netfilter failing to match certain broadcast
-    packets. The result is that the firewall log shows a lot of broadcast
-    packets.<br>
-    <br>
-    Other users have complained of the following message when starting
-    Shorewall:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    modprobe: cant locate module ipt_pkttype<br>
-    <br>
-    Users experiencing either of these problems can use PKTTYPE=No in
-    shorewall.conf to cause Shorewall to use IP address filtering of
-    broadcasts rather than packet type.</p>
-  </li>
-  <li><p style="margin-bottom: 0in;">The shorewall.conf and zones file are no
-    longer given execute permission by the installer script.</p>
-  </li>
-  <li><p>ICMP packets that are in the INVALID state are now dropped by the
-    Reject and Drop default actions. They do so using the new 'dropInvalid'
-    builtin action.</p>
-  </li>
-</ul>
-
-<p><a name="2_0_5"></a><b>7/10/2004 - Shorewall 2.0.5<br>
-</b><br>
-Problems Corrected:</p>
-<ul>
-  <li><p style="margin-bottom: 0in;">If DISABLE_IPV6=Yes in shorewall.conf
-    then harmless error messages referring to $RESTOREBASE are generated
-    during <b>shorewall stop</b>.</p>
-  </li>
-  <li><p>An anachronistic comment concerning a mangle option has been removed
-    from shorewall.conf.</p>
-  </li>
-</ul>
-
-<p><a name="2_0_4"></a><b>7/06/2004 - Shorewall 2.0.4<br>
-</b><br>
-Problems Corrected:</p>
-<ul>
-  <li><p>Rules with $FW as the source zone and that specify logging can cause
-    "shorewall start" to fail.</p>
-  </li>
-</ul>
-
-<p><a name="Release_Model"></a><b>7/03/2004 - New Shorewall Release Model<br>
-<br>
-</b> Effective today, Shorewall is adopting a new release model which takes
-ideas from the one used in the Linux Kernel and from the release model for
-Postfix.</p>
-<ol>
-  <li><p style="margin-bottom: 0in;">Releases continue to have a three-level
-    identification <i>x.y.z</i> (e.g., 2.0.3).</p>
-  </li>
-  <li><p style="margin-bottom: 0in;">The first two levels (<i>x.y)</i>
-    designate the <i>Major Release Number</i> (e.g., 2.0)</p>
-  </li>
-  <li><p style="margin-bottom: 0in;">The third level (<i>z</i>) designates
-    the <i>Minor Release Number</i>.</p>
-  </li>
-  <li><p style="margin-bottom: 0in;">Even numbered major releases (e.g.,
-    <i>1.4, 2.0, 2.2, ...)</i> are <i>Stable Releases</i>. No new features
-    are added to stable releases and new minor releases of a stable release
-    will only contain bug fixes. Installing a new minor release for the major
-    release that you are currently running involves no migration issues (for
-    example, if you are running 1.4.10 and I release 1.4.11, your current
-    configuration is 100% compatible with the new release).</p>
-  </li>
-  <li><p style="margin-bottom: 0in;">Support is available through the <a
-    href="http://lists.shorewall.net/">Mailing List</a> for the two most
-    recent Stable Releases.</p>
-  </li>
-  <li><p style="margin-bottom: 0in;">Odd numbered major releases (e.g., 2.1,
-    2.3, ...) are <i>Development Releases</i>. Development releases are where
-    new functionality is introduced. Documentation for new features will be
-    available but it may not be up to the standards of the stable release
-    documentation. Sites running Development Releases should be prepared to
-    play an active role in testing new features. Bug fixes and problem
-    resolution for the development release take a back seat to support of the
-    stable releases. Problem reports for the current development release
-    should be sent to the <a
-    href="mailto:shorewall-devel@lists.shorewall.net">Shorewall Development
-    Mailing List</a>.</p>
-  </li>
-  <li><p style="margin-bottom: 0in;">When the level of functionality of the
-    current development release is judged adaquate, the Beta period for a new
-    Stable release will begin. Beta releases have identifications of the form
-    <i>x.y.0-BetaN</i> where <i>x.y</i> is the number of the next Stable
-    Release and <i>N</i>=1,2,3... . Betas are expected to occur rougly once
-    per year. Beta releases may contain new functionality not present in the
-    previous beta release (e.g., 2.2.0-Beta4 may contain functionality not
-    present in 2.2.0-Beta3). When I'm confident that the current Beta release
-    is stable, I will release the first <i>Release Candidate.</i> Release
-    candidates have identifications of the form <i>x.y.0-RCn</i> where
-    <i>x.y</i> is the number of the next Stable Release and <i>n</i>=1,2,3...
-    . Release candidates contain no new functionailty -- they only contain
-    bug fixes. When the stability of the current release candidate is judged
-    to be sufficient then that release candidate will be released as the new
-    stable release (e.g., 2.2.0). At that time, the new stable release and
-    the prior stable release are those that are supported.</p>
-  </li>
-  <li><p style="margin-bottom: 0in;">What does it mean for a major release to
-    be <i>supported?</i> It means that I will answer questions about the
-    release and that if a bug is found, I will fix the bug and include the
-    fix in the next minor release.</p>
-  </li>
-  <li><p>Between minor releases, bug fixes will continue to be made available
-    through the Errata page for each major release.</p>
-  </li>
-</ol>
-
-<p>The immediate implications of this change are as follows:</p>
-<ol>
-  <li><p style="margin-bottom: 0in;">The functionality of the 2.0 major
-    release is frozen at the level of minor release 2.0.3.</p>
-  </li>
-  <li><p style="margin-bottom: 0in;">The two major releases currently
-    supported are 1.4 and 2.0.</p>
-  </li>
-  <li><p style="margin-bottom: 0in;">I will be opening the 2.1 development
-    release shortly with the release of 2.1.0.</p>
-  </li>
-  <li><p>Bug-fix releases with identifications of the form <i>x.y.zX</i>
-    where X=a,b,c,... (e.g., 2.0.3c) will not be seen in the future.</p>
-  </li>
-</ol>
-
-<p><a name="2_0_3c"></a><b>7/02/2004 - Shorewall 2.0.3c<br>
-<br>
-</b> Problems Corrected<b>:</b></p>
-<ol>
-  <li><p style="margin-bottom: 0in;">Error messages regarding $RESTOREBASE
-    occur during <b>shorewall stop</b></p>
-  </li>
-  <li><p>If CLEAR_TC=Yes in <tt>shorewall.conf</tt>, <b>shorewall stop</b>
-    fails without removing the lock file.</p>
-  </li>
-</ol>
-
-<p><a name="2_0_3b"></a><b><br>
-6/30/2004 - Shorewall 2.0.3b and Shorewall 1.4.10g<br>
-<br>
-</b> Problems Corrected:</p>
-<ol>
-  <li><p style="margin-bottom: 0in;">The security vulnerability fix released
-    in Shorewall 2.0.3a failed under Slackware 9.1.</p>
-  </li>
-  <li><p>The security vulnerability fix released in Shorewall 2.0.3a failed
-    if mktemp was not installed.</p>
-  </li>
-</ol>
-
-<p><a name="2_0_3a"></a><b>6/28/2004 - Shorewall 2.0.3a and Shorewall
-1.4.10f<br>
-<br>
-</b> Problems Corrected:</p>
-<ol>
-  <li><p style="margin-bottom: 0in;">Javier Fern&Atilde;&iexcl;ndez-Sanguino
-    Pe&Atilde;&plusmn;a has discovered an exploitable vulnerability in the
-    way that Shorewall handles temporary files and directories. The
-    vulnerability can allow a non-root user to cause arbitrary files on the
-    system to be overwritten. LEAF Bering and Bering uClibc users are
-    generally not at risk due to the fact that LEAF boxes do not typically
-    allow logins by non-root users.</p>
-  </li>
-  <li><p>(2.0.3a only) A non-empty DEST entry in /etc/shorewall/tcrules will
-    generate an error and Shorewall fails to start.</p>
-  </li>
-</ol>
-
-<p style="margin-left: 0.42in;">Note:: Slackware users may need the
-'functions' file from CVS (STABLE/ project for 1.4.10f and STABLE2/ project
-for 2.0.3a) to prevent startup errors with these versions installed. These
-updatged files are also available from the Errata (<a
-href="errata.htm">2.0,</a> <a href="1.4/errata.htm">1.4</a>).</p>
-
-<p><a name="2_0_3"></a><b>6/23/2004 - Shorewall 2.0.3<br>
-<br>
-</b> Problems Corrected:</p>
-<ol>
-  <li><p style="margin-bottom: 0in;">The 'firewall' script is not purging
-    temporary restore files in /var/lib/shorewall. These files have names of
-    the form "restore-nnnnn".</p>
-  </li>
-  <li><p style="margin-bottom: 0in;">The /var/lib/shorewall/restore script
-    did not load the kernel modules specified in /etc/shorewall/modules.</p>
-  </li>
-  <li><p style="margin-bottom: 0in;">Specifying a null common action in
-    /etc/shorewall/actions (e.g., :REJECT) results in a startup error.</p>
-  </li>
-  <li><p style="margin-bottom: 0in;">If /var/lib/shorewall does not exist,
-    shorewall start fails.</p>
-  </li>
-  <li><p style="margin-bottom: 0in;">DNAT rules with a dynamic source zone
-    don't work properly. When used, these rules cause the rule to be checked
-    against ALL input, not just input from the designated zone.</p>
-  </li>
-  <li><p style="margin-bottom: 0in;">The install.sh script reported
-    installing some files in /etc/shorewall when the files were actually
-    installed in /usr/share/shorewall.</p>
-  </li>
-  <li><p style="margin-bottom: 0in;">Shorewall checks netfilter capabilities
-    before loading kernel modules. Hence if kernel module autoloading isn't
-    enabled, the capabilities will be misdetected.</p>
-  </li>
-  <li><p style="margin-bottom: 0in;">The 'newnotsyn' option in
-    /etc/shorewall/hosts has no effect.</p>
-  </li>
-  <li><p style="margin-bottom: 0in;">The file /etc/init.d/shorewall now gets
-    proper ownership when the RPM is built by a non-root user.</p>
-  </li>
-  <li><p style="margin-bottom: 0in;">Rules that specify bridge ports in both
-    the SOURCE and DEST columns no longer cause "shorewall start" to fail.</p>
-  </li>
-  <li><p style="margin-bottom: 0in;">Comments in the rules file have been
-    added to advise users that "all" in the SOURCE or DEST column does not
-    affect intra-zone traffic.</p>
-  </li>
-  <li><p>With BLACKLISTNEWONLY=Yes, ICMP packets with state INVALID are now
-    passed through the blacklisting chains. Without this change, it is not
-    possible to blacklist hosts that are mounting certain types of ICMP-based
-    DOS attacks.</p>
-  </li>
-</ol>
-
-<p>Issues when migrating from Shorewall 2.0.2 to Shorewall 2.0.3:</p>
-<ol>
-  <li><p>The 'dropNonSyn' standard builtin action has been replaced with the
-    'dropNotSyn' standard builtin action. The old name can still be used but
-    will generate a warning.</p>
-  </li>
-</ol>
-
-<p>New Features:</p>
-<ol>
-  <li><p style="margin-bottom: 0in;">Shorewall now supports multiple saved
-    configurations.</p>
-    <ol>
-      <li><p style="margin-bottom: 0in;">The default saved configuration
-        (restore script) in /var/lib/shorewall is now specified using the
-        RESTOREFILE option in shorewall.conf. If this variable isn't set then
-        to maintain backward compatibility, 'restore' is assumed.<br>
-        <br>
-        The value of RESTOREFILE must be a simple file name; no slashes ("/")
-        may be included.</p>
-      </li>
-      <li><p style="margin-bottom: 0in;">The "save" command has been extended
-        to be able to specify the name of a saved configuration.<br>
-        <br>
-        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-        shorewall save [ &lt;file name&gt; ]<br>
-        <br>
-        The current state is saved to /var/lib/shorewall/&lt;file name&gt;.
-        If no &lt;file name&gt; is given, the configuration is saved to the
-        file determined by the RESTOREFILE setting.</p>
-      </li>
-      <li><p style="margin-bottom: 0in;">The "restore" command has been
-        extended to be able to specify the name of a saved configuration:<br>
-        <br>
-        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; shorewall
-        restore [ &lt;file name&gt; ]<br>
-        <br>
-        The firewall state is restored from /var/lib/shorewall/&lt;file
-        name&gt;. If no &lt;file name&gt; is given, the firewall state is
-        restored from the file determined by the RESTOREFILE setting.</p>
-      </li>
-      <li><p style="margin-bottom: 0in;">The "forget" command has changed.
-        Previously, the command unconditionally removed the
-        /var/lib/shorewall/save file which records the current dynamic
-        blacklist. The "forget" command now leaves that file alone.<br>
-        <br>
-        Also, the "forget" command has been extended to be able to specify
-        the name of a saved configuration:<br>
-        <br>
-        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-        shorewall forget [ &lt;file name&gt; ]<br>
-        <br>
-        The file /var/lib/shorewall/&lt;file name&gt; is removed. If no
-        &lt;file name&gt; is given, the file determined by the RESTOREFILE
-        setting is removed.</p>
-      </li>
-      <li><p style="margin-bottom: 0in;">The "shorewall -f start" command
-        restores the state from the file determined by the RESTOREFILE
-        setting.</p>
-      </li>
-    </ol>
-  </li>
-  <li><p style="margin-bottom: 0in;">"!" is now allowed in accounting
-    rules.</p>
-  </li>
-  <li><p style="margin-bottom: 0in;">Interface names appearing within the
-    configuration are now verified. Interface names must match the name of an
-    entry in /etc/shorewall/interfaces (or if bridging is enabled, they must
-    match the name of an entry in /etc/shorewall/interfaces or the name of a
-    bridge port appearing in /etc/shorewall/hosts).</p>
-  </li>
-  <li><p style="margin-bottom: 0in;">A new 'rejNotSyn' built-in standard
-    action has been added. This action responds to "New not SYN" packets with
-    an RST.<br>
-    <br>
-    The 'dropNonSyn' action has been superceded by the new 'dropNotSyn'
-    action. The old name will be accepted until the next major release of
-    Shorewall but will generate a warning.<br>
-    <br>
-    Several new logging actions involving "New not SYN" packets have been
-    added:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; logNewNotSyn&nbsp; -- logs the
-    packet with disposition = LOG<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dLogNewNotSyn -- logs the
-    packet with disposition = DROP<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; rLogNewNotSyn -- logs the
-    packet with disposition = REJECT<br>
-    <br>
-    The packets are logged at the log level specified in the LOGNEWNOTSYN
-    option in shorewall.conf. If than option is empty or not specified, then
-    'info' is assumed.<br>
-    <br>
-    Examples (In all cases, set NEWNOTSYN=Yes in shorewall.conf):</p>
-    <ol>
-      <li><p style="margin-bottom: 0in;">To simulate the behavior of
-        NEWNOTSYN=No:</p>
-        <ol>
-          <li><p style="margin-bottom: 0in;">Add 'NoNewNotSyn' to
-            /etc/shorewall/actions.</p>
-          </li>
-          <li><p>Create /etc/shorewall/action.NoNewNotSyn containing:<br>
-            <br>
-            &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-            dLogNotSyn<br>
-            &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-            dropNotSyn</p>
-          </li>
-          <li><p>Early in your rules file, place:<br>
-            <br>
-            &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-            NoNewNotSyn&nbsp;&nbsp; all&nbsp;&nbsp;
-            all&nbsp;&nbsp;&nbsp;&nbsp; tcp</p>
-          </li>
-        </ol>
-      </li>
-      <li><p style="margin-bottom: 0in;">Drop 'New not SYN' packets from the
-        net only. Don't log them:</p>
-        <ol>
-          <li><p>Early in your rules file, place:<br>
-            <br>
-            &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-            dropNotSyn&nbsp;&nbsp;&nbsp;
-            net&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; all&nbsp;&nbsp;
-            tcp</p>
-          </li>
-        </ol>
-      </li>
-    </ol>
-  </li>
-  <li><p>Slackware users no longer have to modify the install.sh script
-    before installation. Tuomo Soini has provided a change that allows the
-    INIT and FIREWALL variables to be specified outside the script as in:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DEST=/etc/rc.d INIT=rc.firewall
-    ./install.sh</p>
-  </li>
-</ol>
-
-<p><b>6/3/2004 - Shorewall 2.0.2f<br>
-</b></p>
-
-<p>Fixes one problem:<br>
-</p>
-<ol>
-  <li>Versions 2.0.2d and 2.0.2e fail to load kernel modules unless
-    MODULE_SUFFIX is set in shorewall.conf<br>
-  </li>
-</ol>
-
-<p><b>6/2/2004 - Shorewall 2.0.2e<br>
-</b></p>
-
-<p>One problem corrected:<br>
-</p>
-<ol>
-  <li>LOG rules within an action generate two Netfilter logging rules.<br>
-  </li>
-</ol>
-
-<p><b>5/28/2004 - Shorewall 2.0.2d<br>
-</b><br>
-One problem corrected:<br>
-</p>
-<ol>
-  <li>Shorewall was checking capabilities before loading kernel modules.
-    Consequently, if kernel module autoloading was disabled, the capabilities
-    were mis-detected.<br>
-  </li>
-</ol>
-
-<p><b>5/21/2004 - Shorewall 2.0.2c</b></p>
-One problem corrected:<br>
-
-<ol>
-  <li>&nbsp;DNAT rules with a dynamic source zone don't work properly. When
-    used, these rules cause the rule to be checked against ALL input,&nbsp;
-    not just input from the designated zone.<br>
-  </li>
-</ol>
-
-<p><b>5/18/2004 - Shorewall 2.0.2b</b><b>&nbsp;</b></p>
-
-<p>Corrects two problems:</p>
-<ol>
-  <li>Specifying a null common action in /etc/shorewall/actions (e.g.,
-    :REJECT) results in a startup error.<br>
-    <br>
-  </li>
-  <li>If /var/lib/shorewall does not exist, shorewall start fails.<br>
-  </li>
-</ol>
-
-<p><b>5/15/2004 - Shorewall 2.0.2a</b><br>
-</p>
-
-<p>Corrects two problems:<br>
-</p>
-<ol>
-  <li>Temporary restore files were not being removed from /var/lib/shorewall.
-    These files have names of the form 'restore-nnnnn'.&nbsp; You can remove
-    files that have accumulated with the command:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;rm -f /var/lib/shorewall/restore-[0-9]*<br>
-    <br>
-  </li>
-  <li>The restore script did not load kernel modules. The result was that
-    after a cold load, applications like FTP and IRC DCC didn't work.<br>
-    <br>
-    To correct:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;1) Install 2.0.2a<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;2) "shorewall restart"<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;3) "shorewall save"</li>
-</ol>
-
-<p><b>5/13/2004 - Shorewall 2.0.2</b><b>&nbsp;</b></p>
-
-<p>Problems Corrected since 2.0.1<br>
-</p>
-<ol>
-  <li>The /etc/init.d/shorewall script installed on Debian by install.sh
-    failed silently due to a missing file (/usr/share/shorewall/wait4ifup).
-    That file is not part of the normal Shorewall distribution and is
-    provided by the Debian maintainer.</li>
-  <li>A meaningless warning message out of the proxyarp file processing has
-    been eliminated.</li>
-  <li>The "shorewall delete" command now correctly removes all dynamic rules
-    pertaining to the host(s) being deleted. Thanks to Stefan Engel for this
-    correction.</li>
-</ol>
-Issues when migrating from Shorewall 2.0.1 to Shorewall 2.0.2:<br>
-
-<ol>
-  <li>Extension Scripts -- In order for extension scripts to work properly
-    with the new iptables-save/restore integration (see New Feature 1 below),
-    some change may be required to your extension scripts. If your extension
-    scripts are executing commands other than iptables then those commands
-    must also be written to the restore file (a temporary file in
-    /var/lib/shorewall that is renamed /var/lib/shorewall/restore-base at the
-    end of the operation).<br>
-    <br>
-    The following functions should be of help:<br>
-    <br>
-    A. save_command() -- saves the passed command to the restore file.<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; Example:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; save_command echo Operation
-    Complete<br>
-    <br>
-    &nbsp;&nbsp; That command would simply write "echo Operation Complete" to
-    the restore file.<br>
-    <br>
-    B. run_and_save_command() -- saves the passed command to the restore file
-    then executes it. The return value is the exit status of the command.<br>
-    <br>
-    &nbsp; &nbsp; Example:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; run_and_save_command "echo 1 &gt;
-    /proc/sys/net/ipv4/icmp_echo_ignore_all"<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; Note that as in this example, when the command
-    involves file redirection then the entire command must be enclosed in
-    quotes. This applies to all of the functions described here.<br>
-    <br>
-    C. ensure_and_save_command() -- runs the passed command. If the command
-    fails, the firewall is restored to it's prior saved state and the
-    operation is terminated. If the command succeeds, the command is written
-    to the restore file.<br>
-    <br>
-  </li>
-  <li>Dynamic Zone support -- If you don't need to use the "shorewall add"
-    and "shorewall delete commands, you should set DYNAMIC_ZONES=No in
-    /etc/shorewall/shorewall.conf.</li>
-</ol>
-New Features:<br>
-
-<ol>
-  <li>Shorewall has now been integrated with iptables-save/iptables-restore
-    to provide very fast start and restart. The elements of this integration
-    are as follows:<br>
-    <br>
-    a) The 'shorewall save' command now saves the current configuration in
-    addition to the current dynamic blacklist. If you have dynamic zones, you
-    will want to issue 'shorewall save' when the zones are empty or the
-    current contents of the zones will be restored by the 'shorewall restore'
-    and 'shorewall -f start' commands.<br>
-    <br>
-    b) The 'shorewall restore' command has been added. This command restores
-    the configuration at the time of the last 'save'.<br>
-    <br>
-    c) The -f (fast) option has been added to 'shorewall start'. When
-    specified (e.g. 'shorewall -f start'), shorewall will perform a
-    'shorewall restore' if there is a saved configuration. If there is no
-    saved configuration, a normal 'shorewall start' is performed.<br>
-    <br>
-    d) The /etc/init.d/shorewall script now translates the 'start' command
-    into 'shorewall -f start' so that fast restart is possible.<br>
-    <br>
-    e) When a state-changing command encounters an error and there is current
-    saved configuration, that configuration will be restored (currently, the
-    firewall is placed in the 'stopped' state).<br>
-    <br>
-    f) If you have previously saved the running configuration and want
-    Shorewall to discard it, use the 'shorewall forget' command. WARNING:
-    iptables 1.2.9 is broken with respect to iptables-save; if your kernel
-    has connection tracking match support, you must patch iptables 1.2.9 with
-    the iptables patch availale from the Shorewall errata page.<br>
-    <br>
-  </li>
-  <li>The previous implementation of dynamic zones was difficult to maintain.
-    I have changed the code to make dynamic zones optional under the control
-    of the DYNAMIC_ZONES option in /etc/shorewall/shorewall.conf.<br>
-    <br>
-  </li>
-  <li>In earlier Shorewall 2.0 releases, Shorewall searches in order the
-    following directories for configuration files.<br>
-    <br>
-    a) The directory specified in a 'try' command or specified using the -c
-    option.<br>
-    b) /etc/shorewall<br>
-    c) /usr/share/shorewall<br>
-    <br>
-    In this release, the CONFIG_PATH option is added to shorewall.conf.
-    CONFIG_PATH contains a list of directory names separated by colons (":").
-    If not set or set to a null value (e.g., CONFIG_PATH="") then
-    "CONFIG_PATH=/etc/shorewall:/usr/share/shorewall" is assumed. Now
-    Shorewall searches for shorewall.conf according to the old rules and for
-    other configuration files as follows:<br>
-    <br>
-    a) The directory specified in a 'try' command or specified using the -c
-    option.<br>
-    b) Each directory in $CONFIG_PATH is searched in sequence.<br>
-    <br>
-    In case it is not obvious, your CONFIG_PATH should include
-    /usr/share/shorewall and your shorewall.conf file must be in the
-    directory specified via -c or in a try command, in /etc/shorewall or in
-    /usr/share/shorewall.<br>
-    <br>
-    For distribution packagers, the default CONFIG_PATH is set in
-    /usr/share/shorewall/configpath. You can customize this file to have a
-    default that differs from mine.<br>
-    <br>
-  </li>
-  <li>Previously, in /etc/shorewall/nat a Yes (or yes) in the LOCAL column
-    would only take effect if the ALL INTERFACES column also contained Yes or
-    yes. Now, the LOCAL columns contents are treated independently of the
-    contents of the ALL INTERFACES column.<br>
-    <br>
-  </li>
-  <li>The folks at Mandrake have created yet another kernel module naming
-    convention (module names end in "ko.gz"). As a consequence, beginning
-    with this release, if MODULE_SUFFIX isn't specified in shorewall.conf,
-    then the default value is "o gz ko o.gz ko.gz".<br>
-    <br>
-  </li>
-  <li>An updated bogons file is included in this release.<br>
-    <br>
-  </li>
-  <li>In /etc/shorewall/rules and in action files generated from
-    /usr/share/shorewall/action.template, rules that perform logging can
-    specify an optional "log tag". A log tag is a string of alphanumeric
-    characters and is specified by following the log level with ":" and the
-    log tag.<br>
-    <br>
-    Example:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ACCEPT:info:ftp
-    net&nbsp;&nbsp;&nbsp;&nbsp; dmz&nbsp;&nbsp;&nbsp;&nbsp;
-    tcp&nbsp;&nbsp;&nbsp;&nbsp; 21<br>
-    <br>
-    The log tag is appended to the log prefix generated by the LOGPREFIX
-    variable in /etc/shorewall/conf. If "ACCEPT:info" generates the log
-    prefix "Shorewall:net2dmz:ACCEPT:" then "ACCEPT:info:ftp" will generate
-    "Shorewall:net2dmz:ACCEPT:ftp " (note the trailing blank). The maximum
-    length of a log prefix supported by iptables is 29 characters; if a
-    larger prefix is generated, Shorewall will issue a warning message and
-    will truncate the prefix to 29 characters.<br>
-    <br>
-  </li>
-  <li>A new "-q" option has been added to /sbin/shorewall commands. It causes
-    the start, restart, check and refresh commands to produce much less
-    output so that warning messages are more visible (when testing this
-    change, I discovered a bug where a bogus warning message was being
-    generated).<br>
-    <br>
-  </li>
-  <li>Shorewall now uses 'modprobe' to load kernel modules if that utility is
-    available in the PATH; otherwise, 'insmod' is used.<br>
-    <br>
-  </li>
-  <li>It is now possible to restrict entries in the /etc/shorewall/masq file
-    to particular protocols and destination port(s). Two new columns (PROTO
-    and PORT(S)) have been added to the file.<br>
-    <br>
-    Example:<br>
-    <br>
-    You want all outgoing SMTP traffic entering the firewall on eth1 to be
-    sent from eth0 with source IP address 206.124.146.177. You want all other
-    outgoing traffic from eth1 to be sent from eth0 with source IP address
-    206.124.146.176.<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; eth0&nbsp;&nbsp;&nbsp;
-    eth1&nbsp;&nbsp;&nbsp; 206.124.146.177 tcp&nbsp;&nbsp;&nbsp;&nbsp; 25<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; eth0&nbsp;&nbsp;&nbsp;
-    eth1&nbsp;&nbsp;&nbsp; 206.124.146.176<br>
-    <br>
-    THE ORDER OF THE ABOVE TWO RULES IS SIGNIFICANT!!!!!<br>
-    <br>
-    Assuming that 10.0.0.0/8 is the only host/network connected to eth1, the
-    progress message at "shorewall start" would be:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; Masqueraded Networks and Hosts:<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; To 0.0.0.0/0 (tcp 25) from
-    10.0.0.0/8 through eth0 using 206.124.146.177<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; To 0.0.0.0/0 (all) from 10.0.0.0/8
-    through eth0 using 206.124.146.176<br>
-    <br>
-  </li>
-  <li>Two new actions are available in the /etc/shorewall/rules file.<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; ACCEPT+&nbsp;&nbsp;&nbsp; -- Behaves like ACCEPT with
-    the exception that it exempts matching connections from subsequent
-    DNAT[-] and REDIRECT[-] rules.<br>
-    &nbsp;&nbsp;&nbsp; NONAT&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -- Exempts
-    matching connections from subsequent DNAT[-] and REDIRECT[-] rules.<br>
-    <br>
-  </li>
-  <li>A new extension script 'initdone' has been added. This script is
-    invoked at the same point as the 'common' script was previously and is
-    useful for users who mis-used that script under Shorewall 1.x (the script
-    was intended for adding rules to the 'common' chain but many users
-    treated it as a script for adding rules before Shorewall's).<br>
-    <br>
-  </li>
-  <li>Installing/Upgrading Shorewall on Slackware has been improved.
-    Slackware users must use the tarball and must modify settings in the
-    install.sh script before running it as follows:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; DEST="/etc/rc.d"<br>
-    &nbsp;&nbsp;&nbsp; INIT="rc.firewall"<br>
-    <br>
-    Thanks to Alex Wilms for helping with this change.</li>
-</ol>
-
-<p><b>4/17/2004 - Presentation at LinuxFest NW</b><b><br>
-</b></p>
-Today I gave a presentation at LinuxFest NW in Bellingham. The presentation
-was entitled "<a
-href="http://lists.shorewall.net/Shorewall_and_the_Enterprise.htm"
-target="_blank">Shorewall and the Enterprise</a>" and described the history
-of Shorewall and gave an overview of its features. 
-
-<p><b>4/5/2004 - Shorewall 2.0.1</b><br>
-</p>
-Problems Corrected since 2.0.0<br>
-<br>
-
-<ol>
-  <li>Using actions in the manner recommended in the documentation results in
-    a Warning that the rule is a policy.</li>
-  <li>When a zone on a single interface is defined using
-    /etc/shorewall/hosts, superfluous rules are generated in the
-    &lt;zone&gt;_frwd chain.</li>
-  <li>Thanks to Sean Mathews, a long-standing problem with Proxy ARP and
-    IPSEC has been corrected. Thanks Sean!!!</li>
-  <li>The "shorewall show log" and "shorewall logwatch" commands incorrectly
-    displayed type 3 ICMP packets.<br>
-  </li>
-</ol>
-Issues when migrating from Shorewall 2.0.0 to Shorewall 2.0.1:<br>
-<br>
-
-<ol>
-  <li>The function of 'norfc1918' is now split between that option and a new
-    'nobogons' option.<br>
-    <br>
-    The rfc1918 file released with Shorewall now contains entries for only
-    those three address ranges reserved by RFC 1918. A 'nobogons' interface
-    option has been added which handles bogon source addresses (those which
-    are reserved by the IANA, those reserved for DHCP auto-configuration and
-    the class C test-net reserved for testing and documentation examples).
-    This will allow users to perform RFC 1918 filtering without having to
-    deal with out of date data from IANA. Those who are willing to update
-    their /usr/share/shorewall/bogons file regularly can specify the
-    'nobogons' option in addition to 'norfc1918'.<br>
-    <br>
-    The level at which bogon packets are logged is specified in the new
-    BOGON_LOG_LEVEL variable in shorewall.conf. If that option is not
-    specified or is specified as empty (e.g, BOGON_LOG_LEVEL="") then bogon
-    packets whose TARGET is 'logdrop' in /usr/share/shorewall/bogons are
-    logged at the 'info' level.</li>
-</ol>
-New Features:<br>
-<br>
-
-<ol>
-  <li>Support for Bridging Firewalls has been added. For details, see<br>
-    <br>
-    <a
-    href="http://shorewall.net/bridge.html">http://shorewall.net/bridge.html</a><br>
-    <br>
-  </li>
-  <li>Support for NETMAP has been added. NETMAP allows NAT to be defined
-    between two network:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;
-    a.b.c.1&nbsp;&nbsp;&nbsp; -&gt; x.y.z.1<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    a.b.c.2&nbsp;&nbsp;&nbsp; -&gt; x.y.z.2<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    a.b.c.3&nbsp;&nbsp;&nbsp; -&gt; x.y.z.3<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ...<br>
-    <br>
-    &nbsp; <a
-    href="http://shorewall.net/netmap.htm">http://shorewall.net/netmap.htm</a><br>
-    <br>
-  </li>
-  <li>The /sbin/shorewall program now accepts a "-x" option to cause iptables
-    to print out the actual packet and byte counts rather than abbreviated
-    counts such as "13MB".<br>
-    <br>
-    Commands affected by this are:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    shorewall -x show [ &lt;chain&gt;[ &lt;chain&gt; ...] ]<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    shorewall -x show tos|mangle<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    shorewall -x show nat<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    shorewall -x status<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    shorewall -x monitor [ &lt;interval&gt; ]<br>
-    <br>
-  </li>
-  <li>Shorewall now traps two common zone definition errors:<br>
-
-    <ul>
-      <li>Including the firewall zone in a /etc/shorewall/hosts record.</li>
-      <li>Defining an interface for a zone in both /etc/shorewall/interfaces
-        and /etc/shorewall/hosts.<br>
-        <br>
-      </li>
-    </ul>
-  </li>
-  <li>In the second case, the following will appear during "shorewall
-    [re]start" or "shorewall check":<br>
-    <br>
-    &nbsp;&nbsp; Determining Hosts in Zones...<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ...<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Error: Invalid zone definition for zone
-    &lt;name of zone&gt;<br>
-    &nbsp;&nbsp; Terminated<br>
-    <br>
-  </li>
-  <li>To support bridging, the following options have been added to entries
-    in /etc/shorewall/hosts:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; norfc1918<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; nobogons<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; blacklist<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; tcpflags<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; nosmurfs<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; newnotsyn<br>
-    <br>
-    With the exception of 'newnotsyn', these options are only useful when the
-    entry refers to a bridge port.<br>
-    <br>
-    &nbsp;&nbsp; Example:<br>
-    <br>
-    &nbsp;&nbsp; #ZONE&nbsp;&nbsp; HOST(S)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    OPTIONS<br>
-    &nbsp;&nbsp; net&nbsp;&nbsp;&nbsp;&nbsp; br0:eth0&nbsp;&nbsp;&nbsp;&nbsp;
-    norfc1918,nobogons,blacklist,tcpflags,nosmurfs</li>
-</ol>
-
-<p><b>3/14/2004 - Shorewall 2.0.0b&nbsp;</b></p>
-Corrects two problems:<br>
-
-<ol>
-  <li>Thanks to Sean Mathews, the long-standing problem with Proxy ARP and
-    IPSEC has been eliminated!</li>
-  <li>The default value of the ALL INTERFACES column in /etc/shorewall/nat is
-    documented as 'No' but the default continued to be 'Yes' as it was in
-    Shorewall 1.4.<br>
-  </li>
-</ol>
-
-<p><b>3/14/2004 - Shorewall 2.0.0a&nbsp;</b></p>
-
-<p>Corrects one problem:<br>
-</p>
-<ul>
-  <li>Rules of the form:<br>
-    <br>
-    &lt;action&gt;&nbsp;&nbsp;&nbsp;&nbsp;
-    zone1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; zone2<br>
-    <br>
-    generated a warning stating that the rule was a policy.<br>
-  </li>
-</ul>
-
-<p><b>3/14/2004 - Shorewall 2.0.0</b> <b><br>
-</b></p>
-
-<p>Dedicated to Agnes Van Slyke Eastep: March 14, 1910 - February 23, 2004<br>
-</p>
-
-<p>Problems Corrected since 1.4.10<br>
-</p>
-<ol>
-  <li>A blank USER/GROUP column in /etc/shorewall/tcrules no longer causes a
-    [re]start error.</li>
-  <li>The 'fgrep' utility is no longer required (caused startup problems on
-    LEAF/Bering).</li>
-  <li>The "shorewall add" command no longer inserts rules before checking of
-    the blacklist.</li>
-  <li>The 'detectnets' and 'routeback' options may now be used together with
-    the intended effect.</li>
-  <li>The following syntax previously produced an error:<br>
-    <br>
-    DNAT&nbsp; z1!z2,z3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; z4...<br>
-  </li>
-</ol>
-
-<p>Problems Corrected since RC2<br>
-<br>
-</p>
-<ol>
-  <li>CONTINUE rules now work again.</li>
-  <li>A comment in the rules file has been corrected.<br>
-  </li>
-</ol>
-
-<p>Issues when migrating from Shorewall 1.4.x to Shorewall 2.0.0:<br>
-</p>
-<ol>
-  <li>The 'dropunclean' and 'logunclean' interface options are no longer
-    supported. If either option is specified in /etc/shorewall/interfaces, an
-    threatening message will be generated.</li>
-  <li>The NAT_BEFORE_RULES option has been removed from shorewall.conf. The
-    behavior of Shorewall is as if NAT_BEFORE_RULES=No had been specified. In
-    other words, DNAT rules now always take precidence over one-to-one NAT
-    specifications.</li>
-  <li>The default value for the ALL INTERFACES column in /etc/shorewall/nat
-    has changed. In Shorewall 1.*, if the column was left empty, a value of
-    "Yes" was assumed. This has been changed so that a value of "No" is now
-    assumed.</li>
-  <li>The following files don't exist in Shorewall 2.0:<br>
-    /etc/shorewall/common.def<br>
-    /etc/shorewall/common<br>
-    /etc/shorewall/icmpdef<br>
-    /etc/shorewall/action.template (Moved to /usr/share/shorewall)<br>
-    /etc/shorewall/rfc1918 (Moved to /usr/share/shorewall).<br>
-    <br>
-    The /etc/shorewall/action file now allows an action to be designated as
-    the "common" action for a particular policy type by following the action
-    name with ":" and the policy (DROP, REJECT or ACCEPT).<br>
-    <br>
-    The file /usr/share/shorewall/actions.std has been added to define those
-    actions that are released as part of Shorewall. In that file are two
-    actions as follows:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; Drop:DROP<br>
-    &nbsp;&nbsp; Reject:REJECT<br>
-    <br>
-    The "Drop" action is the common action for DROP policies while the
-    "Reject" action is the default action for "REJECT" policies. These
-    actions will be performed on packets prior to applying the DROP or REJECT
-    policy respectively. In the first release, the difference between
-    "Reject" and "Drop" is that "Reject" REJECTs SMB traffic while "Drop"
-    silently drops such traffic.<br>
-    <br>
-    As described above, Shorewall allows a common action for ACCEPT policies
-    but does not specify such an action in the default configuration.<br>
-    <br>
-    If for some reason, you don't wish to have a common DROP or REJECT
-    action, just include :DROP or :REJECT respectively in your
-    /etc/shorewall/actions file.<br>
-    <br>
-    The file /usr/share/shorewall/actions.std catalogs the standard actions
-    and is processed prior to /etc/shorewall/actions. This causes a large
-    number of actions to be defined. The files which define these aactions
-    are also located in /usr/share/shorewall as is the he action template
-    file (action.template).<br>
-    <br>
-    These actions may be used in the ACTION column of the rules column. So
-    for example, to allow FTP from your loc zone to your firewall, you would
-    place this rule in /etc/shorewall/rules:<br>
-    <br>
-    &nbsp; #ACTION&nbsp;&nbsp;&nbsp;&nbsp;
-    SOURCE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DEST<br>
-    &nbsp; AllowFTP&nbsp;&nbsp;&nbsp;&nbsp;
-    loc&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;
-    &nbsp; &nbsp; fw<br>
-    <br>
-    If you want to redefine any of the Shorewall-defined actions, simply copy
-    the appropriate action file from /usr/share/shorewall to /etc/shorewall
-    and modify the copy as desired. Your modified copy will be used rather
-    than the original one in /usr/share/shorewall.<br>
-    <br>
-    Note: The 'dropBcast' and 'dropNonSyn' actions are built into Shorewall
-    and may not be changed.<br>
-    <br>
-    Beginning with version 2.0.0-Beta2, Shorewall will only create a chain
-    for those actions that are actually used.<br>
-    <br>
-  </li>
-  <li>The /etc/shorewall directory no longer contains a 'users' file or a
-    'usersets' file. Similar functionality is now available using
-    user-defined actions.<br>
-    <br>
-    Now, action files created by copying /usr/share/shorewall/action.template
-    may specify a USER and or GROUP name/id in the final column just like in
-    the rules file (see below). It is thus possible to create actions that
-    control traffic from a list of users and/or groups.<br>
-    <br>
-    The last column in /etc/shorewall/rules is now labeled USER/GROUP and may
-    contain:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; [!]&lt;user number&gt;[:]<br>
-    &nbsp;&nbsp;&nbsp; [!]&lt;user name&gt;[:]<br>
-    &nbsp;&nbsp;&nbsp; [!]:&lt;group number&gt;<br>
-    &nbsp;&nbsp;&nbsp; [!]:&lt;group name&gt;<br>
-    &nbsp;&nbsp;&nbsp; [!]&lt;user number&gt;:&lt;group number&gt;<br>
-    &nbsp;&nbsp;&nbsp; [!]&lt;user number&gt;:&lt;group name&gt;<br>
-    &nbsp;&nbsp;&nbsp; [!]&lt;user name&gt;:&lt;group number&gt;<br>
-    &nbsp;&nbsp;&nbsp; [!]&lt;user name&gt;:&lt;group name&gt;<br>
-    &nbsp;<br>
-  </li>
-  <li>It is no longer possible to specify rate limiting in the ACTION column
-    of /etc/shorewall/rules -- you must use the RATE LIMIT column.<br>
-    <br>
-  </li>
-  <li>Depending on which method you use to upgrade, if you have your own
-    version of /etc/shorewall/rfc1918, you may have to take special action to
-    restore it after the upgrade. Look for /etc/shorewall/rfc1918*, locate
-    the proper file and rename it back to /etc/shorewall/rfc1918. The
-    contents of that file will supercede the contents of
-    /usr/share/shorewall/rfc1918.</li>
-</ol>
-
-<p>New Features:<br>
-</p>
-<ol>
-  <li>The INCLUDE directive now allows absolute file names.</li>
-  <li>A 'nosmurfs' interface option has been added to
-    /etc/shorewall/interfaces. When specified for an interface, this option
-    causes smurfs (packets with a broadcast address as their source) to be
-    dropped and optionally logged (based on the setting of a new
-    SMURF_LOG_LEVEL option in shorewall.conf).</li>
-  <li>fw-&gt;fw traffic may now be controlled by Shorewall. There is no need
-    to define the loopback interface in /etc/shorewall/interfaces; you simply
-    add a fw-&gt;fw policy and fw-&gt;fw rules. If you have neither a
-    fw-&gt;fw policy nor fw-&gt;fw rules, all fw-&gt;fw traffic is
-  allowed.</li>
-  <li>There is a new PERSISTENT column in the proxyarp file. A value of "Yes"
-    in this column means that the route added by Shorewall for this host will
-    remain after a "shorewall stop" or "shorewall clear".</li>
-  <li>"trace" is now a synonym for "debug" in /sbin/shorewall commands. So to
-    trace the "start" command, you could enter:<br>
-    <br>
-    shorewall trace start 2&gt; /tmp/trace<br>
-    <br>
-    The trace information would be written to the file /tmp/trace.<br>
-    <br>
-  </li>
-  <li>When defining an ipsec tunnel in /etc/shorewall/tunnels, if you follow
-    the tunnel type ("ipsec" or "ipsecnet") with ":noah" (e.g.,
-    "ipsec:noah"), then Shorewall will only create rules for ESP (protocol
-    50) and will not create rules for AH (protocol 51).</li>
-  <li>A new DISABLE_IPV6 option has been added to shorewall.conf. When this
-    option is set to "Yes", Shorewall will set the policy for the IPv6 INPUT,
-    OUTPUT and FORWARD chains to DROP during "shorewall [re]start" and
-    "shorewall stop". Regardless of the setting of this variable, "shorewall
-    clear" will silently attempt to set these policies to ACCEPT.<br>
-    <br>
-    If this option is not set in your existing shorewall.conf then a setting
-    of DISABLE_IPV6=No is assumed in which case, Shorewall will not touch any
-    IPv6 settings except during "shorewall clear".</li>
-  <li>The CONTINUE target is now available in action definitions. CONTINUE
-    terminates processing of the current action and returns to the point
-    where that action was invoked.</li>
-</ol>
-
-<p><b>2/15/2004 - Shorewall 1.4.10c&nbsp;</b></p>
-
-<p>Corrects one problem:<br>
-</p>
-Entries in /etc/shorewall/tcrules with an empty USER/GROUP column would cause
-a startup error. 
-
-<p><b>2/12/2004 - Shorewall 1.4.10b&nbsp;</b></p>
-
-<p>Corrects one problem:<br>
-</p>
-<ul>
-  <li>In the /etc/shorewall/masq entry &acirc;&#x80;&#x9c;<span
-    class="quote">eth0:!10.1.1.150 &nbsp; &nbsp;0.0.0.0/0!10.1.0.0/16 &nbsp;
-    &nbsp; 10.1.2.16</span>&acirc;&#x80;&#x9d;, the &acirc;&#x80;&#x9c;<span
-    class="quote">!10.1.0.0/16</span>&acirc;&#x80;&#x9d; is ignored.</li>
-</ul>
-
-<p><b>2/8/2004 - Shorewall 1.4.10a&nbsp;</b></p>
-
-<p>Corrects two problems:<br>
-</p>
-<ul>
-  <li>A problem which can cause [re]start to fail inexplicably while
-    processing /etc/shorewall/masq.</li>
-  <li>Interfaces using the Atheros WiFi card to use the 'maclist' option.</li>
-</ul>
-
-<p><b>1/30/2004 - Shorewall 1.4.10</b></p>
-
-<p>Problems Corrected since version 1.4.9</p>
-<ol>
-  <li>The column descriptions in the action.template file did not match the
-    column headings. That has been corrected.</li>
-  <li>The presence of IPV6 addresses on devices generated error messages
-    during [re]start if ADD_IP_ALIASES=Yes or ADD_SNAT_ALIASES=Yes are
-    specified in /etc/shorewall/shorewall.conf. These messages have been
-    eliminated.</li>
-  <li value="3">The CONTINUE action in /etc/shorewall/rules now works
-    correctly. A couple of problems involving rate limiting have been
-    corrected. These bug fixes courtesy of Steven Jan Springl.</li>
-  <li>Shorewall now tried to avoid sending an ICMP response to broadcasts and
-    smurfs.</li>
-  <li>Specifying "-" or "all" in the PROTO column of an action no longer
-    causes a startup error.</li>
-</ol>
-Migragion Issues:<br>
-<br>
-&nbsp;&nbsp;&nbsp; None.<br>
-<br>
-New Features:<br>
-
-<ol>
-  <li>The INTERFACE column in the /etc/shorewall/masq file may now specify a
-    destination list.<br>
-    <br>
-    Example:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; #INTERFACE&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;
-    &nbsp;&nbsp;&nbsp; SUBNET&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; ADDRESS<br>
-    &nbsp;&nbsp;&nbsp; eth0:192.0.2.3,192.0.2.16/28&nbsp;&nbsp;&nbsp; eth1<br>
-    <br>
-    If the list begins with "!" then SNAT will occur only if the destination
-    IP address is NOT included in the list.<br>
-    <br>
-  </li>
-  <li>Output traffic control rules (those with the firewall as the source)
-    may now be qualified by the effective userid and/or effective group id of
-    the program generating the output. This feature is courtesy of&nbsp;
-    Fr&Atilde;&copy;d&Atilde;&copy;ric LESPEZ.<br>
-    <br>
-    A new USER column has been added to /etc/shorewall/tcrules. It may
-    contain :<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [&lt;user name or number&gt;]:[&lt;group
-    name or number&gt;]<br>
-    <br>
-    The colon is optionnal when specifying only a user.<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Examples : john: / john / :users /
-    john:users<br>
-    <br>
-  </li>
-  <li>A "detectnets" interface option has been added for entries in
-    /etc/shorewall/interfaces. This option automatically tailors the
-    definition of the zone named in the ZONE column to include just&nbsp;
-    those hosts that have routes through the interface named in the INTERFACE
-    column. The named interface must be UP when Shorewall is [re]started.<br>
-    <br>
-    &nbsp;WARNING: DO NOT SET THIS OPTION ON YOUR INTERNET INTERFACE!
-    &nbsp;&nbsp;</li>
-</ol>
-
-<p><b>1/27/2004 - Shorewall 1.4.10 RC3</b></p>
-
-<p><a
-href="http://shorewall.net/pub/shorewall/Beta">http://shorewall.net/pub/shorewall/Beta</a><br>
-<a href="ftp://shorewall.net/pub/shorewall/Beta"
-target="_top">ftp://shorewall.net/pub/shorewall/Beta</a><br>
-</p>
-
-<p>Problems Corrected since version 1.4.9</p>
-<ol>
-  <li>The column descriptions in the action.template file did not match the
-    column headings. That has been corrected.</li>
-  <li>The presence of IPV6 addresses on devices generated error messages
-    during [re]start if ADD_IP_ALIASES=Yes or ADD_SNAT_ALIASES=Yes are
-    specified in /etc/shorewall/shorewall.conf. These messages have been
-    eliminated.</li>
-  <li value="3">The CONTINUE action in /etc/shorewall/rules now works
-    correctly. A couple of problems involving rate limiting have been
-    corrected. These bug fixes courtesy of Steven Jan Springl.</li>
-  <li>Shorewall now tried to avoid sending an ICMP response to broadcasts and
-    smurfs.<br>
-  </li>
-</ol>
-Migragion Issues:<br>
-<br>
-&nbsp;&nbsp;&nbsp; None.<br>
-<br>
-New Features:<br>
-
-<ol>
-  <li>The INTERFACE column in the /etc/shorewall/masq file may now specify a
-    destination list.<br>
-    <br>
-    Example:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; #INTERFACE&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;
-    &nbsp;&nbsp;&nbsp; SUBNET&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; ADDRESS<br>
-    &nbsp;&nbsp;&nbsp; eth0:192.0.2.3,192.0.2.16/28&nbsp;&nbsp;&nbsp; eth1<br>
-    <br>
-    If the list begins with "!" then SNAT will occur only if the destination
-    IP address is NOT included in the list.<br>
-    <br>
-  </li>
-  <li>Output traffic control rules (those with the firewall as the source)
-    may now be qualified by the effective userid and/or effective group id of
-    the program generating the output. This feature is courtesy of&nbsp;
-    Fr&Atilde;&copy;d&Atilde;&copy;ric LESPEZ.<br>
-    <br>
-    A new USER column has been added to /etc/shorewall/tcrules. It may
-    contain :<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [&lt;user name or number&gt;]:[&lt;group
-    name or number&gt;]<br>
-    <br>
-    The colon is optionnal when specifying only a user.<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Examples : john: / john / :users /
-    john:users<br>
-    <br>
-  </li>
-  <li>A "detectnets" interface option has been added for entries in
-    /etc/shorewall/interfaces. This option automatically tailors the
-    definition of the zone named in the ZONE column to include just&nbsp;
-    those hosts that have routes through the interface named in the INTERFACE
-    column. The named interface must be UP when Shorewall is [re]started.<br>
-    <br>
-    &nbsp;WARNING: DO NOT SET THIS OPTION ON YOUR INTERNET INTERFACE!
-    &nbsp;&nbsp;</li>
-</ol>
-
-<p><b>1/24/2004 - Shorewall 1.4.10 RC2</b><b>&nbsp;</b></p>
-
-<p><a
-href="http://shorewall.net/pub/shorewall/Beta">http://shorewall.net/pub/shorewall/Beta</a><br>
-<a href="ftp://shorewall.net/pub/shorewall/Beta"
-target="_top">ftp://shorewall.net/pub/shorewall/Beta</a><br>
-</p>
-
-<p>Problems Corrected since version 1.4.9</p>
-<ol>
-  <li>The column descriptions in the action.template file did not match the
-    column headings. That has been corrected.</li>
-  <li>The presence of IPV6 addresses on devices generated error messages
-    during [re]start if ADD_IP_ALIASES=Yes or ADD_SNAT_ALIASES=Yes are
-    specified in /etc/shorewall/shorewall.conf. These messages have been
-    eliminated.</li>
-</ol>
-Migragion Issues:<br>
-<br>
-&nbsp;&nbsp;&nbsp; None.<br>
-<br>
-New Features:<br>
-
-<ol>
-  <li>The INTERFACE column in the /etc/shorewall/masq file may now specify a
-    destination list.<br>
-    <br>
-    Example:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; #INTERFACE&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;
-    &nbsp;&nbsp;&nbsp; SUBNET&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; ADDRESS<br>
-    &nbsp;&nbsp;&nbsp; eth0:192.0.2.3,192.0.2.16/28&nbsp;&nbsp;&nbsp; eth1<br>
-    <br>
-    If the list begins with "!" then SNAT will occur only if the destination
-    IP address is NOT included in the list.<br>
-    <br>
-  </li>
-  <li>Output traffic control rules (those with the firewall as the source)
-    may now be qualified by the effective userid and/or effective group id of
-    the program generating the output. This feature is courtesy of&nbsp;
-    Fr&Atilde;&copy;d&Atilde;&copy;ric LESPEZ.<br>
-    <br>
-    A new USER column has been added to /etc/shorewall/tcrules. It may
-    contain :<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [&lt;user name or number&gt;]:[&lt;group
-    name or number&gt;]<br>
-    <br>
-    The colon is optionnal when specifying only a user.<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Examples : john: / john / :users /
-    john:users<br>
-    <br>
-  </li>
-  <li>A "detectnets" interface option has been added for entries in
-    /etc/shorewall/interfaces. This option automatically tailors the
-    definition of the zone named in the ZONE column to include just&nbsp;
-    those hosts that have routes through the interface named in the INTERFACE
-    column. The named interface must be UP when Shorewall is [re]started.<br>
-    <br>
-    &nbsp;WARNING: DO NOT SET THIS OPTION ON YOUR INTERNET INTERFACE!</li>
-</ol>
-
-<p><b>1/22/2004 - Shorewall 1.4.10 RC1</b><b>&nbsp;</b></p>
-
-<p>Problems Corrected since version 1.4.9</p>
-<ol>
-  <li>The column descriptions in the action.template file did not match the
-    column headings. That has been corrected.</li>
-  <li>The presence of IPV6 addresses on devices generated error messages
-    during [re]start if ADD_IP_ALIASES=Yes or ADD_SNAT_ALIASES=Yes are
-    specified in /etc/shorewall/shorewall.conf. These messages have been
-    eliminated.</li>
-</ol>
-Migragion Issues:<br>
-<br>
-&nbsp;&nbsp;&nbsp; None.<br>
-<br>
-New Features:<br>
-
-<ol>
-  <li>The INTERFACE column in the /etc/shorewall/masq file may now specify a
-    destination list.<br>
-    <br>
-    Example:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; #INTERFACE&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;
-    &nbsp;&nbsp;&nbsp; SUBNET&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; ADDRESS<br>
-    &nbsp;&nbsp;&nbsp; eth0:192.0.2.3,192.0.2.16/28&nbsp;&nbsp;&nbsp; eth1<br>
-    <br>
-    If the list begins with "!" then SNAT will occur only if the destination
-    IP address is NOT included in the list.<br>
-    <br>
-  </li>
-  <li>Output traffic control rules (those with the firewall as the source)
-    may now be qualified by the effective userid and/or effective group id of
-    the program generating the output. This feature is courtesy of&nbsp;
-    Fr&Atilde;&copy;d&Atilde;&copy;ric LESPEZ.<br>
-    <br>
-    A new USER column has been added to /etc/shorewall/tcrules. It may
-    contain :<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [&lt;user name or number&gt;]:[&lt;group
-    name or number&gt;]<br>
-    <br>
-    The colon is optionnal when specifying only a user.<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Examples : john: / john / :users /
-    john:users&nbsp;&nbsp;&nbsp;<br>
-  </li>
-</ol>
-
-<p><b>1/13/2004 - Shorewall 1.4.9</b><b><br>
-</b></p>
-
-<p>Problems Corrected since version 1.4.8:<br>
-</p>
-<ol>
-  <li>There has been a low continuing level of confusion over the terms
-    "Source NAT" (SNAT) and "Static NAT". To avoid future confusion, all
-    instances of "Static NAT" have been replaced with "One-to-one NAT" in the
-    documentation and configuration files.</li>
-  <li>The description of NEWNOTSYN in shorewall.conf has been reworded for
-    clarity.</li>
-  <li>Wild-card rules (those involving "all" as SOURCE or DEST) will no
-    longer produce an error if they attempt to add a rule that would override
-    a NONE policy. The logic for expanding these wild-card rules now simply
-    skips those (SOURCE,DEST) pairs that have a NONE policy.</li>
-  <li>DNAT rules that also specified SNAT now work reliably. Previously,
-    there were cases where the SNAT specification was effectively
-  ignored.</li>
-</ol>
-
-<p>Migration Issues:<br>
-<br>
-&nbsp;&nbsp;&nbsp; None.<br>
-<br>
-New Features:<br>
-</p>
-<ol>
-  <li>The documentation has been completely rebased to Docbook XML. The
-    documentation is now released as separate HTML and XML packages.</li>
-  <li>To cut down on the number of "Why are these ports closed rather than
-    stealthed?" questions, the SMB-related rules in /etc/shorewall/common.def
-    have been changed from 'reject' to 'DROP'.</li>
-  <li>For easier identification, packets logged under the 'norfc1918'
-    interface option are now logged out of chains named 'rfc1918'.
-    Previously, such packets were logged under chains named 'logdrop'.</li>
-  <li>Distributors and developers seem to be regularly inventing new naming
-    conventions for kernel modules. To avoid the need to change Shorewall
-    code for each new convention, the MODULE_SUFFIX option has been added to
-    shorewall.conf. MODULE_SUFFIX may be set to the suffix for module names
-    in your particular distribution. If MODULE_SUFFIX is not set in
-    shorewall.conf, Shorewall will use the list "o gz ko o.gz".<br>
-    <br>
-    To see what suffix is used by your distribution:<br>
-    <br>
-    ls /lib/modules/$(uname -r)/kernel/net/ipv4/netfilter<br>
-    <br>
-    All of the files listed should have the same suffix (extension). Set
-    MODULE_SUFFIX to that suffix.<br>
-    <br>
-    Examples:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp; If all files end in ".kzo" then set
-    MODULE_SUFFIX="kzo"<br>
-    &nbsp;&nbsp;&nbsp;&nbsp; If all files end in ".kz.o" then set
-    MODULE_SUFFIX="kz.o"</li>
-  <li>Support for user defined rule ACTIONS has been implemented through two
-    new files:<br>
-    <br>
-    /etc/shorewall/actions - used to list the user-defined ACTIONS.<br>
-    /etc/shorewall/action.template - For each user defined &lt;action&gt;,
-    copy this file to /etc/shorewall/action.&lt;action&gt; and add the
-    appropriate rules for that &lt;action&gt;. Once an &lt;action&gt; has
-    been defined, it may be used like any of the builtin ACTIONS (ACCEPT,
-    DROP, etc.) in /etc/shorewall/rules.<br>
-    <br>
-    Example: You want an action that logs a packet at the 'info' level and
-    accepts the connection.<br>
-    <br>
-    In /etc/shorewall/actions, you would add:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp; LogAndAccept<br>
-    <br>
-    You would then copy /etc/shorewall/action.template to
-    /etc/shorewall/action.LogAndAccept and in that file, you would add the
-    two rules:<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LOG:info<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ACCEPT</li>
-  <li>The default value for NEWNOTSYN in shorewall.conf is now "Yes" (non-syn
-    TCP packets that are not part of an existing connection are filtered
-    according to the rules and policies rather than being dropped). I have
-    made this change for two reasons:<br>
-    <br>
-    a) NEWNOTSYN=No tends to result in lots of "stuck" connections since any
-    timeout during TCP session tear down results in the firewall dropping all
-    of the retries.<br>
-    <br>
-    b) The old default of NEWNOTSYN=No and LOGNEWNOTSYN=info resulted in lots
-    of confusing messages when a connection got "stuck". While I could have
-    changed the default value of LOGNEWNOTSYN to suppress logging, I dislike
-    defaults that silently throw away packets.</li>
-  <li>The common.def file now contains an entry that silently drops ICMP
-    packets with a null source address. Ad Koster reported a case where these
-    were occuring frequently as a result of a broken system on his external
-    network.</li>
-</ol>
-
-<p><b>12/29/2003 - Shorewall 1.4.9 Beta 2</b></p>
-
-<div style="margin-left: 40px;">
-<a
-href="http://shorewall.net/pub/shorewall/Beta">http://shorewall.net/pub/shorewall/Beta</a><br>
-<a href="ftp://shorewall.net/pub/shorewall/Beta"
-target="_top">ftp://shorewall.net/pub/shorewall/Beta</a> </div>
-
-<p>Problems Corrected since version 1.4.8:</p>
-<ol>
-  <li>There has been a low continuing level of confusion over the terms
-    "Source NAT" (SNAT) and "Static NAT". To avoid future confusion, all
-    instances of "Static NAT" have been replaced with "One-to-one NAT" in the
-    documentation and configuration files.</li>
-  <li>The description of NEWNOTSYN in shorewall.conf has been reworded for
-    clarity.</li>
-  <li>Wild-card rules (those involving "all" as SOURCE or DEST) will no
-    longer produce an error if they attempt to add a rule that would override
-    a NONE policy. The logic for expanding these wild-card rules now simply
-    skips those (SOURCE,DEST) pairs that have a NONE policy.</li>
-  <li>DNAT rules that also specified SNAT now work reliably. Previously,
-    there were cases where the SNAT specification was effectively ignored.<br>
-  </li>
-</ol>
-
-<p>Migration Issues:</p>
-
-<p>&nbsp;&nbsp;&nbsp; None.<br>
-<br>
-New Features:</p>
-<ol>
-  <li>The documentation has been completely rebased to Docbook XML. The
-    documentation is now released as separate HTML and XML packages.<br>
-  </li>
-  <li>To cut down on the number of "Why are these ports closed rather than
-    stealthed?" questions, the SMB-related rules in /etc/shorewall/common.def
-    have been changed from 'reject' to 'DROP'.</li>
-  <li>For easier identification, packets logged under the 'norfc1918'
-    interface option are now logged out of chains named 'rfc1918'.
-    Previously, such packets were logged under chains named 'logdrop'.</li>
-  <li>Distributors and developers seem to be regularly inventing new naming
-    conventions for kernel modules. To avoid the need to change Shorewall
-    code for each new convention, the MODULE_SUFFIX option has been added to
-    shorewall.conf. MODULE_SUFFIX may be set to the suffix for module names
-    in your particular distribution. If MODULE_SUFFIX is not set in
-    shorewall.conf, Shorewall will use the list "o gz ko o.gz".<br>
-    <br>
-    To see what suffix is used by your distribution:<br>
-    <br>
-    ls /lib/modules/$(uname -r)/kernel/net/ipv4/netfilter<br>
-    <br>
-    All of the files listed should have the same suffix (extension). Set
-    MODULE_SUFFIX to that suffix.<br>
-    <br>
-    Examples:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp; If all files end in ".kzo" then set
-    MODULE_SUFFIX="kzo"<br>
-    &nbsp;&nbsp;&nbsp;&nbsp; If all files end in ".kz.o" then set
-    MODULE_SUFFIX="kz.o"</li>
-  <li>Support for user defined rule ACTIONS has been implemented through two
-    new files:<br>
-    <br>
-    /etc/shorewall/actions - used to list the user-defined ACTIONS.<br>
-    /etc/shorewall/action.template - For each user defined &lt;action&gt;,
-    copy this file to /etc/shorewall/action.&lt;action&gt; and add the
-    appropriate rules for that &lt;action&gt;. Once an &lt;action&gt; has
-    been defined, it may be used like any of the builtin ACTIONS (ACCEPT,
-    DROP, etc.) in /etc/shorewall/rules.<br>
-    <br>
-    Example: You want an action that logs a packet at the 'info' level and
-    accepts the connection.<br>
-    <br>
-    In /etc/shorewall/actions, you would add:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp; LogAndAccept<br>
-    <br>
-    You would then copy /etc/shorewall/action.template to
-    /etc/shorewall/action.LogAndAccept and in that file, you would add the
-    two rules:<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LOG:info<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ACCEPT<br>
-  </li>
-  <li>The default value for NEWNOTSYN in shorewall.conf is now "Yes" (non-syn
-    TCP packets that are not part of an existing connection are filtered
-    according to the rules and policies rather than being dropped). I have
-    made this change for two reasons:<br>
-    <br>
-    a) NEWNOTSYN=No tends to result in lots of "stuck" connections since any
-    timeout during TCP session tear down results in the firewall dropping all
-    of the retries.<br>
-    <br>
-    b) The old default of NEWNOTSYN=No and LOGNEWNOTSYN=info resulted in lots
-    of confusing messages when a connection got "stuck". While I could have
-    changed the default value of LOGNEWNOTSYN to suppress logging, I dislike
-    defaults that silently throw away packets.<br>
-    <br>
-  </li>
-</ol>
-
-<p><b>12/28/2003 - www.shorewall.net/ftp.shorewall.net Back On-line</b>
-<b><br>
-</b></p>
-
-<p>Our high-capacity server has been restored to service -- please let <a
-href="mailto:webmaster@shorewall.net">us</a> know if you find any
-problems.</p>
-
-<p><b>12/29/2003 - Shorewall 1.4.9 Beta 1</b></p>
-
-<div style="margin-left: 40px;">
-<a
-href="http://shorewall.net/pub/shorewall/Beta">http://shorewall.net/pub/shorewall/Beta</a><br>
-<a href="ftp://shorewall.net/pub/shorewall/Beta"
-target="_top">ftp://shorewall.net/pub/shorewall/Beta</a> </div>
-
-<p>Problems Corrected since version 1.4.8:</p>
-<ol>
-  <li>There has been a low continuing level of confusion over the terms
-    "Source NAT" (SNAT) and "Static NAT". To avoid future confusion, all
-    instances of "Static NAT" have been replaced with "One-to-one NAT" in the
-    documentation and configuration files.</li>
-  <li>The description of NEWNOTSYN in shorewall.conf has been reworded for
-    clarity.</li>
-  <li>Wild-card rules (those involving "all" as SOURCE or DEST) will no
-    longer produce an error if they attempt to add a rule that would override
-    a NONE policy. The logic for expanding these wild-card rules now simply
-    skips those (SOURCE,DEST) pairs that have a NONE policy.</li>
-</ol>
-
-<p>Migration Issues:</p>
-
-<p>&nbsp;&nbsp;&nbsp; None.<br>
-<br>
-New Features:</p>
-<ol>
-  <li>To cut down on the number of "Why are these ports closed rather than
-    stealthed?" questions, the SMB-related rules in /etc/shorewall/common.def
-    have been changed from 'reject' to 'DROP'.</li>
-  <li>For easier identification, packets logged under the 'norfc1918'
-    interface option are now logged out of chains named 'rfc1918'.
-    Previously, such packets were logged under chains named 'logdrop'.</li>
-  <li>Distributors and developers seem to be regularly inventing new naming
-    conventions for kernel modules. To avoid the need to change Shorewall
-    code for each new convention, the MODULE_SUFFIX option has been added to
-    shorewall.conf. MODULE_SUFFIX may be set to the suffix for module names
-    in your particular distribution. If MODULE_SUFFIX is not set in
-    shorewall.conf, Shorewall will use the list "o gz ko o.gz".<br>
-    <br>
-    To see what suffix is used by your distribution:<br>
-    <br>
-    ls /lib/modules/$(uname -r)/kernel/net/ipv4/netfilter<br>
-    <br>
-    All of the files listed should have the same suffix (extension). Set
-    MODULE_SUFFIX to that suffix.<br>
-    <br>
-    Examples:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp; If all files end in ".kzo" then set
-    MODULE_SUFFIX="kzo"<br>
-    &nbsp;&nbsp;&nbsp;&nbsp; If all files end in ".kz.o" then set
-    MODULE_SUFFIX="kz.o"</li>
-  <li>Support for user defined rule ACTIONS has been implemented through two
-    new files:<br>
-    <br>
-    /etc/shorewall/actions - used to list the user-defined ACTIONS.<br>
-    /etc/shorewall/action.template - For each user defined &lt;action&gt;,
-    copy this file to /etc/shorewall/action.&lt;action&gt; and add the
-    appropriate rules for that &lt;action&gt;. Once an &lt;action&gt; has
-    been defined, it may be used like any of the builtin ACTIONS (ACCEPT,
-    DROP, etc.) in /etc/shorewall/rules.<br>
-    <br>
-    Example: You want an action that logs a packet at the 'info' level and
-    accepts the connection.<br>
-    <br>
-    In /etc/shorewall/actions, you would add:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp; LogAndAccept<br>
-    <br>
-    You would then copy /etc/shorewall/action.template to
-    /etc/shorewall/action.LogAndAccept and in that file, you would add the
-    two rules:<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LOG:info<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ACCEPT<br>
-  </li>
-  <li>The default value for NEWNOTSYN in shorewall.conf is now "Yes" (non-syn
-    TCP packets that are not part of an existing connection are filtered
-    according to the rules and policies rather than being dropped). I have
-    made this change for two reasons:<br>
-    <br>
-    a) NEWNOTSYN=No tends to result in lots of "stuck" connections since any
-    timeout during TCP session tear down results in the firewall dropping all
-    of the retries.<br>
-    <br>
-    b) The old default of NEWNOTSYN=No and LOGNEWNOTSYN=info resulted in lots
-    of confusing messages when a connection got "stuck". While I could have
-    changed the default value of LOGNEWNOTSYN to suppress logging, I dislike
-    defaults that silently throw away packets.</li>
-</ol>
-
-<p><b>12/03/2003 - Support Torch Passed</b></p>
-Effective today, I am reducing my participation in the day-to-day support of
-Shorewall. As part of this shift to community-based Shorewall support a new
-<a
-href="https://lists.shorewall.net/mailman/listinfo/shorewall-newbies">Shorewall
-Newbies mailing list</a> has been established to field questions and problems
-from new users. I will not monitor that list personally. I will continue my
-active development of Shorewall and will be available via the development
-list to handle development issues -- Tom. 
-
-<p><b>11/07/2003 - Shorewall 1.4.8<br>
-<br>
-</b> Problems Corrected since version 1.4.7:<br>
-</p>
-<ol>
-  <li>Tuomo Soini has supplied a correction to a problem that occurs using
-    some versions of 'ash'. The symptom is that "shorewall start" fails
-    with:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; local: --limit: bad variable name<br>
-    &nbsp;&nbsp; iptables v1.2.8: Couldn't load match
-    `-j':/lib/iptables/libipt_-j.so:<br>
-    &nbsp;&nbsp; cannot open shared object file: No such file or directory<br>
-    &nbsp;&nbsp; Try `iptables -h' or 'iptables --help' for more
-  information.</li>
-  <li>Andres Zhoglo has supplied a correction that avoids trying to use the
-    multiport match iptables facility on ICMP rules.<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; Example of rule that previously caused "shorewall start" to
-    fail:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    ACCEPT&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; loc&nbsp; $FW&nbsp;
-    icmp&nbsp;&nbsp;&nbsp; 0,8,11,12<br>
-    <br>
-  </li>
-  <li>Previously, if the following error message was issued, Shorewall was
-    left in an inconsistent state.<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; Error: Unable to determine the routes through interface
-    xxx<br>
-    <br>
-  </li>
-  <li>Handling of the LOGUNCLEAN option in shorewall.conf has been
-  corrected.</li>
-  <li>In Shorewall 1.4.2, an optimization was added. This optimization
-    involved creating a chain named "&lt;zone&gt;_frwd" for most zones
-    defined using the /etc/shorewall/hosts file. It has since been discovered
-    that in many cases these new chains contain redundant rules and that the
-    "optimization" turns out to be less than optimal. The implementation has
-    now been corrected.</li>
-  <li>When the MARK value in a tcrules entry is followed by ":F" or ":P", the
-    ":F" or ":P" was previously only applied to the first Netfilter rule
-    generated by the entry. It is now applied to all entries.</li>
-  <li>An incorrect comment concerning Debian's use of the SUBSYSLOCK option
-    has been removed from shorewall.conf.</li>
-  <li>Previously, neither the 'routefilter' interface option nor the
-    ROUTE_FILTER parameter were working properly. This has been corrected
-    (thanks to Eric Bowles for his analysis and patch). The definition of the
-    ROUTE_FILTER option has changed however. Previously, ROUTE_FILTER=Yes was
-    documented as enabling route filtering on all interfaces (which didn't
-    work). Beginning with this release, setting ROUTE_FILTER=Yes will enable
-    route filtering of all interfaces brought up while Shorewall is started.
-    As a consequence, ROUTE_FILTER=Yes can coexist with the use of the
-    'routefilter' option in the interfaces file.</li>
-  <li>If MAC verification was enabled on an interface with a /32 address and
-    a broadcast address then an error would occur during startup.</li>
-  <li>The NONE policy's intended use is to suppress the generating of rules
-    that can't possibly be traversed. This means that a policy of NONE is
-    inappropriate where the source or destination zone is $FW or "all".
-    Shorewall now generates an error message if such a policy is given in
-    /etc/shorewall/policy. Previously such a policy caused "shorewall start"
-    to fail.</li>
-  <li>The 'routeback' option was broken for wildcard interfaces (e.g.,
-    "tun+"). This has been corrected so that 'routeback' now works as
-    expected in this case.<br>
-  </li>
-</ol>
-Migration Issues:<br>
-
-<ol>
-  <li>The definition of the ROUTE_FILTER option in shorewall.conf has changed
-    as described in item 8) above.<br>
-  </li>
-</ol>
-New Features:<br>
-
-<ol>
-  <li>A new QUEUE action has been introduced for rules. QUEUE allows you to
-    pass connection requests to a user-space filter such as ftwall
-    (http://p2pwall.sourceforge.net). The ftwall program allows for effective
-    filtering of p2p applications such as Kazaa. For example, to use ftwall
-    to filter P2P clients in the 'loc' zone, you would add the following
-    rules:<br>
-    <br>
-    &nbsp;&nbsp; QUEUE&nbsp;&nbsp; loc&nbsp;&nbsp;&nbsp;
-    &nbsp;&nbsp;&nbsp;&nbsp; net&nbsp;&nbsp;&nbsp; tcp<br>
-    &nbsp;&nbsp; QUEUE&nbsp;&nbsp; loc&nbsp;&nbsp;&nbsp;
-    &nbsp;&nbsp;&nbsp;&nbsp; net&nbsp;&nbsp;&nbsp; udp<br>
-    &nbsp;&nbsp; QUEUE&nbsp;&nbsp; loc&nbsp;&nbsp;&nbsp;
-    &nbsp;&nbsp;&nbsp;&nbsp; fw&nbsp;&nbsp;&nbsp;&nbsp; udp<br>
-    <br>
-    You would normally want to place those three rules BEFORE any ACCEPT
-    rules for loc-&gt;net udp or tcp.<br>
-    <br>
-    Note: When the protocol specified is TCP ("tcp", "TCP" or "6"), Shorewall
-    will only pass connection requests (SYN packets) to user space. This is
-    for compatibility with ftwall.</li>
-  <li>A BLACKLISTNEWNONLY option has been added to shorewall.conf. When this
-    option is set to "Yes", the blacklists (dynamic and static) are only
-    consulted for new connection requests. When set to "No" (the default if
-    the variable is not set), the blacklists are consulted on every
-    packet.<br>
-    <br>
-    Setting this option to "No" allows blacklisting to stop existing
-    connections from a newly blacklisted host but is more expensive in terms
-    of packet processing time. This is especially true if the blacklists
-    contain a large number of entries.</li>
-  <li>Chain names used in the /etc/shorewall/accounting file may now begin
-    with a digit ([0-9]) and may contain embedded dashes ("-").</li>
-</ol>
-
-<p><b>10/30/2003 - Shorewall 1.4.8 RC1<br>
-</b></p>
-Given the small number of new features and the relatively few lines of code
-that were changed, there will be no Beta for 1.4.8.<br>
-
-
-<p><b><a
-href="http://shorewall.net/pub/shorewall/Beta">http://shorewall.net/pub/shorewall/Beta</a><br>
-<a href="ftp://shorewall.net/pub/shorewall/Beta"
-target="_top">ftp://shorewall.net/pub/shorewall/Beta</a><br>
-<br>
-</b> Problems Corrected since version 1.4.7:<br>
-</p>
-<ol>
-  <li>Tuomo Soini has supplied a correction to a problem that occurs using
-    some versions of 'ash'. The symptom is that "shorewall start" fails
-    with:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; local: --limit: bad variable name<br>
-    &nbsp;&nbsp; iptables v1.2.8: Couldn't load match
-    `-j':/lib/iptables/libipt_-j.so:<br>
-    &nbsp;&nbsp; cannot open shared object file: No such file or directory<br>
-    &nbsp;&nbsp; Try `iptables -h' or 'iptables --help' for more
-  information.</li>
-  <li>Andres Zhoglo has supplied a correction that avoids trying to use the
-    multiport match iptables facility on ICMP rules.<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; Example of rule that previously caused "shorewall start" to
-    fail:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    ACCEPT&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; loc&nbsp; $FW&nbsp;
-    icmp&nbsp;&nbsp;&nbsp; 0,8,11,12<br>
-    <br>
-  </li>
-  <li>Previously, if the following error message was issued, Shorewall was
-    left in an inconsistent state.<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; Error: Unable to determine the routes through interface
-    xxx<br>
-    <br>
-  </li>
-  <li>Handling of the LOGUNCLEAN option in shorewall.conf has been
-  corrected.</li>
-  <li>In Shorewall 1.4.2, an optimization was added. This optimization
-    involved creating a chain named "&lt;zone&gt;_frwd" for most zones
-    defined using the /etc/shorewall/hosts file. It has since been discovered
-    that in many cases these new chains contain redundant rules and that the
-    "optimization" turns out to be less than optimal. The implementation has
-    now been corrected.</li>
-  <li>When the MARK value in a tcrules entry is followed by ":F" or ":P", the
-    ":F" or ":P" was previously only applied to the first Netfilter rule
-    generated by the entry. It is now applied to all entries.</li>
-  <li>An incorrect comment concerning Debian's use of the SYBSYSLOCK option
-    has been removed from shorewall.conf.</li>
-  <li>Previously, neither the 'routefilter' interface option nor the
-    ROUTE_FILTER parameter were working properly. This has been corrected
-    (thanks to Eric Bowles for his analysis and patch). The definition of the
-    ROUTE_FILTER option has changed however. Previously, ROUTE_FILTER=Yes was
-    documented as enabling route filtering on all interfaces (which didn't
-    work). Beginning with this release, setting ROUTE_FILTER=Yes will enable
-    route filtering of all interfaces brought up while Shorewall is started.
-    As a consequence, ROUTE_FILTER=Yes can coexist with the use of the
-    'routefilter' option in the interfaces file.</li>
-</ol>
-Migration Issues:<br>
-
-<ol>
-  <li>The definition of the ROUTE_FILTER option in shorewall.conf has changed
-    as described in item 8) above.<br>
-  </li>
-</ol>
-New Features:<br>
-
-<ol>
-  <li>A new QUEUE action has been introduced for rules. QUEUE allows you to
-    pass connection requests to a user-space filter such as ftwall
-    (http://p2pwall.sourceforge.net). The ftwall program allows for effective
-    filtering of p2p applications such as Kazaa. For example, to use ftwall
-    to filter P2P clients in the 'loc' zone, you would add the following
-    rules:<br>
-    <br>
-    &nbsp;&nbsp; QUEUE&nbsp;&nbsp; loc&nbsp;&nbsp;&nbsp;
-    &nbsp;&nbsp;&nbsp;&nbsp; net&nbsp;&nbsp;&nbsp; tcp<br>
-    &nbsp;&nbsp; QUEUE&nbsp;&nbsp; loc&nbsp;&nbsp;&nbsp;
-    &nbsp;&nbsp;&nbsp;&nbsp; net&nbsp;&nbsp;&nbsp; udp<br>
-    &nbsp;&nbsp; QUEUE&nbsp;&nbsp; loc&nbsp;&nbsp;&nbsp;
-    &nbsp;&nbsp;&nbsp;&nbsp; fw&nbsp;&nbsp;&nbsp;&nbsp; udp<br>
-    <br>
-    You would normally want to place those three rules BEFORE any ACCEPT
-    rules for loc-&gt;net udp or tcp.<br>
-    <br>
-    Note: When the protocol specified is TCP ("tcp", "TCP" or "6"), Shorewall
-    will only pass connection requests (SYN packets) to user space. This is
-    for compatibility with ftwall.</li>
-  <li>A BLACKLISTNEWNONLY option has been added to shorewall.conf. When this
-    option is set to "Yes", the blacklists (dynamic and static) are only
-    consulted for new connection requests. When set to "No" (the default if
-    the variable is not set), the blacklists are consulted on every
-    packet.<br>
-    <br>
-    Setting this option to "No" allows blacklisting to stop existing
-    connections from a newly blacklisted host but is more expensive in terms
-    of packet processing time. This is especially true if the blacklists
-    contain a large number of entries.</li>
-  <li>Chain names used in the /etc/shorewall/accounting file may now begin
-    with a digit ([0-9]) and may contain embedded dashes ("-").<br>
-  </li>
-</ol>
-
-<p><b>10/26/2003 - Shorewall 1.4.7a and 1.4.7b win brown paper bag awards</b>
-<b><img style="border: 0px solid ; width: 50px; height: 80px;"
-src="images/j0233056.gif" title="" alt="" align="middle" />Shorewall 1.4.7c
-released.</b></p>
-<ol>
-  <li>The saga with "&lt;zone&gt;_frwd" chains continues. The 1.4.7c script
-    produces a ruleset that should work for everyone even if it is not quite
-    optimal. My apologies for this ongoing mess.<br>
-  </li>
-</ol>
-
-<p><b>10/24/2003 - Shorewall 1.4.7b</b></p>
-This is a bugfx rollup of the 1.4.7a fixes plus:<br>
-
-<ol>
-  <li>The fix for problem 5 in 1.4.7a was wrong with the result that
-    "&lt;zone&gt;_frwd" chains might contain too few rules. That wrong code
-    is corrected in this release.<br>
-  </li>
-</ol>
-
-<p><b>10/21/2003 - Shorewall 1.4.7a<br>
-</b></p>
-
-<p>This is a bugfix rollup of the following problem corrections:<br>
-</p>
-<ol>
-  <li>Tuomo Soini has supplied a correction to a problem that occurs using
-    some versions of 'ash'. The symptom is that "shorewall start" fails
-    with:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; local: --limit: bad variable name<br>
-    &nbsp;&nbsp; iptables v1.2.8: Couldn't load match
-    `-j':/lib/iptables/libipt_-j.so:<br>
-    &nbsp;&nbsp; cannot open shared object file: No such file or directory<br>
-    &nbsp;&nbsp; Try `iptables -h' or 'iptables --help' for more
-    information.<br>
-    <br>
-  </li>
-  <li>Andres Zhoglo has supplied a correction that avoids trying to use the
-    multiport match iptables facility on ICMP rules.<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; Example of rule that previously caused "shorewall start" to
-    fail:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    ACCEPT&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; loc&nbsp; $FW&nbsp;
-    icmp&nbsp;&nbsp;&nbsp; 0,8,11,12<br>
-    <br>
-  </li>
-  <li>Previously, if the following error message was issued, Shorewall was
-    left in an inconsistent state.<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; Error: Unable to determine the routes through interface
-    xxx<br>
-    <br>
-  </li>
-  <li>Handling of the LOGUNCLEAN option in shorewall.conf has been
-  corrected.</li>
-  <li>In Shorewall 1.4.2, an optimization was added. This optimization
-    involved creating a chain named "&lt;zone&gt;_frwd" for most zones
-    defined using the /etc/shorewall/hosts file. It has since been discovered
-    that in many cases these new chains contain redundant rules and that the
-    "optimization" turns out to be less than optimal. The implementation has
-    now been corrected.</li>
-  <li>When the MARK value in a tcrules entry is followed by ":F" or ":P", the
-    ":F" or ":P" was previously only applied to the first Netfilter rule
-    generated by the entry. It is now applied to all entries.<br>
-  </li>
-</ol>
-
-<p><b>10/06/2003 - Shorewall 1.4.7</b><b><br>
-</b></p>
-<b>Problems Corrected since version 1.4.6 (Those in bold font were corrected
-since 1.4.7 RC2).</b><br>
-
-<ol>
-  <li>Corrected problem in 1.4.6 where the MANGLE_ENABLED variable was being
-    tested before it was set.</li>
-  <li>Corrected handling of MAC addresses in the SOURCE column of the tcrules
-    file. Previously, these addresses resulted in an invalid iptables
-  command.</li>
-  <li>The "shorewall stop" command is now disabled when
-    /etc/shorewall/startup_disabled exists. This prevents people from
-    shooting themselves in the foot prior to having configured Shorewall.</li>
-  <li>A change introduced in version 1.4.6 caused error messages during
-    "shorewall [re]start" when ADD_IP_ALIASES=Yes and ip addresses were being
-    added to a PPP interface; the addresses were successfully added in spite
-    of the messages.<br>
-    &nbsp;&nbsp;&nbsp;<br>
-    The firewall script has been modified to eliminate the error messages</li>
-  <li>Interface-specific dynamic blacklisting chains are now displayed by
-    "shorewall monitor" on the "Dynamic Chains" page (previously named
-    "Dynamic Chain").</li>
-  <li>Thanks to Henry Yang, LOGRATE and LOGBURST now work again.</li>
-  <li value="7">The 'shorewall reject' and 'shorewall drop' commands now
-    delete any existing rules for the subject IP address before adding a new
-    DROP or REJECT rule. Previously, there could be many rules for the same
-    IP address in the dynamic chain so that multiple 'allow' commands were
-    required to re-enable traffic to/from the address.</li>
-  <li>When ADD_SNAT_ALIASES=Yes in shorewall.conf, the following entry in
-    /etc/shorewall/masq resulted in a startup error:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; eth0 eth1&nbsp;&nbsp;&nbsp;&nbsp;
-    206.124.146.20-206.124.146.24<br>
-    <br>
-  </li>
-  <li>Shorewall previously choked over IPV6 addresses configured on
-    interfaces in contexts where Shorewall needed to detect something about
-    the interface (such as when "detect" appears in the BROADCAST column of
-    the /etc/shorewall/interfaces file).</li>
-  <li>Shorewall will now load module files that are formed from the module
-    name by appending ".o.gz".</li>
-  <li>When Shorewall adds a route to a proxy ARP host and such a route
-    already exists, two routes resulted previously. This has been corrected
-    so that the existing route is replaced if it already exists.</li>
-  <li>The rfc1918 file has been updated to reflect recent allocations.</li>
-  <li>The documentation of the USER SET column in the rules file has been
-    corrected.</li>
-  <li>If there is no policy defined for the zones specified in a rule, the
-    firewall script previously encountered a shell syntax error:<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [: NONE: unexpected
-    operator<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
-    Now, the absence of a policy generates an error message and the firewall
-    is stopped:<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; No policy defined from zone
-    &lt;source&gt; to zone &lt;dest&gt;<br>
-    <br>
-  </li>
-  <li>Previously, if neither /etc/shorewall/common nor
-    /etc/shorewall/common.def existed, Shorewall would fail to start and
-    would not remove the lock file. Failure to remove the lock file resulted
-    in the following during subsequent attempts to start:<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
-    &nbsp;&nbsp;&nbsp; Loading /usr/share/shorewall/functions...<br>
-    &nbsp;&nbsp;&nbsp; Processing /etc/shorewall/params ...<br>
-    &nbsp;&nbsp;&nbsp; Processing /etc/shorewall/shorewall.conf...<br>
-    &nbsp;&nbsp;&nbsp; Giving up on lock file /var/lib/shorewall/lock<br>
-    &nbsp;&nbsp;&nbsp; Shorewall Not Started<br>
-    <br>
-    Shorewall now reports a fatal error if neither of these two files exist
-    and correctly removes the lock fille.</li>
-  <li>The order of processing the various options has been changed such that
-    blacklist entries now take precedence over the 'dhcp' <span
-    style="font-weight: bold;">i</span>nterface setting.</li>
-  <li>The log message generated from the 'logunclean' interface option has
-    been changed to reflect a disposition of LOG rather than DROP.</li>
-  <li><span style="font-weight: bold;">When a user name and/or a group name
-    was specified in the USER SET column and the destination zone was
-    qualified with a IP address, the user and/or group name was not being
-    used to qualify the rule.<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp; Example:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp; ACCEPT fw&nbsp; net:192.0.2.12 tcp 23 - - -
-    vladimir:<br>
-    <br>
-    </span></li>
-  <li><span style="font-weight: bold;">The /etc/shorewall/masq file has had
-    the spurious "/" character at the front removed.<br>
-    <br>
-    </span></li>
-</ol>
-<b>Migration Issues:</b><br>
-
-<ol>
-  <li>Shorewall IP Traffic Accounting has changed since snapshot 20030813 --
-    see the <a href="Accounting.html">Accounting Page</a> for details.</li>
-  <li>The Uset Set capability introduced in SnapShot 20030821 has changed --
-    see the <a href="UserSets.html">User Set page</a> for details.</li>
-  <li>The per-interface Dynamic Blacklisting facility introduced in the first
-    post-1.4.6 Snapshot has been removed. The facility had too many
-    idiosyncrasies for dial-up users to be a viable part of Shorewall.<br>
-  </li>
-</ol>
-<b>New Features:</b><br>
-
-<ol>
-  <li>Thanks to Steve Herber, the 'help' command can now give
-    command-specific help (e.g., shorewall help &lt;command&gt;).</li>
-  <li>A new option "ADMINISABSENTMINDED" has been added to
-    /etc/shorewall/shorewall.conf. This option has a default value of "No"
-    for existing users which causes Shorewall's 'stopped' state &nbsp;to
-    continue as it has been; namely, in the stopped state only traffic
-    to/from hosts listed in /etc/shorewall/routestopped is accepted.<br>
-    <br>
-    With ADMINISABSENTMINDED=Yes (the default for new installs), in addition
-    to traffic to/from the hosts listed in /etc/shorewall/routestopped,
-    Shorewall will allow:<br>
-    <br>
-    &nbsp;&nbsp; a) All traffic originating from the firewall itself; and<br>
-    &nbsp;&nbsp; b) All traffic that is part of or related to an
-    already-existing connection.<br>
-    <br>
-    &nbsp;In particular, with ADMINISABSENTMINDED=Yes, a "shorewall stop"
-    entered through an ssh session will not kill the session.<br>
-    <br>
-    &nbsp;Note though that even with ADMINISABSENTMINDED=Yes, it is still
-    possible for people to shoot themselves in the foot.<br>
-    <br>
-    &nbsp;Example:<br>
-    <br>
-    &nbsp;/etc/shorewall/nat:<br>
-    <br>
-    &nbsp; &nbsp; &nbsp;206.124.146.178&nbsp;&nbsp;&nbsp;
-    eth0:0&nbsp;&nbsp;&nbsp; 192.168.1.5&nbsp;&nbsp;&nbsp;<br>
-    <br>
-    &nbsp;/etc/shorewall/rules:<br>
-    <br>
-    &nbsp;&nbsp; ACCEPT&nbsp;&nbsp;&nbsp; net&nbsp;&nbsp;&nbsp;
-    loc:192.168.1.5&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp; 22<br>
-    &nbsp;&nbsp; ACCEPT&nbsp;&nbsp;&nbsp; loc&nbsp;&nbsp;&nbsp;
-    fw&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp; 22<br>
-    <br>
-    From a remote system, I ssh to 206.124.146.178 which establishes an SSH
-    connection with local system 192.168.1.5. I then create a second SSH
-    connection from that computer to the firewall and confidently type
-    "shorewall stop". As part of its stop processing, Shorewall removes
-    eth0:0 which kills my SSH connection to 192.168.1.5!!!</li>
-  <li>Given the wide range of VPN software, I can never hope to add specific
-    support for all of it. I have therefore decided to add "generic" tunnel
-    support.<br>
-    &nbsp;<br>
-    Generic tunnels work pretty much like any of the other tunnel types. You
-    usually add a zone to represent the systems at the other end of the
-    tunnel and you add the appropriate rules/policies to<br>
-    implement your security policy regarding traffic to/from those
-    systems.<br>
-    &nbsp;<br>
-    In the /etc/shorewall/tunnels file, you can have entries of the form:<br>
-    <br>
-    generic:&lt;protocol&gt;[:&lt;port&gt;]&nbsp; &lt;zone&gt;&nbsp; &lt;ip
-    address&gt;&nbsp;&nbsp;&nbsp; &lt;gateway zones&gt;<br>
-    &nbsp;<br>
-    where:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;protocol&gt; is the protocol
-    used by the tunnel<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;port&gt;&nbsp; if the protocol
-    is 'udp' or 'tcp' then this is the destination port number used by the
-    tunnel.<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;zone&gt;&nbsp; is the zone of
-    the remote tunnel gateway<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;ip address&gt; is the IP address
-    of the remote tunnel gateway.<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;gateway zone&gt;&nbsp;&nbsp;
-    Optional. A comma-separated list of zone names. If specified, the remote
-    gateway is to be considered part of these zones.</li>
-  <li>An 'arp_filter' option has been added to the /etc/shorewall/interfaces
-    file. This option causes
-    /proc/sys/net/ipv4/conf/&lt;interface&gt;/arp_filter to be set with the
-    result that this interface will only answer ARP 'who-has' requests from
-    hosts that are routed out through that interface. Setting this option
-    facilitates testing of your firewall where multiple firewall interfaces
-    are connected to the same HUB/Switch (all interfaces connected to the
-    single HUB/Switch should have this option specified). Note that using
-    such a configuration in a production environment is strongly recommended
-    against.</li>
-  <li>The ADDRESS column in /etc/shorewall/masq may now include a
-    comma-separated list of addresses and/or address ranges. Netfilter will
-    use all listed addresses/ranges in round-robin fashion. \</li>
-  <li>An /etc/shorewall/accounting file has been added to allow for traffic
-    accounting.&nbsp; See the <a href="Accounting.html">accounting
-    documentation</a> for a description of this facility.</li>
-  <li>Bridge interfaces (br[0-9]) may now be used in
-  /etc/shorewall/maclist.</li>
-  <li>ACCEPT, DNAT[-], REDIRECT[-] and LOG rules defined in
-    /etc/shorewall/rules may now be rate-limited. For DNAT and REDIRECT
-    rules, rate limiting occurs in the nat table DNAT rule; the corresponding
-    ACCEPT rule in the filter table is not rate limited. If you want to limit
-    the filter table rule, you will need o create two rules; a DNAT- rule and
-    an ACCEPT rule which can be rate-limited separately.<br>
-    &nbsp;<br>
-    <span style="font-weight: bold;">Warning:</span> When rate limiting is
-    specified on a rule with "all" in the SOURCE or DEST fields, the limit
-    will apply to each pair of zones individually rather than as a single
-    limit for all pairs of covered by the rule.<br>
-    &nbsp;<br>
-    To specify a rate limit,<br>
-    <br>
-    a) Follow ACCEPT, DNAT[-], REDIRECT[-] or LOG with<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;
-    &lt;rate&gt;/&lt;interval&gt;[:&lt;burst&gt;] &gt;<br>
-    &nbsp;<br>
-    &nbsp; where<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;rate&gt; is the sustained rate per
-    &lt;interval&gt;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;interval&gt; is "sec" or "min"<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;burst&gt; is the largest burst
-    accepted within an &lt;interval&gt;. If not given, the default of 5 is
-    assumed.<br>
-    &nbsp;<br>
-    There may be no white space between the ACTION and "&lt;" nor there may
-    be any white space within the burst specification. If you want to specify
-    logging of a rate-limited rule, the ":" and log level comes after the
-    "&gt;" (e.g., ACCEPT&lt;2/sec:4&gt;:info ).<br>
-    <br>
-    b) A new RATE LIMIT column has been added to the /etc/shorewall/rules
-    file. You may specify the rate limit there in the format:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    &lt;rate&gt;/&lt;interval&gt;[:&lt;burst&gt;]<br>
-    &nbsp;<br>
-    Let's take an example:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    ACCEPT&lt;2/sec:4&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    net&nbsp;&nbsp;&nbsp;&nbsp; dmz&nbsp;&nbsp;&nbsp;&nbsp;
-    tcp&nbsp;&nbsp;&nbsp;&nbsp; 80<br>
-    &nbsp;&nbsp;&nbsp;<br>
-    The first time this rule is reached, the packet will be accepted; in
-    fact, since the burst is 4, the first four packets will be accepted.
-    After this, it will be 500ms (1 second divided by the rate<br>
-    of 2) before a packet will be accepted from this rule, regardless of how
-    many packets reach it. Also, every 500ms which passes without matching a
-    packet, one of the bursts will be regained; if no packets hit the rule
-    for 2 second, the burst will be fully recharged; back where we
-    started.<br>
-  </li>
-  <li>Multiple chains may now be displayed in one "shorewall show" command
-    (e.g., shorewall show INPUT FORWARD OUTPUT).</li>
-  <li>Output rules (those with $FW as the SOURCE) may now be limited to a set
-    of local users and/or groups. See <a
-    href="UserSets.html">http://shorewall.net/UserSets.html</a> for
-  details.</li>
-</ol>
-
-<p><b>10/02/2003 - Shorewall 1.4.7 RC2</b><b><br>
-</b></p>
-
-<p><b><a
-href="http://shorewall.net/pub/shorewall/Beta">http://shorewall.net/pub/shorewall/Beta</a><br>
-<a href="ftp://shorewall.net/pub/shorewall/Beta"
-target="_top">ftp://shorewall.net/pub/shorewall/Beta</a><br>
-</b></p>
-<b>Problems Corrected since version 1.4.6 (Those in bold font were corrected
-since 1.4.7 RC 1).</b><br>
-
-<ol>
-  <li>Corrected problem in 1.4.6 where the MANGLE_ENABLED variable was being
-    tested before it was set.</li>
-  <li>Corrected handling of MAC addresses in the SOURCE column of the tcrules
-    file. Previously, these addresses resulted in an invalid iptables
-  command.</li>
-  <li>The "shorewall stop" command is now disabled when
-    /etc/shorewall/startup_disabled exists. This prevents people from
-    shooting themselves in the foot prior to having configured Shorewall.</li>
-  <li>A change introduced in version 1.4.6 caused error messages during
-    "shorewall [re]start" when ADD_IP_ALIASES=Yes and ip addresses were being
-    added to a PPP interface; the addresses were successfully added in spite
-    of the messages.<br>
-    &nbsp;&nbsp;&nbsp;<br>
-    The firewall script has been modified to eliminate the error messages</li>
-  <li>Interface-specific dynamic blacklisting chains are now displayed by
-    "shorewall monitor" on the "Dynamic Chains" page (previously named
-    "Dynamic Chain").</li>
-  <li>Thanks to Henry Yang, LOGRATE and LOGBURST now work again.</li>
-  <li value="7">The 'shorewall reject' and 'shorewall drop' commands now
-    delete any existing rules for the subject IP address before adding a new
-    DROP or REJECT rule. Previously, there could be many rules for the same
-    IP address in the dynamic chain so that multiple 'allow' commands were
-    required to re-enable traffic to/from the address.</li>
-  <li>When ADD_SNAT_ALIASES=Yes in shorewall.conf, the following entry in
-    /etc/shorewall/masq resulted in a startup error:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; eth0 eth1&nbsp;&nbsp;&nbsp;&nbsp;
-    206.124.146.20-206.124.146.24<br>
-    <br>
-  </li>
-  <li>Shorewall previously choked over IPV6 addresses configured on
-    interfaces in contexts where Shorewall needed to detect something about
-    the interface (such as when "detect" appears in the BROADCAST column of
-    the /etc/shorewall/interfaces file).</li>
-  <li>Shorewall will now load module files that are formed from the module
-    name by appending ".o.gz".</li>
-  <li>When Shorewall adds a route to a proxy ARP host and such a route
-    already exists, two routes resulted previously. This has been corrected
-    so that the existing route is replaced if it already exists.</li>
-  <li>The rfc1918 file has been updated to reflect recent allocations.</li>
-  <li><span style="font-weight: bold;">The documentation of the USER SET
-    column in the rules file has been corrected.</span></li>
-  <li><span style="font-weight: bold;">If there is no policy defined for the
-    zones specified in a rule, the firewall script previously encountered a
-    shell syntax error:<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [: NONE: unexpected
-    operator<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
-    Now, the absence of a policy generates an error message and the firewall
-    is stopped:<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; No policy defined from zone
-    &lt;source&gt; to zone &lt;dest&gt;<br>
-    <br>
-    </span></li>
-  <li><span style="font-weight: bold;">Previously, if neither
-    /etc/shorewall/common nor /etc/shorewall/common.def existed, Shorewall
-    would fail to start and would not remove the lock file. Failure to remove
-    the lock file resulted in the following during subsequent attempts to
-    start:<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
-    &nbsp;&nbsp;&nbsp; Loading /usr/share/shorewall/functions...<br>
-    &nbsp;&nbsp;&nbsp; Processing /etc/shorewall/params ...<br>
-    &nbsp;&nbsp;&nbsp; Processing /etc/shorewall/shorewall.conf...<br>
-    &nbsp;&nbsp;&nbsp; Giving up on lock file /var/lib/shorewall/lock<br>
-    &nbsp;&nbsp;&nbsp; Shorewall Not Started<br>
-    <br>
-    Shorewall now reports a fatal error if neither of these two files exist
-    and correctly removes the lock fille.</span></li>
-  <li><span style="font-weight: bold;">The order of processing the various
-    options has been changed such that blacklist entries now take precedence
-    over the 'dhcp' interface setting.</span></li>
-  <li><span style="font-weight: bold;">The log message generated from the
-    'logunclean' interface option has been changed to reflect a disposition
-    of LOG rather than DROP.</span></li>
-  <li><span style="font-weight: bold;">The RFC1918 file has been updated to
-    reflect recent IANA allocations.<br>
-    </span></li>
-</ol>
-<b>Migration Issues:</b><br>
-
-<ol>
-  <li>Shorewall IP Traffic Accounting has changed since snapshot 20030813 --
-    see the <a href="Accounting.html">Accounting Page</a> for details.</li>
-  <li>The Uset Set capability introduced in SnapShot 20030821 has changed --
-    see the <a href="UserSets.html">User Set page</a> for details.</li>
-  <li>The per-interface Dynamic Blacklisting facility introduced in the first
-    post-1.4.6 Snapshot has been removed. The facility had too many
-    idiosyncrasies for dial-up users to be a viable part of Shorewall.<br>
-  </li>
-</ol>
-<b>New Features:</b><br>
-
-<ol>
-  <li>Thanks to Steve Herber, the 'help' command can now give
-    command-specific help (e.g., shorewall help &lt;command&gt;).</li>
-  <li>A new option "ADMINISABSENTMINDED" has been added to
-    /etc/shorewall/shorewall.conf. This option has a default value of "No"
-    for existing users which causes Shorewall's 'stopped' state &nbsp;to
-    continue as it has been; namely, in the stopped state only traffic
-    to/from hosts listed in /etc/shorewall/routestopped is accepted.<br>
-    <br>
-    With ADMINISABSENTMINDED=Yes (the default for new installs), in addition
-    to traffic to/from the hosts listed in /etc/shorewall/routestopped,
-    Shorewall will allow:<br>
-    <br>
-    &nbsp;&nbsp; a) All traffic originating from the firewall itself; and<br>
-    &nbsp;&nbsp; b) All traffic that is part of or related to an
-    already-existing connection.<br>
-    <br>
-    &nbsp;In particular, with ADMINISABSENTMINDED=Yes, a "shorewall stop"
-    entered through an ssh session will not kill the session.<br>
-    <br>
-    &nbsp;Note though that even with ADMINISABSENTMINDED=Yes, it is still
-    possible for people to shoot themselves in the foot.<br>
-    <br>
-    &nbsp;Example:<br>
-    <br>
-    &nbsp;/etc/shorewall/nat:<br>
-    <br>
-    &nbsp; &nbsp; &nbsp;206.124.146.178&nbsp;&nbsp;&nbsp;
-    eth0:0&nbsp;&nbsp;&nbsp; 192.168.1.5&nbsp;&nbsp;&nbsp;<br>
-    <br>
-    &nbsp;/etc/shorewall/rules:<br>
-    <br>
-    &nbsp;&nbsp; ACCEPT&nbsp;&nbsp;&nbsp; net&nbsp;&nbsp;&nbsp;
-    loc:192.168.1.5&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp; 22<br>
-    &nbsp;&nbsp; ACCEPT&nbsp;&nbsp;&nbsp; loc&nbsp;&nbsp;&nbsp;
-    fw&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp; 22<br>
-    <br>
-    From a remote system, I ssh to 206.124.146.178 which establishes an SSH
-    connection with local system 192.168.1.5. I then create a second SSH
-    connection from that computer to the firewall and confidently type
-    "shorewall stop". As part of its stop processing, Shorewall removes
-    eth0:0 which kills my SSH connection to 192.168.1.5!!!</li>
-  <li>Given the wide range of VPN software, I can never hope to add specific
-    support for all of it. I have therefore decided to add "generic" tunnel
-    support.<br>
-    &nbsp;<br>
-    Generic tunnels work pretty much like any of the other tunnel types. You
-    usually add a zone to represent the systems at the other end of the
-    tunnel and you add the appropriate rules/policies to<br>
-    implement your security policy regarding traffic to/from those
-    systems.<br>
-    &nbsp;<br>
-    In the /etc/shorewall/tunnels file, you can have entries of the form:<br>
-    <br>
-    generic:&lt;protocol&gt;[:&lt;port&gt;]&nbsp; &lt;zone&gt;&nbsp; &lt;ip
-    address&gt;&nbsp;&nbsp;&nbsp; &lt;gateway zones&gt;<br>
-    &nbsp;<br>
-    where:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;protocol&gt; is the protocol
-    used by the tunnel<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;port&gt;&nbsp; if the protocol
-    is 'udp' or 'tcp' then this is the destination port number used by the
-    tunnel.<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;zone&gt;&nbsp; is the zone of
-    the remote tunnel gateway<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;ip address&gt; is the IP address
-    of the remote tunnel gateway.<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;gateway zone&gt;&nbsp;&nbsp;
-    Optional. A comma-separated list of zone names. If specified, the remote
-    gateway is to be considered part of these zones.</li>
-  <li>An 'arp_filter' option has been added to the /etc/shorewall/interfaces
-    file. This option causes
-    /proc/sys/net/ipv4/conf/&lt;interface&gt;/arp_filter to be set with the
-    result that this interface will only answer ARP 'who-has' requests from
-    hosts that are routed out through that interface. Setting this option
-    facilitates testing of your firewall where multiple firewall interfaces
-    are connected to the same HUB/Switch (all interfaces connected to the
-    single HUB/Switch should have this option specified). Note that using
-    such a configuration in a production environment is strongly recommended
-    against.</li>
-  <li>The ADDRESS column in /etc/shorewall/masq may now include a
-    comma-separated list of addresses and/or address ranges. Netfilter will
-    use all listed addresses/ranges in round-robin fashion. \</li>
-  <li>An /etc/shorewall/accounting file has been added to allow for traffic
-    accounting.&nbsp; See the <a href="Accounting.html">accounting
-    documentation</a> for a description of this facility.</li>
-  <li>Bridge interfaces (br[0-9]) may now be used in
-  /etc/shorewall/maclist.</li>
-  <li>ACCEPT, DNAT[-], REDIRECT[-] and LOG rules defined in
-    /etc/shorewall/rules may now be rate-limited. For DNAT and REDIRECT
-    rules, rate limiting occurs in the nat table DNAT rule; the corresponding
-    ACCEPT rule in the filter table is not rate limited. If you want to limit
-    the filter table rule, you will need o create two rules; a DNAT- rule and
-    an ACCEPT rule which can be rate-limited separately.<br>
-    &nbsp;<br>
-    <span style="font-weight: bold;">Warning:</span> When rate limiting is
-    specified on a rule with "all" in the SOURCE or DEST fields, the limit
-    will apply to each pair of zones individually rather than as a single
-    limit for all pairs of covered by the rule.<br>
-    &nbsp;<br>
-    To specify a rate limit,<br>
-    <br>
-    a) Follow ACCEPT, DNAT[-], REDIRECT[-] or LOG with<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;
-    &lt;rate&gt;/&lt;interval&gt;[:&lt;burst&gt;] &gt;<br>
-    &nbsp;<br>
-    &nbsp; where<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;rate&gt; is the sustained rate per
-    &lt;interval&gt;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;interval&gt; is "sec" or "min"<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;burst&gt; is the largest burst
-    accepted within an &lt;interval&gt;. If not given, the default of 5 is
-    assumed.<br>
-    &nbsp;<br>
-    There may be no white space between the ACTION and "&lt;" nor there may
-    be any white space within the burst specification. If you want to specify
-    logging of a rate-limited rule, the ":" and log level comes after the
-    "&gt;" (e.g., ACCEPT&lt;2/sec:4&gt;:info ).<br>
-    <br>
-    b) A new RATE LIMIT column has been added to the /etc/shorewall/rules
-    file. You may specify the rate limit there in the format:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    &lt;rate&gt;/&lt;interval&gt;[:&lt;burst&gt;]<br>
-    &nbsp;<br>
-    Let's take an example:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    ACCEPT&lt;2/sec:4&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    net&nbsp;&nbsp;&nbsp;&nbsp; dmz&nbsp;&nbsp;&nbsp;&nbsp;
-    tcp&nbsp;&nbsp;&nbsp;&nbsp; 80<br>
-    &nbsp;&nbsp;&nbsp;<br>
-    The first time this rule is reached, the packet will be accepted; in
-    fact, since the burst is 4, the first four packets will be accepted.
-    After this, it will be 500ms (1 second divided by the rate<br>
-    of 2) before a packet will be accepted from this rule, regardless of how
-    many packets reach it. Also, every 500ms which passes without matching a
-    packet, one of the bursts will be regained; if no packets hit the rule
-    for 2 second, the burst will be fully recharged; back where we
-    started.<br>
-  </li>
-  <li>Multiple chains may now be displayed in one "shorewall show" command
-    (e.g., shorewall show INPUT FORWARD OUTPUT).</li>
-  <li>Output rules (those with $FW as the SOURCE) may now be limited to a set
-    of local users and/or groups. See <a
-    href="UserSets.html">http://shorewall.net/UserSets.html</a> for
-  details.</li>
-</ol>
-
-<p><b>9/18/2003 - Shorewall 1.4.7 RC 1</b><b><br>
-</b></p>
-
-<p><b><a
-href="http://shorewall.net/pub/shorewall/Beta">http://shorewall.net/pub/shorewall/Beta</a><br>
-<a href="ftp://shorewall.net/pub/shorewall/Beta"
-target="_top">ftp://shorewall.net/pub/shorewall/Beta</a><br>
-</b></p>
-<b>Problems Corrected since version 1.4.6 (Those in bold font were corrected
-since 1.4.7 Beta 1).</b><br>
-
-<ol>
-  <li>Corrected problem in 1.4.6 where the MANGLE_ENABLED variable was being
-    tested before it was set.</li>
-  <li>Corrected handling of MAC addresses in the SOURCE column of the tcrules
-    file. Previously, these addresses resulted in an invalid iptables
-  command.</li>
-  <li>The "shorewall stop" command is now disabled when
-    /etc/shorewall/startup_disabled exists. This prevents people from
-    shooting themselves in the foot prior to having configured Shorewall.</li>
-  <li>A change introduced in version 1.4.6 caused error messages during
-    "shorewall [re]start" when ADD_IP_ALIASES=Yes and ip addresses were being
-    added to a PPP interface; the addresses were successfully added in spite
-    of the messages.<br>
-    &nbsp;&nbsp;&nbsp;<br>
-    The firewall script has been modified to eliminate the error messages</li>
-  <li>Interface-specific dynamic blacklisting chains are now displayed by
-    "shorewall monitor" on the "Dynamic Chains" page (previously named
-    "Dynamic Chain").</li>
-  <li>Thanks to Henry Yang, LOGRATE and LOGBURST now work again.</li>
-  <li value="7">The 'shorewall reject' and 'shorewall drop' commands now
-    delete any existing rules for the subject IP address before adding a new
-    DROP or REJECT rule. Previously, there could be many rules for the same
-    IP address in the dynamic chain so that multiple 'allow' commands were
-    required to re-enable traffic to/from the address.</li>
-  <li>When ADD_SNAT_ALIASES=Yes in shorewall.conf, the following entry in
-    /etc/shorewall/masq resulted in a startup error:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; eth0 eth1&nbsp;&nbsp;&nbsp;&nbsp;
-    206.124.146.20-206.124.146.24<br>
-    <br>
-  </li>
-  <li>Shorewall previously choked over IPV6 addresses configured on
-    interfaces in contexts where Shorewall needed to detect something about
-    the interface (such as when "detect" appears in the BROADCAST column of
-    the /etc/shorewall/interfaces file).</li>
-  <li>Shorewall will now load module files that are formed from the module
-    name by appending ".o.gz".</li>
-  <li style="font-weight: bold;">When Shorewall adds a route to a proxy ARP
-    host and such a route already exists, two routes resulted previously.
-    This has been corrected so that the existing route is replaced if it
-    already exists.</li>
-  <li><span style="font-weight: bold;">The rfc1918 file has been updated to
-    reflect recent allocations.</span><br>
-  </li>
-</ol>
-<b>Migration Issues:</b><br>
-
-<ol>
-  <li>Shorewall IP Traffic Accounting has changed since snapshot 20030813 --
-    see the <a href="Accounting.html">Accounting Page</a> for details.</li>
-  <li>The Uset Set capability introduced in SnapShot 20030821 has changed --
-    see the <a href="UserSets.html">User Set page</a> for details.</li>
-  <li>The per-interface Dynamic Blacklisting facility introduced in the first
-    post-1.4.6 Snapshot has been removed. The facility had too many
-    idiosyncrasies for dial-up users to be a viable part of Shorewall.<br>
-  </li>
-</ol>
-<b>New Features:</b><br>
-
-<ol>
-  <li>Thanks to Steve Herber, the 'help' command can now give
-    command-specific help (e.g., shorewall help &lt;command&gt;).</li>
-  <li>A new option "ADMINISABSENTMINDED" has been added to
-    /etc/shorewall/shorewall.conf. This option has a default value of "No"
-    for existing users which causes Shorewall's 'stopped' state &nbsp;to
-    continue as it has been; namely, in the stopped state only traffic
-    to/from hosts listed in /etc/shorewall/routestopped is accepted.<br>
-    <br>
-    With ADMINISABSENTMINDED=Yes (the default for new installs), in addition
-    to traffic to/from the hosts listed in /etc/shorewall/routestopped,
-    Shorewall will allow:<br>
-    <br>
-    &nbsp;&nbsp; a) All traffic originating from the firewall itself; and<br>
-    &nbsp;&nbsp; b) All traffic that is part of or related to an
-    already-existing connection.<br>
-    <br>
-    &nbsp;In particular, with ADMINISABSENTMINDED=Yes, a "shorewall stop"
-    entered through an ssh session will not kill the session.<br>
-    <br>
-    &nbsp;Note though that even with ADMINISABSENTMINDED=Yes, it is still
-    possible for people to shoot themselves in the foot.<br>
-    <br>
-    &nbsp;Example:<br>
-    <br>
-    &nbsp;/etc/shorewall/nat:<br>
-    <br>
-    &nbsp; &nbsp; &nbsp;206.124.146.178&nbsp;&nbsp;&nbsp;
-    eth0:0&nbsp;&nbsp;&nbsp; 192.168.1.5&nbsp;&nbsp;&nbsp;<br>
-    <br>
-    &nbsp;/etc/shorewall/rules:<br>
-    <br>
-    &nbsp;&nbsp; ACCEPT&nbsp;&nbsp;&nbsp; net&nbsp;&nbsp;&nbsp;
-    loc:192.168.1.5&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp; 22<br>
-    &nbsp;&nbsp; ACCEPT&nbsp;&nbsp;&nbsp; loc&nbsp;&nbsp;&nbsp;
-    fw&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp; 22<br>
-    <br>
-    From a remote system, I ssh to 206.124.146.178 which establishes an SSH
-    connection with local system 192.168.1.5. I then create a second SSH
-    connection from that computer to the firewall and confidently type
-    "shorewall stop". As part of its stop processing, Shorewall removes
-    eth0:0 which kills my SSH connection to 192.168.1.5!!!</li>
-  <li>Given the wide range of VPN software, I can never hope to add specific
-    support for all of it. I have therefore decided to add "generic" tunnel
-    support.<br>
-    &nbsp;<br>
-    Generic tunnels work pretty much like any of the other tunnel types. You
-    usually add a zone to represent the systems at the other end of the
-    tunnel and you add the appropriate rules/policies to<br>
-    implement your security policy regarding traffic to/from those
-    systems.<br>
-    &nbsp;<br>
-    In the /etc/shorewall/tunnels file, you can have entries of the form:<br>
-    <br>
-    generic:&lt;protocol&gt;[:&lt;port&gt;]&nbsp; &lt;zone&gt;&nbsp; &lt;ip
-    address&gt;&nbsp;&nbsp;&nbsp; &lt;gateway zones&gt;<br>
-    &nbsp;<br>
-    where:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;protocol&gt; is the protocol
-    used by the tunnel<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;port&gt;&nbsp; if the protocol
-    is 'udp' or 'tcp' then this is the destination port number used by the
-    tunnel.<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;zone&gt;&nbsp; is the zone of
-    the remote tunnel gateway<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;ip address&gt; is the IP address
-    of the remote tunnel gateway.<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;gateway zone&gt;&nbsp;&nbsp;
-    Optional. A comma-separated list of zone names. If specified, the remote
-    gateway is to be considered part of these zones.</li>
-  <li>An 'arp_filter' option has been added to the /etc/shorewall/interfaces
-    file. This option causes
-    /proc/sys/net/ipv4/conf/&lt;interface&gt;/arp_filter to be set with the
-    result that this interface will only answer ARP 'who-has' requests from
-    hosts that are routed out through that interface. Setting this option
-    facilitates testing of your firewall where multiple firewall interfaces
-    are connected to the same HUB/Switch (all interfaces connected to the
-    single HUB/Switch should have this option specified). Note that using
-    such a configuration in a production environment is strongly recommended
-    against.</li>
-  <li>The ADDRESS column in /etc/shorewall/masq may now include a
-    comma-separated list of addresses and/or address ranges. Netfilter will
-    use all listed addresses/ranges in round-robin fashion. \</li>
-  <li>An /etc/shorewall/accounting file has been added to allow for traffic
-    accounting.&nbsp; See the <a href="Accounting.html">accounting
-    documentation</a> for a description of this facility.</li>
-  <li>Bridge interfaces (br[0-9]) may now be used in
-  /etc/shorewall/maclist.</li>
-  <li>ACCEPT, DNAT[-], REDIRECT[-] and LOG rules defined in
-    /etc/shorewall/rules may now be rate-limited. For DNAT and REDIRECT
-    rules, rate limiting occurs in the nat table DNAT rule; the corresponding
-    ACCEPT rule in the filter table is not rate limited. If you want to limit
-    the filter table rule, you will need o create two rules; a DNAT- rule and
-    an ACCEPT rule which can be rate-limited separately.<br>
-    &nbsp;<br>
-    <span style="font-weight: bold;">Warning:</span> When rate limiting is
-    specified on a rule with "all" in the SOURCE or DEST fields, the limit
-    will apply to each pair of zones individually rather than as a single
-    limit for all pairs of covered by the rule.<br>
-    &nbsp;<br>
-    To specify a rate limit,<br>
-    <br>
-    a) Follow ACCEPT, DNAT[-], REDIRECT[-] or LOG with<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;
-    &lt;rate&gt;/&lt;interval&gt;[:&lt;burst&gt;] &gt;<br>
-    &nbsp;<br>
-    &nbsp; where<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;rate&gt; is the sustained rate per
-    &lt;interval&gt;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;interval&gt; is "sec" or "min"<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;burst&gt; is the largest burst
-    accepted within an &lt;interval&gt;. If not given, the default of 5 is
-    assumed.<br>
-    &nbsp;<br>
-    There may be no white space between the ACTION and "&lt;" nor there may
-    be any white space within the burst specification. If you want to specify
-    logging of a rate-limited rule, the ":" and log level comes after the
-    "&gt;" (e.g., ACCEPT&lt;2/sec:4&gt;:info ).<br>
-    <br>
-    b) A new RATE LIMIT column has been added to the /etc/shorewall/rules
-    file. You may specify the rate limit there in the format:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    &lt;rate&gt;/&lt;interval&gt;[:&lt;burst&gt;]<br>
-    &nbsp;<br>
-    Let's take an example:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    ACCEPT&lt;2/sec:4&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    net&nbsp;&nbsp;&nbsp;&nbsp; dmz&nbsp;&nbsp;&nbsp;&nbsp;
-    tcp&nbsp;&nbsp;&nbsp;&nbsp; 80<br>
-    &nbsp;&nbsp;&nbsp;<br>
-    The first time this rule is reached, the packet will be accepted; in
-    fact, since the burst is 4, the first four packets will be accepted.
-    After this, it will be 500ms (1 second divided by the rate<br>
-    of 2) before a packet will be accepted from this rule, regardless of how
-    many packets reach it. Also, every 500ms which passes without matching a
-    packet, one of the bursts will be regained; if no packets hit the rule
-    for 2 second, the burst will be fully recharged; back where we
-    started.<br>
-  </li>
-  <li>Multiple chains may now be displayed in one "shorewall show" command
-    (e.g., shorewall show INPUT FORWARD OUTPUT).</li>
-  <li>Output rules (those with $FW as the SOURCE) may now be limited to a set
-    of local users and/or groups. See <a
-    href="UserSets.html">http://shorewall.net/UserSets.html</a> for
-  details.</li>
-</ol>
-
-<p><b>9/15/2003 - Shorewall 1.4.7 Beta 2</b> <b><br>
-</b></p>
-
-<p><b><a
-href="http://shorewall.net/pub/shorewall/Beta">http://shorewall.net/pub/shorewall/Beta</a><br>
-<a href="ftp://shorewall.net/pub/shorewall/Beta"
-target="_top">ftp://shorewall.net/pub/shorewall/Beta</a><br>
-</b></p>
-<b>Problems Corrected since version 1.4.6 (Those in bold font were corrected
-since 1.4.7 Beta 1).</b><br>
-
-<ol>
-  <li>Corrected problem in 1.4.6 where the MANGLE_ENABLED variable was being
-    tested before it was set.</li>
-  <li>Corrected handling of MAC addresses in the SOURCE column of the tcrules
-    file. Previously, these addresses resulted in an invalid iptables
-  command.</li>
-  <li>The "shorewall stop" command is now disabled when
-    /etc/shorewall/startup_disabled exists. This prevents people from
-    shooting themselves in the foot prior to having configured Shorewall.</li>
-  <li>A change introduced in version 1.4.6 caused error messages during
-    "shorewall [re]start" when ADD_IP_ALIASES=Yes and ip addresses were being
-    added to a PPP interface; the addresses were successfully added in spite
-    of the messages.<br>
-    &nbsp;&nbsp;&nbsp;<br>
-    The firewall script has been modified to eliminate the error messages</li>
-  <li>Interface-specific dynamic blacklisting chains are now displayed by
-    "shorewall monitor" on the "Dynamic Chains" page (previously named
-    "Dynamic Chain").</li>
-  <li>Thanks to Henry Yang, LOGRATE and LOGBURST now work again.</li>
-  <li value="7" style="font-weight: bold;">The 'shorewall reject' and
-    'shorewall drop' commands now delete any existing rules for the subject
-    IP address before adding a new DROP or REJECT rule. Previously, there
-    could be many rules for the same IP address in the dynamic chain so that
-    multiple 'allow' commands were required to re-enable traffic to/from the
-    address.</li>
-  <li style="font-weight: bold;">When ADD_SNAT_ALIASES=Yes in shorewall.conf,
-    the following entry in /etc/shorewall/masq resulted in a startup
-    error:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; eth0 eth1&nbsp;&nbsp;&nbsp;&nbsp;
-    206.124.146.20-206.124.146.24<br>
-    <br>
-  </li>
-  <li style="font-weight: bold;">Shorewall previously choked over IPV6
-    addresses configured on interfaces in contexts where Shorewall needed to
-    detect something about the interface (such as when "detect" appears in
-    the BROADCAST column of the /etc/shorewall/interfaces file).</li>
-  <li><span style="font-weight: bold;">Shorewall will now load module files
-    that are formed from the module name by appending ".o.gz".</span><br>
-  </li>
-</ol>
-<b>Migration Issues:</b><br>
-
-<ol>
-  <li>Shorewall IP Traffic Accounting has changed since snapshot 20030813 --
-    see the <a href="Accounting.html">Accounting Page</a> for details.</li>
-  <li>The Uset Set capability introduced in SnapShot 20030821 has changed --
-    see the <a href="UserSets.html">User Set page</a> for details.</li>
-  <li>The per-interface Dynamic Blacklisting facility introduced in the first
-    post-1.4.6 Snapshot has been removed. The facility had too many
-    idiosyncrasies for dial-up users to be a viable part of Shorewall.<br>
-  </li>
-</ol>
-<b>New Features:</b><br>
-
-<ol>
-  <li>Thanks to Steve Herber, the 'help' command can now give
-    command-specific help (e.g., shorewall help &lt;command&gt;).</li>
-  <li>A new option "ADMINISABSENTMINDED" has been added to
-    /etc/shorewall/shorewall.conf. This option has a default value of "No"
-    for existing users which causes Shorewall's 'stopped' state &nbsp;to
-    continue as it has been; namely, in the stopped state only traffic
-    to/from hosts listed in /etc/shorewall/routestopped is accepted.<br>
-    <br>
-    With ADMINISABSENTMINDED=Yes (the default for new installs), in addition
-    to traffic to/from the hosts listed in /etc/shorewall/routestopped,
-    Shorewall will allow:<br>
-    <br>
-    &nbsp;&nbsp; a) All traffic originating from the firewall itself; and<br>
-    &nbsp;&nbsp; b) All traffic that is part of or related to an
-    already-existing connection.<br>
-    <br>
-    &nbsp;In particular, with ADMINISABSENTMINDED=Yes, a "shorewall stop"
-    entered through an ssh session will not kill the session.<br>
-    <br>
-    &nbsp;Note though that even with ADMINISABSENTMINDED=Yes, it is still
-    possible for people to shoot themselves in the foot.<br>
-    <br>
-    &nbsp;Example:<br>
-    <br>
-    &nbsp;/etc/shorewall/nat:<br>
-    <br>
-    &nbsp; &nbsp; &nbsp;206.124.146.178&nbsp;&nbsp;&nbsp;
-    eth0:0&nbsp;&nbsp;&nbsp; 192.168.1.5&nbsp;&nbsp;&nbsp;<br>
-    <br>
-    &nbsp;/etc/shorewall/rules:<br>
-    <br>
-    &nbsp;&nbsp; ACCEPT&nbsp;&nbsp;&nbsp; net&nbsp;&nbsp;&nbsp;
-    loc:192.168.1.5&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp; 22<br>
-    &nbsp;&nbsp; ACCEPT&nbsp;&nbsp;&nbsp; loc&nbsp;&nbsp;&nbsp;
-    fw&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp; 22<br>
-    <br>
-    From a remote system, I ssh to 206.124.146.178 which establishes an SSH
-    connection with local system 192.168.1.5. I then create a second SSH
-    connection from that computer to the firewall and confidently type
-    "shorewall stop". As part of its stop processing, Shorewall removes
-    eth0:0 which kills my SSH connection to 192.168.1.5!!!</li>
-  <li>Given the wide range of VPN software, I can never hope to add specific
-    support for all of it. I have therefore decided to add "generic" tunnel
-    support.<br>
-    &nbsp;<br>
-    Generic tunnels work pretty much like any of the other tunnel types. You
-    usually add a zone to represent the systems at the other end of the
-    tunnel and you add the appropriate rules/policies to<br>
-    implement your security policy regarding traffic to/from those
-    systems.<br>
-    &nbsp;<br>
-    In the /etc/shorewall/tunnels file, you can have entries of the form:<br>
-    <br>
-    generic:&lt;protocol&gt;[:&lt;port&gt;]&nbsp; &lt;zone&gt;&nbsp; &lt;ip
-    address&gt;&nbsp;&nbsp;&nbsp; &lt;gateway zones&gt;<br>
-    &nbsp;<br>
-    where:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;protocol&gt; is the protocol
-    used by the tunnel<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;port&gt;&nbsp; if the protocol
-    is 'udp' or 'tcp' then this is the destination port number used by the
-    tunnel.<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;zone&gt;&nbsp; is the zone of
-    the remote tunnel gateway<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;ip address&gt; is the IP address
-    of the remote tunnel gateway.<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;gateway zone&gt;&nbsp;&nbsp;
-    Optional. A comma-separated list of zone names. If specified, the remote
-    gateway is to be considered part of these zones.</li>
-  <li>An 'arp_filter' option has been added to the /etc/shorewall/interfaces
-    file. This option causes
-    /proc/sys/net/ipv4/conf/&lt;interface&gt;/arp_filter to be set with the
-    result that this interface will only answer ARP 'who-has' requests from
-    hosts that are routed out through that interface. Setting this option
-    facilitates testing of your firewall where multiple firewall interfaces
-    are connected to the same HUB/Switch (all interfaces connected to the
-    single HUB/Switch should have this option specified). Note that using
-    such a configuration in a production environment is strongly recommended
-    against.</li>
-  <li>The ADDRESS column in /etc/shorewall/masq may now include a
-    comma-separated list of addresses and/or address ranges. Netfilter will
-    use all listed addresses/ranges in round-robin fashion. \</li>
-  <li>An /etc/shorewall/accounting file has been added to allow for traffic
-    accounting.&nbsp; See the <a href="Accounting.html">accounting
-    documentation</a> for a description of this facility.</li>
-  <li>Bridge interfaces (br[0-9]) may now be used in
-  /etc/shorewall/maclist.</li>
-  <li>ACCEPT, DNAT[-], REDIRECT[-] and LOG rules defined in
-    /etc/shorewall/rules may now be rate-limited. For DNAT and REDIRECT
-    rules, rate limiting occurs in the nat table DNAT rule; the corresponding
-    ACCEPT rule in the filter table is not rate limited. If you want to limit
-    the filter table rule, you will need o create two rules; a DNAT- rule and
-    an ACCEPT rule which can be rate-limited separately.<br>
-    &nbsp;<br>
-    <span style="font-weight: bold;">Warning:</span> When rate limiting is
-    specified on a rule with "all" in the SOURCE or DEST fields, the limit
-    will apply to each pair of zones individually rather than as a single
-    limit for all pairs of covered by the rule.<br>
-    &nbsp;<br>
-    To specify a rate limit,<br>
-    <br>
-    a) Follow ACCEPT, DNAT[-], REDIRECT[-] or LOG with<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;
-    &lt;rate&gt;/&lt;interval&gt;[:&lt;burst&gt;] &gt;<br>
-    &nbsp;<br>
-    &nbsp; where<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;rate&gt; is the sustained rate per
-    &lt;interval&gt;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;interval&gt; is "sec" or "min"<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;burst&gt; is the largest burst
-    accepted within an &lt;interval&gt;. If not given, the default of 5 is
-    assumed.<br>
-    &nbsp;<br>
-    There may be no white space between the ACTION and "&lt;" nor there may
-    be any white space within the burst specification. If you want to specify
-    logging of a rate-limited rule, the ":" and log level comes after the
-    "&gt;" (e.g., ACCEPT&lt;2/sec:4&gt;:info ).<br>
-    <br>
-    b) A new RATE LIMIT column has been added to the /etc/shorewall/rules
-    file. You may specify the rate limit there in the format:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    &lt;rate&gt;/&lt;interval&gt;[:&lt;burst&gt;]<br>
-    &nbsp;<br>
-    Let's take an example:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    ACCEPT&lt;2/sec:4&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    net&nbsp;&nbsp;&nbsp;&nbsp; dmz&nbsp;&nbsp;&nbsp;&nbsp;
-    tcp&nbsp;&nbsp;&nbsp;&nbsp; 80<br>
-    &nbsp;&nbsp;&nbsp;<br>
-    The first time this rule is reached, the packet will be accepted; in
-    fact, since the burst is 4, the first four packets will be accepted.
-    After this, it will be 500ms (1 second divided by the rate<br>
-    of 2) before a packet will be accepted from this rule, regardless of how
-    many packets reach it. Also, every 500ms which passes without matching a
-    packet, one of the bursts will be regained; if no packets hit the rule
-    for 2 second, the burst will be fully recharged; back where we
-    started.<br>
-  </li>
-  <li>Multiple chains may now be displayed in one "shorewall show" command
-    (e.g., shorewall show INPUT FORWARD OUTPUT).</li>
-  <li>Output rules (those with $FW as the SOURCE) may now be limited to a set
-    of local users and/or groups. See <a
-    href="UserSets.html">http://shorewall.net/UserSets.html</a> for
-  details.</li>
-</ol>
-
-<p><b>8/27/2003 - Shorewall Mirror in Australia</b></p>
-
-<p>Thanks to Dave Kempe and Solutions First (<a
-href="http://www.solutionsfirst.com.au"><font
-size="3">http://www.solutionsfirst.com.au</font></a>), there is now a
-Shorewall Mirror in Australia:</p>
-
-<div style="margin-left: 40px;">
-<a href="http://www.shorewall.com.au" target="_top"><font
-size="3">http://www.shorewall.com.au</font></a><br>
-<a href="ftp://ftp.shorewall.com.au"><font
-size="3">ftp://ftp.shorewall.com.au</font></a> </div>
-
-<p><b>8/26/2003 - French Version of the Shorewall Setup Guide&nbsp;</b></p>
-Thanks to Fabien <font size="3">Demassieux, there is now a <a
-href="shorewall_setup_guide_fr.htm">French translation of the Shorewall Setup
-Guide</a>. Merci Beacoup, Fabien!</font> 
-
-<p><b>8/25/2003 - Shorewall 1.4.7 Beta 1</b> <b><br>
-</b></p>
-
-<p><b><a
-href="http://shorewall.net/pub/shorewall/Beta">http://shorewall.net/pub/shorewall/Beta</a><br>
-<a href="ftp://shorewall.net/pub/shorewall/Beta"
-target="_top">ftp://shorewall.net/pub/shorewall/Beta</a><br>
-</b></p>
-<b>Problems Corrected since version 1.4.6</b><br>
-
-<ol>
-  <li>Corrected problem in 1.4.6 where the MANGLE_ENABLED variable was being
-    tested before it was set.</li>
-  <li>Corrected handling of MAC addresses in the SOURCE column of the tcrules
-    file. Previously, these addresses resulted in an invalid iptables
-  command.</li>
-  <li>The "shorewall stop" command is now disabled when
-    /etc/shorewall/startup_disabled exists. This prevents people from
-    shooting themselves in the foot prior to having configured Shorewall.</li>
-  <li>A change introduced in version 1.4.6 caused error messages during
-    "shorewall [re]start" when ADD_IP_ALIASES=Yes and ip addresses were being
-    added to a PPP interface; the addresses were successfully added in spite
-    of the messages.<br>
-    &nbsp;&nbsp;&nbsp;<br>
-    The firewall script has been modified to eliminate the error messages</li>
-  <li>Interface-specific dynamic blacklisting chains are now displayed by
-    "shorewall monitor" on the "Dynamic Chains" page (previously named
-    "Dynamic Chain").</li>
-  <li>Thanks to Henry Yang, LOGRATE and LOGBURST now work again.<br>
-    <br>
-  </li>
-</ol>
-<b>Migration Issues:</b><br>
-
-<ol>
-  <li>Shorewall IP Traffic Accounting has changed since snapshot 20030813 --
-    see the <a href="Accounting.html">Accounting Page</a> for details.</li>
-  <li>The Uset Set capability introduced in SnapShot 20030821 has changed --
-    see the <a href="UserSets.html">User Set page</a> for details.</li>
-  <li>The per-interface Dynamic Blacklisting facility introduced in the first
-    post-1.4.6 Snapshot has been removed. The facility had too many
-    idiosyncrasies for dial-up users to be a viable part of Shorewall.<br>
-  </li>
-</ol>
-<b>New Features:</b><br>
-
-<ol>
-  <li>Thanks to Steve Herber, the 'help' command can now give
-    command-specific help (e.g., shorewall help &lt;command&gt;).</li>
-  <li>A new option "ADMINISABSENTMINDED" has been added to
-    /etc/shorewall/shorewall.conf. This option has a default value of "No"
-    for existing users which causes Shorewall's 'stopped' state &nbsp;to
-    continue as it has been; namely, in the stopped state only traffic
-    to/from hosts listed in /etc/shorewall/routestopped is accepted.<br>
-    <br>
-    With ADMINISABSENTMINDED=Yes (the default for new installs), in addition
-    to traffic to/from the hosts listed in /etc/shorewall/routestopped,
-    Shorewall will allow:<br>
-    <br>
-    &nbsp;&nbsp; a) All traffic originating from the firewall itself; and<br>
-    &nbsp;&nbsp; b) All traffic that is part of or related to an
-    already-existing connection.<br>
-    <br>
-    &nbsp;In particular, with ADMINISABSENTMINDED=Yes, a "shorewall stop"
-    entered through an ssh session will not kill the session.<br>
-    <br>
-    &nbsp;Note though that even with ADMINISABSENTMINDED=Yes, it is still
-    possible for people to shoot themselves in the foot.<br>
-    <br>
-    &nbsp;Example:<br>
-    <br>
-    &nbsp;/etc/shorewall/nat:<br>
-    <br>
-    &nbsp; &nbsp; &nbsp;206.124.146.178&nbsp;&nbsp;&nbsp;
-    eth0:0&nbsp;&nbsp;&nbsp; 192.168.1.5&nbsp;&nbsp;&nbsp;<br>
-    <br>
-    &nbsp;/etc/shorewall/rules:<br>
-    <br>
-    &nbsp;&nbsp; ACCEPT&nbsp;&nbsp;&nbsp; net&nbsp;&nbsp;&nbsp;
-    loc:192.168.1.5&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp; 22<br>
-    &nbsp;&nbsp; ACCEPT&nbsp;&nbsp;&nbsp; loc&nbsp;&nbsp;&nbsp;
-    fw&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp; 22<br>
-    <br>
-    From a remote system, I ssh to 206.124.146.178 which establishes an SSH
-    connection with local system 192.168.1.5. I then create a second SSH
-    connection from that computer to the firewall and confidently type
-    "shorewall stop". As part of its stop processing, Shorewall removes
-    eth0:0 which kills my SSH connection to 192.168.1.5!!!</li>
-  <li>Given the wide range of VPN software, I can never hope to add specific
-    support for all of it. I have therefore decided to add "generic" tunnel
-    support.<br>
-    &nbsp;<br>
-    Generic tunnels work pretty much like any of the other tunnel types. You
-    usually add a zone to represent the systems at the other end of the
-    tunnel and you add the appropriate rules/policies to<br>
-    implement your security policy regarding traffic to/from those
-    systems.<br>
-    &nbsp;<br>
-    In the /etc/shorewall/tunnels file, you can have entries of the form:<br>
-    <br>
-    generic:&lt;protocol&gt;[:&lt;port&gt;]&nbsp; &lt;zone&gt;&nbsp; &lt;ip
-    address&gt;&nbsp;&nbsp;&nbsp; &lt;gateway zones&gt;<br>
-    &nbsp;<br>
-    where:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;protocol&gt; is the protocol
-    used by the tunnel<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;port&gt;&nbsp; if the protocol
-    is 'udp' or 'tcp' then this is the destination port number used by the
-    tunnel.<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;zone&gt;&nbsp; is the zone of
-    the remote tunnel gateway<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;ip address&gt; is the IP address
-    of the remote tunnel gateway.<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;gateway zone&gt;&nbsp;&nbsp;
-    Optional. A comma-separated list of zone names. If specified, the remote
-    gateway is to be considered part of these zones.</li>
-  <li>An 'arp_filter' option has been added to the /etc/shorewall/interfaces
-    file. This option causes
-    /proc/sys/net/ipv4/conf/&lt;interface&gt;/arp_filter to be set with the
-    result that this interface will only answer ARP 'who-has' requests from
-    hosts that are routed out through that interface. Setting this option
-    facilitates testing of your firewall where multiple firewall interfaces
-    are connected to the same HUB/Switch (all interfaces connected to the
-    single HUB/Switch should have this option specified). Note that using
-    such a configuration in a production environment is strongly recommended
-    against.</li>
-  <li>The ADDRESS column in /etc/shorewall/masq may now include a
-    comma-separated list of addresses and/or address ranges. Netfilter will
-    use all listed addresses/ranges in round-robin fashion. \</li>
-  <li>An /etc/shorewall/accounting file has been added to allow for traffic
-    accounting.&nbsp; See the <a href="Accounting.html">accounting
-    documentation</a> for a description of this facility.</li>
-  <li>Bridge interfaces (br[0-9]) may now be used in
-  /etc/shorewall/maclist.</li>
-  <li>ACCEPT, DNAT[-], REDIRECT[-] and LOG rules defined in
-    /etc/shorewall/rules may now be rate-limited. For DNAT and REDIRECT
-    rules, rate limiting occurs in the nat table DNAT rule; the corresponding
-    ACCEPT rule in the filter table is not rate limited. If you want to limit
-    the filter table rule, you will need o create two rules; a DNAT- rule and
-    an ACCEPT rule which can be rate-limited separately.<br>
-    &nbsp;<br>
-    <span style="font-weight: bold;">Warning:</span> When rate limiting is
-    specified on a rule with "all" in the SOURCE or DEST fields, the limit
-    will apply to each pair of zones individually rather than as a single
-    limit for all pairs of covered by the rule.<br>
-    &nbsp;<br>
-    To specify a rate limit,<br>
-    <br>
-    a) Follow ACCEPT, DNAT[-], REDIRECT[-] or LOG with<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;
-    &lt;rate&gt;/&lt;interval&gt;[:&lt;burst&gt;] &gt;<br>
-    &nbsp;<br>
-    &nbsp; where<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;rate&gt; is the sustained rate per
-    &lt;interval&gt;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;interval&gt; is "sec" or "min"<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;burst&gt; is the largest burst
-    accepted within an &lt;interval&gt;. If not given, the default of 5 is
-    assumed.<br>
-    &nbsp;<br>
-    There may be no white space between the ACTION and "&lt;" nor there may
-    be any white space within the burst specification. If you want to specify
-    logging of a rate-limited rule, the ":" and log level comes after the
-    "&gt;" (e.g., ACCEPT&lt;2/sec:4&gt;:info ).<br>
-    <br>
-    b) A new RATE LIMIT column has been added to the /etc/shorewall/rules
-    file. You may specify the rate limit there in the format:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    &lt;rate&gt;/&lt;interval&gt;[:&lt;burst&gt;]<br>
-    &nbsp;<br>
-    Let's take an example:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    ACCEPT&lt;2/sec:4&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    net&nbsp;&nbsp;&nbsp;&nbsp; dmz&nbsp;&nbsp;&nbsp;&nbsp;
-    tcp&nbsp;&nbsp;&nbsp;&nbsp; 80<br>
-    &nbsp;&nbsp;&nbsp;<br>
-    The first time this rule is reached, the packet will be accepted; in
-    fact, since the burst is 4, the first four packets will be accepted.
-    After this, it will be 500ms (1 second divided by the rate<br>
-    of 2) before a packet will be accepted from this rule, regardless of how
-    many packets reach it. Also, every 500ms which passes without matching a
-    packet, one of the bursts will be regained; if no packets hit the rule
-    for 2 second, the burst will be fully recharged; back where we
-    started.<br>
-  </li>
-  <li>Multiple chains may now be displayed in one "shorewall show" command
-    (e.g., shorewall show INPUT FORWARD OUTPUT).</li>
-  <li>Output rules (those with $FW as the SOURCE) may now be limited to a set
-    of local users and/or groups. See <a
-    href="UserSets.html">http://shorewall.net/UserSets.html</a> for
-    details.<br>
-  </li>
-</ol>
-
-<p><b>8/23/2003 - Snapshot 1.4.6_2003082</b><span
-style="font-weight: bold;">3</span></p>
-
-<blockquote>
-  <p><a
-  href="http://shorewall.net/pub/shorewall/Snapshots/">http://shorewall.net/pub/shorewall/Snapshots/</a><br>
-  <a href="ftp://shorewall.net/pub/shorewall/Snapshots/"
-  target="_top">ftp://shorewall.net/pub/shorewall/Snapshots/</a></p>
-</blockquote>
-<b>Problems Corrected since version 1.4.6</b><br>
-
-<ol>
-  <li>Corrected problem in 1.4.6 where the MANGLE_ENABLED variable was being
-    tested before it was set.</li>
-  <li>Corrected handling of MAC addresses in the SOURCE column of the tcrules
-    file. Previously, these addresses resulted in an invalid iptables
-  command.</li>
-  <li>The "shorewall stop" command is now disabled when
-    /etc/shorewall/startup_disabled exists. This prevents people from
-    shooting themselves in the foot prior to having configured Shorewall.</li>
-  <li>A change introduced in version 1.4.6 caused error messages during
-    "shorewall [re]start" when ADD_IP_ALIASES=Yes and ip addresses were being
-    added to a PPP interface; the addresses were successfully added in spite
-    of the messages.<br>
-    &nbsp;&nbsp;&nbsp;<br>
-    The firewall script has been modified to eliminate the error messages</li>
-  <li>Interface-specific dynamic blacklisting chains are now displayed by
-    "shorewall monitor" on the "Dynamic Chains" page (previously named
-    "Dynamic Chain").</li>
-  <li>Thanks to Henry Yang, LOGRATE and LOGBURST now work again.<br>
-    <br>
-  </li>
-</ol>
-<b>Migration Issues:</b><br>
-
-<ol>
-  <li>Once you have installed this version of Shorewall, you must restart
-    Shorewall before you may use the 'drop', 'reject', 'allow' or 'save'
-    commands.</li>
-  <li>To maintain strict compatibility with previous versions, current uses
-    of "shorewall drop" and "shorewall reject" should be replaced with
-    "shorewall dropall" and "shorewall rejectall"</li>
-  <li>Shorewall IP Traffic Accounting has changed since snapshot 20030813 --
-    see the <a href="Accounting.html">Accounting Page</a> for details.</li>
-  <li>The Uset Set capability introduced in SnapShot 20030821 has changed --
-    see the <a href="UserSets.html">User Set page</a> for details.</li>
-</ol>
-<b>New Features:</b><br>
-
-<ol>
-  <li>Shorewall now creates a dynamic blacklisting chain for each interface
-    defined in /etc/shorewall/interfaces. The 'drop' and 'reject' commands
-    use the routing table to determine which of these chains is to be used
-    for blacklisting the specified IP address(es).<br>
-    <br>
-    Two new commands ('dropall' and 'rejectall') have been introduced that do
-    what 'drop' and 'reject' used to do; namely, when an address is
-    blacklisted using these new commands, it will be blacklisted on all of
-    your firewall's interfaces.</li>
-  <li>Thanks to Steve Herber, the 'help' command can now give
-    command-specific help (e.g., shorewall help &lt;command&gt;).</li>
-  <li>A new option "ADMINISABSENTMINDED" has been added to
-    /etc/shorewall/shorewall.conf. This option has a default value of "No"
-    for existing users which causes Shorewall's 'stopped' state &nbsp;to
-    continue as it has been; namely, in the stopped state only traffic
-    to/from hosts listed in /etc/shorewall/routestopped is accepted.<br>
-    <br>
-    With ADMINISABSENTMINDED=Yes (the default for new installs), in addition
-    to traffic to/from the hosts listed in /etc/shorewall/routestopped,
-    Shorewall will allow:<br>
-    <br>
-    &nbsp;&nbsp; a) All traffic originating from the firewall itself; and<br>
-    &nbsp;&nbsp; b) All traffic that is part of or related to an
-    already-existing connection.<br>
-    <br>
-    &nbsp;In particular, with ADMINISABSENTMINDED=Yes, a "shorewall stop"
-    entered through an ssh session will not kill the session.<br>
-    <br>
-    &nbsp;Note though that even with ADMINISABSENTMINDED=Yes, it is still
-    possible for people to shoot themselves in the foot.<br>
-    <br>
-    &nbsp;Example:<br>
-    <br>
-    &nbsp;/etc/shorewall/nat:<br>
-    <br>
-    &nbsp; &nbsp; &nbsp;206.124.146.178&nbsp;&nbsp;&nbsp;
-    eth0:0&nbsp;&nbsp;&nbsp; 192.168.1.5&nbsp;&nbsp;&nbsp;<br>
-    <br>
-    &nbsp;/etc/shorewall/rules:<br>
-    <br>
-    &nbsp;&nbsp; ACCEPT&nbsp;&nbsp;&nbsp; net&nbsp;&nbsp;&nbsp;
-    loc:192.168.1.5&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp; 22<br>
-    &nbsp;&nbsp; ACCEPT&nbsp;&nbsp;&nbsp; loc&nbsp;&nbsp;&nbsp;
-    fw&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp; 22<br>
-    <br>
-    From a remote system, I ssh to 206.124.146.178 which establishes an SSH
-    connection with local system 192.168.1.5. I then create a second SSH
-    connection from that computer to the firewall and confidently type
-    "shorewall stop". As part of its stop processing, Shorewall removes
-    eth0:0 which kills my SSH connection to 192.168.1.5!!!</li>
-  <li>Given the wide range of VPN software, I can never hope to add specific
-    support for all of it. I have therefore decided to add "generic" tunnel
-    support.<br>
-    &nbsp;<br>
-    Generic tunnels work pretty much like any of the other tunnel types. You
-    usually add a zone to represent the systems at the other end of the
-    tunnel and you add the appropriate rules/policies to<br>
-    implement your security policy regarding traffic to/from those
-    systems.<br>
-    &nbsp;<br>
-    In the /etc/shorewall/tunnels file, you can have entries of the form:<br>
-    <br>
-    generic:&lt;protocol&gt;[:&lt;port&gt;]&nbsp; &lt;zone&gt;&nbsp; &lt;ip
-    address&gt;&nbsp;&nbsp;&nbsp; &lt;gateway zones&gt;<br>
-    &nbsp;<br>
-    where:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;protocol&gt; is the protocol
-    used by the tunnel<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;port&gt;&nbsp; if the protocol
-    is 'udp' or 'tcp' then this is the destination port number used by the
-    tunnel.<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;zone&gt;&nbsp; is the zone of
-    the remote tunnel gateway<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;ip address&gt; is the IP address
-    of the remote tunnel gateway.<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;gateway zone&gt;&nbsp;&nbsp;
-    Optional. A comma-separated list of zone names. If specified, the remote
-    gateway is to be considered part of these zones.</li>
-  <li>An 'arp_filter' option has been added to the /etc/shorewall/interfaces
-    file. This option causes
-    /proc/sys/net/ipv4/conf/&lt;interface&gt;/arp_filter to be set with the
-    result that this interface will only answer ARP 'who-has' requests from
-    hosts that are routed out through that interface. Setting this option
-    facilitates testing of your firewall where multiple firewall interfaces
-    are connected to the same HUB/Switch (all interfaces connected to the
-    single HUB/Switch should have this option specified). Note that using
-    such a configuration in a production environment is strongly recommended
-    against.</li>
-  <li>The ADDRESS column in /etc/shorewall/masq may now include a
-    comma-separated list of addresses and/or address ranges. Netfilter will
-    use all listed addresses/ranges in round-robin fashion. \</li>
-  <li>An /etc/shorewall/accounting file has been added to allow for traffic
-    accounting.&nbsp; See the <a href="Accounting.html">accounting
-    documentation</a> for a description of this facility.</li>
-  <li>Bridge interfaces (br[0-9]) may now be used in
-  /etc/shorewall/maclist.</li>
-  <li>ACCEPT, DNAT[-], REDIRECT[-] and LOG rules defined in
-    /etc/shorewall/rules may now be rate-limited. For DNAT and REDIRECT
-    rules, rate limiting occurs in the nat table DNAT rule; the corresponding
-    ACCEPT rule in the filter table is not rate limited. If you want to limit
-    the filter table rule, you will need o create two rules; a DNAT- rule and
-    an ACCEPT rule which can be rate-limited separately.<br>
-    &nbsp;<br>
-    <span style="font-weight: bold;">Warning:</span> When rate limiting is
-    specified on a rule with "all" in the SOURCE or DEST fields, the limit
-    will apply to each pair of zones individually rather than as a single
-    limit for all pairs of covered by the rule.<br>
-    &nbsp;<br>
-    To specify a rate limit,<br>
-    <br>
-    a) Follow ACCEPT, DNAT[-], REDIRECT[-] or LOG with<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;
-    &lt;rate&gt;/&lt;interval&gt;[:&lt;burst&gt;] &gt;<br>
-    &nbsp;<br>
-    &nbsp; where<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;rate&gt; is the sustained rate per
-    &lt;interval&gt;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;interval&gt; is "sec" or "min"<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;burst&gt; is the largest burst
-    accepted within an &lt;interval&gt;. If not given, the default of 5 is
-    assumed.<br>
-    &nbsp;<br>
-    There may be no white space between the ACTION and "&lt;" nor there may
-    be any white space within the burst specification. If you want to specify
-    logging of a rate-limited rule, the ":" and log level comes after the
-    "&gt;" (e.g., ACCEPT&lt;2/sec:4&gt;:info ).<br>
-    <br>
-    b) A new RATE LIMIT column has been added to the /etc/shorewall/rules
-    file. You may specify the rate limit there in the format:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    &lt;rate&gt;/&lt;interval&gt;[:&lt;burst&gt;]<br>
-    &nbsp;<br>
-    Let's take an example:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    ACCEPT&lt;2/sec:4&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    net&nbsp;&nbsp;&nbsp;&nbsp; dmz&nbsp;&nbsp;&nbsp;&nbsp;
-    tcp&nbsp;&nbsp;&nbsp;&nbsp; 80<br>
-    &nbsp;&nbsp;&nbsp;<br>
-    The first time this rule is reached, the packet will be accepted; in
-    fact, since the burst is 4, the first four packets will be accepted.
-    After this, it will be 500ms (1 second divided by the rate<br>
-    of 2) before a packet will be accepted from this rule, regardless of how
-    many packets reach it. Also, every 500ms which passes without matching a
-    packet, one of the bursts will be regained; if no packets hit the rule
-    for 2 second, the burst will be fully recharged; back where we
-    started.<br>
-  </li>
-  <li>Multiple chains may now be displayed in one "shorewall show" command
-    (e.g., shorewall show INPUT FORWARD OUTPUT).</li>
-  <li>Output rules (those with $FW as the SOURCE) may now be limited to a set
-    of local users and/or groups. See <a
-    href="UserSets.html">http://shorewall.net/UserSets.html</a> for
-    details.<br>
-  </li>
-</ol>
-
-<p><b>8/13/2003 - Snapshot 1.4.6_20030813</b><b>&nbsp;</b></p>
-
-<blockquote>
-  <p><a
-  href="http://shorewall.net/pub/shorewall/Snapshots/">http://shorewall.net/pub/shorewall/Snapshots/</a><br>
-  <a href="ftp://shorewall.net/pub/shorewall/Snapshots/"
-  target="_top">ftp://shorewall.net/pub/shorewall/Snapshots/</a></p>
-</blockquote>
-<b>Problems Corrected since version 1.4.6</b><br>
-
-<ol>
-  <li>Corrected problem in 1.4.6 where the MANGLE_ENABLED variable was being
-    tested before it was set.</li>
-  <li>Corrected handling of MAC addresses in the SOURCE column of the tcrules
-    file. Previously, these addresses resulted in an invalid iptables
-  command.</li>
-  <li>The "shorewall stop" command is now disabled when
-    /etc/shorewall/startup_disabled exists. This prevents people from
-    shooting themselves in the foot prior to having configured Shorewall.</li>
-  <li>A change introduced in version 1.4.6 caused error messages during
-    "shorewall [re]start" when ADD_IP_ALIASES=Yes and ip addresses were being
-    added to a PPP interface; the addresses were successfully added in spite
-    of the messages.<br>
-    &nbsp;&nbsp;&nbsp;<br>
-    The firewall script has been modified to eliminate the error messages</li>
-  <li>&nbsp;Interface-specific dynamic blacklisting chains are now displayed
-    by "shorewall monitor" on the "Dynamic Chains" page (previously named
-    "Dynamic Chain").<br>
-    <br>
-  </li>
-</ol>
-<b>Migration Issues:</b><br>
-
-<ol>
-  <li>Once you have installed this version of Shorewall, you must restart
-    Shorewall before you may use the 'drop', 'reject', 'allow' or 'save'
-    commands.</li>
-  <li>To maintain strict compatibility with previous versions, current uses
-    of "shorewall drop" and "shorewall reject" should be replaced with
-    "shorewall dropall" and "shorewall rejectall"</li>
-</ol>
-<b>New Features:</b><br>
-
-<ol>
-  <li>Shorewall now creates a dynamic blacklisting chain for each interface
-    defined in /etc/shorewall/interfaces. The 'drop' and 'reject' commands
-    use the routing table to determine which of these chains is to be used
-    for blacklisting the specified IP address(es).<br>
-    <br>
-    Two new commands ('dropall' and 'rejectall') have been introduced that do
-    what 'drop' and 'reject' used to do; namely, when an address is
-    blacklisted using these new commands, it will be blacklisted on all of
-    your firewall's interfaces.</li>
-  <li>Thanks to Steve Herber, the 'help' command can now give
-    command-specific help (e.g., shorewall help &lt;command&gt;).</li>
-  <li>A new option "ADMINISABSENTMINDED" has been added to
-    /etc/shorewall/shorewall.conf. This option has a default value of "No"
-    for existing users which causes Shorewall's 'stopped' state &nbsp;to
-    continue as it has been; namely, in the stopped state only traffic
-    to/from hosts listed in /etc/shorewall/routestopped is accepted.<br>
-    <br>
-    With ADMINISABSENTMINDED=Yes (the default for new installs), in addition
-    to traffic to/from the hosts listed in /etc/shorewall/routestopped,
-    Shorewall will allow:<br>
-    <br>
-    &nbsp;&nbsp; a) All traffic originating from the firewall itself; and<br>
-    &nbsp;&nbsp; b) All traffic that is part of or related to an
-    already-existing connection.<br>
-    <br>
-    &nbsp;In particular, with ADMINISABSENTMINDED=Yes, a "shorewall stop"
-    entered through an ssh session will not kill the session.<br>
-    <br>
-    &nbsp;Note though that even with ADMINISABSENTMINDED=Yes, it is still
-    possible for people to shoot themselves in the foot.<br>
-    <br>
-    &nbsp;Example:<br>
-    <br>
-    &nbsp;/etc/shorewall/nat:<br>
-    <br>
-    &nbsp; &nbsp; &nbsp;206.124.146.178&nbsp;&nbsp;&nbsp;
-    eth0:0&nbsp;&nbsp;&nbsp; 192.168.1.5&nbsp;&nbsp;&nbsp;<br>
-    <br>
-    &nbsp;/etc/shorewall/rules:<br>
-    <br>
-    &nbsp;&nbsp; ACCEPT&nbsp;&nbsp;&nbsp; net&nbsp;&nbsp;&nbsp;
-    loc:192.168.1.5&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp; 22<br>
-    &nbsp;&nbsp; ACCEPT&nbsp;&nbsp;&nbsp; loc&nbsp;&nbsp;&nbsp;
-    fw&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp; 22<br>
-    <br>
-    From a remote system, I ssh to 206.124.146.178 which establishes an SSH
-    connection with local system 192.168.1.5. I then create a second SSH
-    connection from that computer to the firewall and confidently type
-    "shorewall stop". As part of its stop processing, Shorewall removes
-    eth0:0 which kills my SSH connection to 192.168.1.5!!!</li>
-  <li>Given the wide range of VPN software, I can never hope to add specific
-    support for all of it. I have therefore decided to add "generic" tunnel
-    support.<br>
-    &nbsp;<br>
-    Generic tunnels work pretty much like any of the other tunnel types. You
-    usually add a zone to represent the systems at the other end of the
-    tunnel and you add the appropriate rules/policies to<br>
-    implement your security policy regarding traffic to/from those
-    systems.<br>
-    &nbsp;<br>
-    In the /etc/shorewall/tunnels file, you can have entries of the form:<br>
-    <br>
-    generic:&lt;protocol&gt;[:&lt;port&gt;]&nbsp; &lt;zone&gt;&nbsp; &lt;ip
-    address&gt;&nbsp;&nbsp;&nbsp; &lt;gateway zones&gt;<br>
-    &nbsp;<br>
-    where:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;protocol&gt; is the protocol
-    used by the tunnel<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;port&gt;&nbsp; if the protocol
-    is 'udp' or 'tcp' then this is the destination port number used by the
-    tunnel.<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;zone&gt;&nbsp; is the zone of
-    the remote tunnel gateway<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;ip address&gt; is the IP address
-    of the remote tunnel gateway.<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;gateway zone&gt;&nbsp;&nbsp;
-    Optional. A comma-separated list of zone names. If specified, the remote
-    gateway is to be considered part of these zones.</li>
-  <li>An 'arp_filter' option has been added to the /etc/shorewall/interfaces
-    file. This option causes
-    /proc/sys/net/ipv4/conf/&lt;interface&gt;/arp_filter to be set with the
-    result that this interface will only answer ARP 'who-has' requests from
-    hosts that are routed out through that interface. Setting this option
-    facilitates testing of your firewall where multiple firewall interfaces
-    are connected to the same HUB/Switch (all interfaces connected to the
-    single HUB/Switch should have this option specified). Note that using
-    such a configuration in a production environment is strongly recommended
-    against.</li>
-  <li>The ADDRESS column in /etc/shorewall/masq may now include a
-    comma-separated list of addresses and/or address ranges. Netfilter will
-    use all listed addresses/ranges in round-robin fashion. \</li>
-  <li>An /etc/shorewall/accounting file has been added to allow for traffic
-    accounting.&nbsp; See the <a href="Accounting.html">accounting
-    documentation</a> for a description of this facility.</li>
-  <li>Bridge interfaces (br[0-9]) may now be used in
-  /etc/shorewall/maclist.</li>
-  <li>ACCEPT, DNAT[-], REDIRECT[-] and LOG rules defined in
-    /etc/shorewall/rules may now be rate-limited. For DNAT and REDIRECT
-    rules, rate limiting occurs in the nat table DNAT rule; the corresponding
-    ACCEPT rule in the filter table is not rate limited. If you want to limit
-    the filter table rule, you will need o create two rules; a DNAT- rule and
-    an ACCEPT rule which can be rate-limited separately.<br>
-    &nbsp;<br>
-    <span style="font-weight: bold;">Warning:</span> When rate limiting is
-    specified on a rule with "all" in the SOURCE or DEST fields, the limit
-    will apply to each pair of zones individually rather than as a single
-    limit for all pairs of covered by the rule.<br>
-    &nbsp;<br>
-    To specify a rate limit, follow ACCEPT, DNAT[-], REDIRECT[-] or LOG
-    with<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;
-    &lt;rate&gt;/&lt;interval&gt;[:&lt;burst&gt;] &gt;<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; where<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;rate&gt; is the sustained rate per
-    &lt;interval&gt;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;interval&gt; is "sec" or "min"<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;burst&gt; is the largest burst
-    accepted within an &lt;interval&gt;. If not given, the default of 5 is
-    assumed.<br>
-    &nbsp;<br>
-    There may be no white space between the ACTION and "&lt;" nor there may
-    be any white space within the burst specification. If you want to specify
-    logging of a rate-limited rule, the ":" and log level comes after the
-    "&gt;" (e.g., ACCEPT&lt;2/sec:4&gt;:info ).<br>
-    &nbsp;<br>
-    Let's take an example:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    ACCEPT&lt;2/sec:4&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    net&nbsp;&nbsp;&nbsp;&nbsp; dmz&nbsp;&nbsp;&nbsp;&nbsp;
-    tcp&nbsp;&nbsp;&nbsp;&nbsp; 80<br>
-    &nbsp;&nbsp;&nbsp;<br>
-    The first time this rule is reached, the packet will be accepted; in
-    fact, since the burst is 4, the first four packets will be accepted.
-    After this, it will be 500ms (1 second divided by the rate<br>
-    of 2) before a packet will be accepted from this rule, regardless of how
-    many packets reach it. Also, every 500ms which passes without matching a
-    packet, one of the bursts will be regained; if no packets hit the rule
-    for 2 second, the burst will be fully recharged; back where we
-    started.<br>
-  </li>
-</ol>
-
-<p><b>8/9/2003 - Snapshot 1.4.6_20030809</b><b>&nbsp;</b></p>
-
-<blockquote>
-  <p><a
-  href="http://shorewall.net/pub/shorewall/Snapshots/">http://shorewall.net/pub/shorewall/Snapshots/</a><br>
-  <a href="ftp://shorewall.net/pub/shorewall/Snapshots/"
-  target="_top">ftp://shorewall.net/pub/shorewall/Snapshots/</a></p>
-</blockquote>
-<b>Problems Corrected since version 1.4.6</b><br>
-
-<ol>
-  <li>Corrected problem in 1.4.6 where the MANGLE_ENABLED variable was being
-    tested before it was set.</li>
-  <li>Corrected handling of MAC addresses in the SOURCE column of the tcrules
-    file. Previously, these addresses resulted in an invalid iptables
-  command.</li>
-  <li>The "shorewall stop" command is now disabled when
-    /etc/shorewall/startup_disabled exists. This prevents people from
-    shooting themselves in the foot prior to having configured Shorewall.</li>
-  <li>A change introduced in version 1.4.6 caused error messages during
-    "shorewall [re]start" when ADD_IP_ALIASES=Yes and ip addresses were being
-    added to a PPP interface; the addresses were successfully added in spite
-    of the messages.<br>
-    &nbsp;&nbsp;&nbsp;<br>
-    The firewall script has been modified to eliminate the error messages<br>
-  </li>
-</ol>
-<b>Migration Issues:</b><br>
-
-<ol>
-  <li>Once you have installed this version of Shorewall, you must restart
-    Shorewall before you may use the 'drop', 'reject', 'allow' or 'save'
-    commands.</li>
-  <li>To maintain strict compatibility with previous versions, current uses
-    of "shorewall drop" and "shorewall reject" should be replaced with
-    "shorewall dropall" and "shorewall rejectall"</li>
-</ol>
-<b>New Features:</b><br>
-
-<ol>
-  <li>Shorewall now creates a dynamic blacklisting chain for each interface
-    defined in /etc/shorewall/interfaces. The 'drop' and 'reject' commands
-    use the routing table to determine which of these chains is to be used
-    for blacklisting the specified IP address(es).<br>
-    <br>
-    Two new commands ('dropall' and 'rejectall') have been introduced that do
-    what 'drop' and 'reject' used to do; namely, when an address is
-    blacklisted using these new commands, it will be blacklisted on all of
-    your firewall's interfaces.</li>
-  <li>Thanks to Steve Herber, the 'help' command can now give
-    command-specific help (e.g., shorewall help &lt;command&gt;).</li>
-  <li>A new option "ADMINISABSENTMINDED" has been added to
-    /etc/shorewall/shorewall.conf. This option has a default value of "No"
-    for existing users which causes Shorewall's 'stopped' state &nbsp;to
-    continue as it has been; namely, in the stopped state only traffic
-    to/from hosts listed in /etc/shorewall/routestopped is accepted.<br>
-    <br>
-    With ADMINISABSENTMINDED=Yes (the default for new installs), in addition
-    to traffic to/from the hosts listed in /etc/shorewall/routestopped,
-    Shorewall will allow:<br>
-    <br>
-    &nbsp;&nbsp; a) All traffic originating from the firewall itself; and<br>
-    &nbsp;&nbsp; b) All traffic that is part of or related to an
-    already-existing connection.<br>
-    <br>
-    &nbsp;In particular, with ADMINISABSENTMINDED=Yes, a "shorewall stop"
-    entered through an ssh session will not kill the session.<br>
-    <br>
-    &nbsp;Note though that even with ADMINISABSENTMINDED=Yes, it is still
-    possible for people to shoot themselves in the foot.<br>
-    <br>
-    &nbsp;Example:<br>
-    <br>
-    &nbsp;/etc/shorewall/nat:<br>
-    <br>
-    &nbsp; &nbsp; &nbsp;206.124.146.178&nbsp;&nbsp;&nbsp;
-    eth0:0&nbsp;&nbsp;&nbsp; 192.168.1.5&nbsp;&nbsp;&nbsp;<br>
-    <br>
-    &nbsp;/etc/shorewall/rules:<br>
-    <br>
-    &nbsp;&nbsp; ACCEPT&nbsp;&nbsp;&nbsp; net&nbsp;&nbsp;&nbsp;
-    loc:192.168.1.5&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp; 22<br>
-    &nbsp;&nbsp; ACCEPT&nbsp;&nbsp;&nbsp; loc&nbsp;&nbsp;&nbsp;
-    fw&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp; 22<br>
-    <br>
-    From a remote system, I ssh to 206.124.146.178 which establishes an SSH
-    connection with local system 192.168.1.5. I then create a second SSH
-    connection from that computer to the firewall and confidently type
-    "shorewall stop". As part of its stop processing, Shorewall removes
-    eth0:0 which kills my SSH connection to 192.168.1.5!!!</li>
-  <li>Given the wide range of VPN software, I can never hope to add specific
-    support for all of it. I have therefore decided to add "generic" tunnel
-    support.<br>
-    &nbsp;<br>
-    Generic tunnels work pretty much like any of the other tunnel types. You
-    usually add a zone to represent the systems at the other end of the
-    tunnel and you add the appropriate rules/policies to<br>
-    implement your security policy regarding traffic to/from those
-    systems.<br>
-    &nbsp;<br>
-    In the /etc/shorewall/tunnels file, you can have entries of the form:<br>
-    <br>
-    generic:&lt;protocol&gt;[:&lt;port&gt;]&nbsp; &lt;zone&gt;&nbsp; &lt;ip
-    address&gt;&nbsp;&nbsp;&nbsp; &lt;gateway zones&gt;<br>
-    &nbsp;<br>
-    where:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;protocol&gt; is the protocol
-    used by the tunnel<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;port&gt;&nbsp; if the protocol
-    is 'udp' or 'tcp' then this is the destination port number used by the
-    tunnel.<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;zone&gt;&nbsp; is the zone of
-    the remote tunnel gateway<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;ip address&gt; is the IP address
-    of the remote tunnel gateway.<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;gateway zone&gt;&nbsp;&nbsp;
-    Optional. A comma-separated list of zone names. If specified, the remote
-    gateway is to be considered part of these zones.</li>
-  <li>An 'arp_filter' option has been added to the /etc/shorewall/interfaces
-    file. This option causes
-    /proc/sys/net/ipv4/conf/&lt;interface&gt;/arp_filter to be set with the
-    result that this interface will only answer ARP 'who-has' requests from
-    hosts that are routed out through that interface. Setting this option
-    facilitates testing of your firewall where multiple firewall interfaces
-    are connected to the same HUB/Switch (all interfaces connected to the
-    single HUB/Switch should have this option specified). Note that using
-    such a configuration in a production environment is strongly recommended
-    against.<br>
-  </li>
-</ol>
-
-<p><b>8/5/2003 - Shorewall-1.4.6b</b><b>&nbsp;<br>
-</b></p>
-<b>Problems Corrected since version 1.4.6:</b><br>
-
-<ol>
-  <li>Previously, if TC_ENABLED is set to yes in shorewall.conf then
-    Shorewall would fail to start with the error "ERROR: &nbsp;Traffic
-    Control requires Mangle"; that problem has been corrected.</li>
-  <li>Corrected handling of MAC addresses in the SOURCE column of the tcrules
-    file. Previously, these addresses resulted in an invalid iptables
-  command.</li>
-  <li>The "shorewall stop" command is now disabled when
-    /etc/shorewall/startup_disabled exists. This prevents people from
-    shooting themselves in the foot prior to having configured Shorewall.</li>
-  <li>A change introduced in version 1.4.6 caused error messages during
-    "shorewall [re]start" when ADD_IP_ALIASES=Yes and ip addresses were being
-    added to a PPP interface; the addresses were successfully added in spite
-    of the messages.<br>
-    &nbsp;&nbsp;<br>
-    The firewall script has been modified to eliminate the error
-  messages.</li>
-</ol>
-
-<p><b>8/5/2003 - Shorewall-1.4.6b</b> <b><br>
-</b></p>
-<b>Problems Corrected since version 1.4.6:</b><br>
-
-<ol>
-  <li>Previously, if TC_ENABLED is set to yes in shorewall.conf then
-    Shorewall would fail to start with the error "ERROR: &nbsp;Traffic
-    Control requires Mangle"; that problem has been corrected.</li>
-  <li>Corrected handling of MAC addresses in the SOURCE column of the tcrules
-    file. Previously, these addresses resulted in an invalid iptables
-  command.</li>
-  <li>The "shorewall stop" command is now disabled when
-    /etc/shorewall/startup_disabled exists. This prevents people from
-    shooting themselves in the foot prior to having configured Shorewall.</li>
-  <li>A change introduced in version 1.4.6 caused error messages during
-    "shorewall [re]start" when ADD_IP_ALIASES=Yes and ip addresses were being
-    added to a PPP interface; the addresses were successfully added in spite
-    of the messages.<br>
-    &nbsp;&nbsp;<br>
-    The firewall script has been modified to eliminate the error messages.<br>
-  </li>
-</ol>
-
-<p><b>7/31/2003 - Snapshot 1.4.6_20030731</b></p>
-
-<blockquote>
-  <p><a
-  href="http://shorewall.net/pub/shorewall/Snapshots/">http://shorewall.net/pub/shorewall/Snapshots/</a><br>
-  <a href="ftp://shorewall.net/pub/shorewall/Snapshots/"
-  target="_top">ftp://shorewall.net/pub/shorewall/Snapshots/</a></p>
-</blockquote>
-
-<p><b>Problems Corrected since version 1.4.6:</b><br>
-</p>
-<ol>
-  <li>Corrected problem in 1.4.6 where the MANGLE_ENABLED variable was being
-    tested before it was set.</li>
-  <li>Corrected handling of MAC addresses in the SOURCE column of the tcrules
-    file. Previously, these addresses resulted in an invalid iptables
-    command.<br>
-  </li>
-</ol>
-
-<p><b>Migration Issues:</b><br>
-</p>
-<ol>
-  <li>Once you have installed this version of Shorewall, you must restart
-    Shorewall before you may use the 'drop', 'reject', 'allow' or 'save'
-    commands.</li>
-  <li>To maintain strict compatibility with previous versions, current uses
-    of "shorewall drop" and "shorewall reject" should be replaced with
-    "shorewall dropall" and "shorewall rejectall"</li>
-</ol>
-
-<p><b>New Features:</b><br>
-</p>
-<ol>
-  <li>Shorewall now creates a dynamic blacklisting chain for each interface
-    defined in /etc/shorewall/interfaces. The 'drop' and 'reject' commands
-    use the routing table to determine which of these chains is to be used
-    for blacklisting the specified IP address(es).<br>
-    <br>
-    Two new commands ('dropall' and 'rejectall') have been introduced that do
-    what 'drop' and 'reject' used to do; namely, when an address is
-    blacklisted using these new commands, it will be blacklisted on all of
-    your firewall's interfaces.</li>
-  <li>Thanks to Steve Herber, the 'help' command can now give
-    command-specific help (e.g., shorewall help &lt;command&gt;).</li>
-  <li>A new option "ADMINISABSENTMINDED" has been added to
-    /etc/shorewall/shorewall.conf. This option has a default value of "No"
-    for existing users which causes Shorewall's 'stopped' state &nbsp;to
-    continue as it has been; namely, in the stopped state only traffic
-    to/from hosts listed in /etc/shorewall/routestopped is accepted.<br>
-    <br>
-    With ADMINISABSENTMINDED=Yes (the default for new installs), in addition
-    to traffic to/from the hosts listed in /etc/shorewall/routestopped,
-    Shorewall will allow:<br>
-    <br>
-    &nbsp;&nbsp; a) All traffic originating from the firewall itself; and<br>
-    &nbsp;&nbsp; b) All traffic that is part of or related to an
-    already-existing connection.<br>
-    <br>
-    &nbsp;In particular, with ADMINISABSENTMINDED=Yes, a "shorewall stop"
-    entered through an ssh session will not kill the session.<br>
-    <br>
-    &nbsp;Note though that even with ADMINISABSENTMINDED=Yes, it is still
-    possible for people to shoot themselves in the foot.<br>
-    <br>
-    &nbsp;Example:<br>
-    <br>
-    &nbsp;/etc/shorewall/nat:<br>
-    <br>
-    &nbsp; &nbsp; &nbsp;206.124.146.178&nbsp;&nbsp;&nbsp;
-    eth0:0&nbsp;&nbsp;&nbsp; 192.168.1.5&nbsp;&nbsp;&nbsp;<br>
-    <br>
-    &nbsp;/etc/shorewall/rules:<br>
-    <br>
-    &nbsp;&nbsp; ACCEPT&nbsp;&nbsp;&nbsp; net&nbsp;&nbsp;&nbsp;
-    loc:192.168.1.5&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp; 22<br>
-    &nbsp;&nbsp; ACCEPT&nbsp;&nbsp;&nbsp; loc&nbsp;&nbsp;&nbsp;
-    fw&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp; 22<br>
-    <br>
-    From a remote system, I ssh to 206.124.146.178 which establishes an SSH
-    connection with local system 192.168.1.5. I then create a second SSH
-    connection from that computer to the firewall and confidently type
-    "shorewall stop". As part of its stop processing, Shorewall removes
-    eth0:0 which kills my SSH connection to 192.168.1.5!!!</li>
-</ol>
-
-<p><b>7/27/2003 - Snapshot 1.4.6_20030727</b></p>
-
-<blockquote>
-  <p><a
-  href="http://shorewall.net/pub/shorewall/Snapshots/">http://shorewall.net/pub/shorewall/Snapshots/</a><br>
-  <a href="ftp://shorewall.net/pub/shorewall/Snapshots/"
-  target="_top">ftp://shorewall.net/pub/shorewall/Snapshots/</a></p>
-</blockquote>
-<b>Problems Corrected since version 1.4.6</b><br>
-
-<ol>
-  <li>Corrected problem in 1.4.6 where the MANGLE_ENABLED variable was being
-    tested before it was set.</li>
-  <li>Corrected handling of MAC addresses in the SOURCE column of the tcrules
-    file. Previously, these addresses resulted in an invalid iptables
-    command.<br>
-  </li>
-</ol>
-<b>Migration Issues:</b><br>
-
-<ol>
-  <li>Once you have installed this version of Shorewall, you must restart
-    Shorewall before you may use the 'drop', 'reject', 'allow' or 'save'
-    commands.</li>
-  <li>To maintain strict compatibility with previous versions, current uses
-    of "shorewall drop" and "shorewall reject" should be replaced with
-    "shorewall dropall" and "shorewall rejectall"</li>
-</ol>
-<b>New Features:</b><br>
-
-<ol>
-  <li>Shorewall now creates a dynamic blacklisting chain for each interface
-    defined in /etc/shorewall/interfaces. The 'drop' and 'reject' commands
-    use the routing table to determine which of these chains is to be used
-    for blacklisting the specified IP address(es).<br>
-    <br>
-    Two new commands ('dropall' and 'rejectall') have been introduced that do
-    what 'drop' and 'reject' used to do; namely, when an address is
-    blacklisted using these new commands, it will be blacklisted on all of
-    your firewall's interfaces.</li>
-  <li>Thanks to Steve Herber, the 'help' command can now give
-    command-specific help (e.g., shorewall help &lt;command&gt;).<br>
-  </li>
-</ol>
-
-<p><b>7/26/2003 - Snapshot 1.4.6_20030726</b></p>
-
-<blockquote>
-  <p><a
-  href="http://shorewall.net/pub/shorewall/Snapshots/">http://shorewall.net/pub/shorewall/Snapshots/</a><br>
-  <a href="ftp://shorewall.net/pub/shorewall/Snapshots/"
-  target="_top">ftp://shorewall.net/pub/shorewall/Snapshots/</a></p>
-</blockquote>
-
-<p><b>Problems Corrected since version 1.4.6:</b><br>
-</p>
-<ol>
-  <li>Corrected problem in 1.4.6 where the MANGLE_ENABLED variable was being
-    tested before it was set.</li>
-  <li>Corrected handling of MAC addresses in the SOURCE column of the tcrules
-    file. Previously, these addresses resulted in an invalid iptables
-    command.<br>
-  </li>
-</ol>
-
-<p><b>Migration Issues:</b><br>
-</p>
-<ol>
-  <li>Once you have installed this version of Shorewall, you must restart
-    Shorewall before you may use the 'drop', 'reject', 'allow' or 'save'
-    commands.</li>
-  <li>To maintain strict compatibility with previous versions, current uses
-    of "shorewall drop" and "shorewall reject" should be replaced with
-    "shorewall dropall" and "shorewall rejectall"</li>
-</ol>
-
-<p><b>New Features:</b><br>
-</p>
-Shorewall now creates a dynamic blacklisting chain for each interface defined
-in /etc/shorewall/interfaces. The 'drop' and 'reject' commands use the
-routing table to determine which of these chains is to be used for
-blacklisting the specified IP address(es).<br>
-<br>
-Two new commands ('dropall' and 'rejectall') have been introduced that do
-what 'drop' and 'reject' used to do; namely, when an address is blacklisted
-using these new commands, it will be blacklisted on all of your firewall's
-interfaces. 
-
-<p><b>7/22/2003 - Shorewall-1.4.6a</b> <b><br>
-</b></p>
-<b>Problems Corrected:</b><br>
-
-<ol>
-  <li>Previously, if TC_ENABLED is set to yes in shorewall.conf then
-    Shorewall would fail to start with the error "ERROR: &nbsp;Traffic
-    Control requires Mangle"; that problem has been corrected.</li>
-</ol>
-
-<p><b>7/20/2003 - Shorewall-1.4.6</b> <b><br>
-</b></p>
-
-<p><b>Problems Corrected:</b><br>
-</p>
-<ol>
-  <li>A problem seen on RH7.3 systems where Shorewall encountered start
-    errors when started using the "service" mechanism has been worked
-    around.<br>
-    <br>
-  </li>
-  <li>Where a list of IP addresses appears in the DEST column of a DNAT[-]
-    rule, Shorewall incorrectly created multiple DNAT rules in the nat table
-    (one for each element in the list). Shorewall now correctly creates a
-    single DNAT rule with multiple "--to-destination" clauses.<br>
-    <br>
-  </li>
-  <li>Corrected a problem in Beta 1 where DNS names containing a "-" were
-    mis-handled when they appeared in the DEST column of a rule.<br>
-    <br>
-  </li>
-  <li>A number of problems with rule parsing have been corrected. Corrections
-    involve the handling of "z1!z2" in the SOURCE column as well as lists in
-    the ORIGINAL DESTINATION column.<br>
-    <br>
-  </li>
-  <li>The message "Adding rules for DHCP" is now suppressed if there are no
-    DHCP rules to add.<br>
-  </li>
-</ol>
-
-<p><b>Migration Issues:</b><br>
-</p>
-<ol>
-  <li>In earlier versions, an undocumented feature allowed entries in the
-    host file as follows:<br>
-    <br>
-    &nbsp; &nbsp; z&nbsp;&nbsp;&nbsp;
-    eth1:192.168.1.0/24,eth2:192.168.2.0/24<br>
-    <br>
-    This capability was never documented and has been removed in 1.4.6 to
-    allow entries of the following format:<br>
-    <br>
-    &nbsp; &nbsp; z&nbsp;&nbsp; eth1:192.168.1.0/24,192.168.2.0/24<br>
-    <br>
-  </li>
-  <li>The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT options have been removed
-    from /etc/shorewall/shorewall.conf. These capabilities are now
-    automatically detected by Shorewall (see below).<br>
-  </li>
-</ol>
-
-<p><b>New Features:</b><br>
-</p>
-<ol>
-  <li>A 'newnotsyn' interface option has been added. This option may be
-    specified in /etc/shorewall/interfaces and overrides the setting
-    NEWNOTSYN=No for packets arriving on the associated interface.<br>
-    <br>
-  </li>
-  <li>The means for specifying a range of IP addresses in /etc/shorewall/masq
-    to use for SNAT is now documented. ADD_SNAT_ALIASES=Yes is enabled for
-    address ranges.<br>
-    <br>
-  </li>
-  <li>Shorewall can now add IP addresses to subnets other than the first one
-    on an interface.<br>
-    <br>
-  </li>
-  <li>DNAT[-] rules may now be used to load balance (round-robin) over a set
-    of servers. Servers may be specified in a range of addresses given as
-    &lt;first address&gt;-&lt;last address&gt;.<br>
-    <br>
-    Example:<br>
-    <br>
-    &nbsp; &nbsp; DNAT net loc:192.168.10.2-192.168.10.5 tcp 80<br>
-    <br>
-  </li>
-  <li>The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration options
-    have been removed and have been replaced by code that detects whether
-    these capabilities are present in the current kernel. The output of the
-    start, restart and check commands have been enhanced to report the
-    outcome:<br>
-    <br>
-    Shorewall has detected the following iptables/netfilter capabilities:<br>
-    &nbsp; &nbsp;NAT: Available<br>
-    &nbsp; &nbsp;Packet Mangling: Available<br>
-    &nbsp; &nbsp;Multi-port Match: Available<br>
-    Verifying Configuration...<br>
-    <br>
-  </li>
-  <li>Support for the Connection Tracking Match Extension has been added.
-    This extension is available in recent kernel/iptables releases and allows
-    for rules which match against elements in netfilter's connection tracking
-    table. Shorewall automatically detects the availability of this extension
-    and reports its availability in the output of the start, restart and
-    check commands.<br>
-    <br>
-    Shorewall has detected the following iptables/netfilter capabilities:<br>
-    &nbsp; &nbsp;NAT: Available<br>
-    &nbsp; &nbsp;Packet Mangling: Available<br>
-    &nbsp; &nbsp;Multi-port Match: Available<br>
-    &nbsp; &nbsp;Connection Tracking Match: Available<br>
-    Verifying Configuration...<br>
-    <br>
-    If this extension is available, the ruleset generated by Shorewall is
-    changed in the following ways:</li>
-  <li
-  style="list-style-type: none; list-style-position: outside; list-style-image: none;"><ul>
-      <li>To handle 'norfc1918' filtering, Shorewall will not create chains
-        in the mangle table but will rather do all 'norfc1918' filtering in
-        the filter table (rfc1918 chain).</li>
-      <li>Recall that Shorewall DNAT rules generate two netfilter rules; one
-        in the nat table and one in the filter table. If the Connection
-        Tracking Match Extension is available, the rule in the filter table
-        is extended to check that the original destination address was the
-        same as specified (or defaulted to) in the DNAT rule.<br>
-        <br>
-      </li>
-    </ul>
-  </li>
-  <li>The shell used to interpret the firewall script
-    (/usr/share/shorewall/firewall) may now be specified using the
-    SHOREWALL_SHELL parameter in shorewall.conf.<br>
-    <br>
-  </li>
-  <li>An 'ipcalc' command has been added to /sbin/shorewall.<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipcalc [ &lt;address&gt; &lt;netmask&gt; |
-    &lt;address&gt;/&lt;vlsm&gt; ]<br>
-    <br>
-    Examples:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [root@wookie root]# shorewall ipcalc
-    192.168.1.0/24<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CIDR=192.168.1.0/24<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; NETMASK=255.255.255.0<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; NETWORK=192.168.1.0<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    BROADCAST=192.168.1.255<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [root@wookie root]#<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [root@wookie root]# shorewall ipcalc
-    192.168.1.0 255.255.255.0<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CIDR=192.168.1.0/24<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; NETMASK=255.255.255.0<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; NETWORK=192.168.1.0<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    BROADCAST=192.168.1.255<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [root@wookie root]#<br>
-    <br>
-    Warning:<br>
-    <br>
-    If your shell only supports 32-bit signed arithmatic (ash or dash), then
-    the ipcalc command produces incorrect information for IP addresses
-    128.0.0.0-1 and for /1 networks. Bash should produce correct information
-    for all valid IP addresses.<br>
-    <br>
-  </li>
-  <li>An 'iprange' command has been added to /sbin/shorewall.<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iprange &lt;address&gt;-&lt;address&gt;<br>
-    <br>
-    This command decomposes a range of IP addressses into a list of network
-    and host addresses. The command can be useful if you need to construct an
-    efficient set of rules that accept connections from a range of network
-    addresses.<br>
-    <br>
-    Note: If your shell only supports 32-bit signed arithmetic (ash or dash)
-    then the range may not span 128.0.0.0.<br>
-    <br>
-    Example:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [root@gateway root]# shorewall iprange
-    192.168.1.4-192.168.12.9<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.4/30<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.8/29<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.16/28<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.32/27<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.64/26<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.128/25<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.2.0/23<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.4.0/22<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.8.0/22<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.12.0/29<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.12.8/31<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [root@gateway root]#<br>
-    <br>
-  </li>
-  <li>A list of host/net addresses is now allowed in an entry in
-    /etc/shorewall/hosts.<br>
-    <br>
-    Example:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; foo&nbsp;&nbsp;&nbsp;
-    eth1:192.168.1.0/24,192.168.2.0/24<br>
-    <br>
-  </li>
-  <li>The "shorewall check" command now includes the chain name when printing
-    the applicable policy for each pair of zones.<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp; Example:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Policy for dmz to net is
-    REJECT using chain all2all<br>
-    &nbsp;<br>
-    This means that the policy for connections from the dmz to the internet
-    is REJECT and the applicable entry in the /etc/shorewall/policy was the
-    all-&gt;all policy.<br>
-    <br>
-  </li>
-  <li>Support for the 2.6 Kernel series has been added.<br>
-  </li>
-</ol>
-
-<p><b>7/15/2003 - New Mirror in Brazil</b><b><br>
-</b></p>
-Thanks to the folks at securityopensource.org.br, there is now a <a
-href="http://shorewall.securityopensource.org.br" target="_top">Shorewall
-mirror in Brazil</a>. 
-
-<p><b>7/15/2003 - Shorewall-1.4.6 RC 1</b> <b><br>
-</b></p>
-
-<p><b>Problems Corrected:</b><br>
-</p>
-<ol>
-  <li>A problem seen on RH7.3 systems where Shorewall encountered start
-    errors when started using the "service" mechanism has been worked
-    around.<br>
-    <br>
-  </li>
-  <li>Where a list of IP addresses appears in the DEST column of a DNAT[-]
-    rule, Shorewall incorrectly created multiple DNAT rules in the nat table
-    (one for each element in the list). Shorewall now correctly creates a
-    single DNAT rule with multiple "--to-destination" clauses.<br>
-    <br>
-  </li>
-  <li>Corrected a problem in Beta 1 where DNS names containing a "-" were
-    mis-handled when they appeared in the DEST column of a rule.<br>
-    <br>
-  </li>
-  <li>A number of problems with rule parsing have been corrected. Corrections
-    involve the handling of "z1!z2" in the SOURCE column as well as lists in
-    the ORIGINAL DESTINATION column.<br>
-  </li>
-</ol>
-
-<p><b>Migration Issues:</b><br>
-</p>
-<ol>
-  <li>In earlier versions, an undocumented feature allowed entries in the
-    host file as follows:<br>
-    <br>
-    &nbsp; &nbsp; z&nbsp;&nbsp;&nbsp;
-    eth1:192.168.1.0/24,eth2:192.168.2.0/24<br>
-    <br>
-    This capability was never documented and has been removed in 1.4.6 to
-    allow entries of the following format:<br>
-    <br>
-    &nbsp; &nbsp; z&nbsp;&nbsp; eth1:192.168.1.0/24,192.168.2.0/24<br>
-    <br>
-  </li>
-  <li>The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT options have been removed
-    from /etc/shorewall/shorewall.conf. These capabilities are now
-    automatically detected by Shorewall (see below).<br>
-  </li>
-</ol>
-
-<p><b>New Features:</b><br>
-</p>
-<ol>
-  <li>A 'newnotsyn' interface option has been added. This option may be
-    specified in /etc/shorewall/interfaces and overrides the setting
-    NEWNOTSYN=No for packets arriving on the associated interface.<br>
-    <br>
-  </li>
-  <li>The means for specifying a range of IP addresses in /etc/shorewall/masq
-    to use for SNAT is now documented. ADD_SNAT_ALIASES=Yes is enabled for
-    address ranges.<br>
-    <br>
-  </li>
-  <li>Shorewall can now add IP addresses to subnets other than the first one
-    on an interface.<br>
-    <br>
-  </li>
-  <li>DNAT[-] rules may now be used to load balance (round-robin) over a set
-    of servers. Servers may be specified in a range of addresses given as
-    &lt;first address&gt;-&lt;last address&gt;.<br>
-    <br>
-    Example:<br>
-    <br>
-    &nbsp; &nbsp; DNAT net loc:192.168.10.2-192.168.10.5 tcp 80<br>
-    <br>
-  </li>
-  <li>The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration options
-    have been removed and have been replaced by code that detects whether
-    these capabilities are present in the current kernel. The output of the
-    start, restart and check commands have been enhanced to report the
-    outcome:<br>
-    <br>
-    Shorewall has detected the following iptables/netfilter capabilities:<br>
-    &nbsp; &nbsp;NAT: Available<br>
-    &nbsp; &nbsp;Packet Mangling: Available<br>
-    &nbsp; &nbsp;Multi-port Match: Available<br>
-    Verifying Configuration...<br>
-    <br>
-  </li>
-  <li>Support for the Connection Tracking Match Extension has been added.
-    This extension is available in recent kernel/iptables releases and allows
-    for rules which match against elements in netfilter's connection tracking
-    table. Shorewall automatically detects the availability of this extension
-    and reports its availability in the output of the start, restart and
-    check commands.<br>
-    <br>
-    Shorewall has detected the following iptables/netfilter capabilities:<br>
-    &nbsp; &nbsp;NAT: Available<br>
-    &nbsp; &nbsp;Packet Mangling: Available<br>
-    &nbsp; &nbsp;Multi-port Match: Available<br>
-    &nbsp; &nbsp;Connection Tracking Match: Available<br>
-    Verifying Configuration...<br>
-    <br>
-    If this extension is available, the ruleset generated by Shorewall is
-    changed in the following ways:</li>
-  <li
-  style="list-style-type: none; list-style-position: outside; list-style-image: none;"><ul>
-      <li>To handle 'norfc1918' filtering, Shorewall will not create chains
-        in the mangle table but will rather do all 'norfc1918' filtering in
-        the filter table (rfc1918 chain).</li>
-      <li>Recall that Shorewall DNAT rules generate two netfilter rules; one
-        in the nat table and one in the filter table. If the Connection
-        Tracking Match Extension is available, the rule in the filter table
-        is extended to check that the original destination address was the
-        same as specified (or defaulted to) in the DNAT rule.<br>
-        <br>
-      </li>
-    </ul>
-  </li>
-  <li>The shell used to interpret the firewall script
-    (/usr/share/shorewall/firewall) may now be specified using the
-    SHOREWALL_SHELL parameter in shorewall.conf.<br>
-    <br>
-  </li>
-  <li>An 'ipcalc' command has been added to /sbin/shorewall.<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipcalc [ &lt;address&gt; &lt;netmask&gt; |
-    &lt;address&gt;/&lt;vlsm&gt; ]<br>
-    <br>
-    Examples:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [root@wookie root]# shorewall ipcalc
-    192.168.1.0/24<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CIDR=192.168.1.0/24<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; NETMASK=255.255.255.0<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; NETWORK=192.168.1.0<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    BROADCAST=192.168.1.255<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [root@wookie root]#<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [root@wookie root]# shorewall ipcalc
-    192.168.1.0 255.255.255.0<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CIDR=192.168.1.0/24<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; NETMASK=255.255.255.0<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; NETWORK=192.168.1.0<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    BROADCAST=192.168.1.255<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [root@wookie root]#<br>
-    <br>
-    Warning:<br>
-    <br>
-    If your shell only supports 32-bit signed arithmatic (ash or dash), then
-    the ipcalc command produces incorrect information for IP addresses
-    128.0.0.0-1 and for /1 networks. Bash should produce correct information
-    for all valid IP addresses.<br>
-    <br>
-  </li>
-  <li>An 'iprange' command has been added to /sbin/shorewall.<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iprange &lt;address&gt;-&lt;address&gt;<br>
-    <br>
-    This command decomposes a range of IP addressses into a list of network
-    and host addresses. The command can be useful if you need to construct an
-    efficient set of rules that accept connections from a range of network
-    addresses.<br>
-    <br>
-    Note: If your shell only supports 32-bit signed arithmetic (ash or dash)
-    then the range may not span 128.0.0.0.<br>
-    <br>
-    Example:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [root@gateway root]# shorewall iprange
-    192.168.1.4-192.168.12.9<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.4/30<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.8/29<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.16/28<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.32/27<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.64/26<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.128/25<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.2.0/23<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.4.0/22<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.8.0/22<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.12.0/29<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.12.8/31<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [root@gateway root]#<br>
-    <br>
-  </li>
-  <li>A list of host/net addresses is now allowed in an entry in
-    /etc/shorewall/hosts.<br>
-    <br>
-    Example:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; foo&nbsp;&nbsp;&nbsp;
-    eth1:192.168.1.0/24,192.168.2.0/24</li>
-</ol>
-
-<p><b>7/7/2003 - Shorewall-1.4.6 Beta 2</b></p>
-
-<p><b>Problems Corrected:</b><br>
-</p>
-<ol>
-  <li>A problem seen on RH7.3 systems where Shorewall encountered start
-    errors when started using the "service" mechanism has been worked
-    around.<br>
-    <br>
-  </li>
-  <li>Where a list of IP addresses appears in the DEST column of a DNAT[-]
-    rule, Shorewall incorrectly created multiple DNAT rules in the nat table
-    (one for each element in the list). Shorewall now correctly creates a
-    single DNAT rule with multiple "--to-destination" clauses.<br>
-    <br>
-  </li>
-  <li>Corrected a problem in Beta 1 where DNS names containing a "-" were
-    mis-handled when they appeared in the DEST column of a rule.<br>
-  </li>
-</ol>
-
-<p><b>Migration Issues:</b><br>
-</p>
-<ol>
-  <li>In earlier versions, an undocumented feature allowed entries in the
-    host file as follows:<br>
-    <br>
-    &nbsp; &nbsp; z&nbsp;&nbsp;&nbsp;
-    eth1:192.168.1.0/24,eth2:192.168.2.0/24<br>
-    <br>
-    This capability was never documented and has been removed in 1.4.6 to
-    allow entries of the following format:<br>
-    <br>
-    &nbsp; &nbsp; z&nbsp;&nbsp; eth1:192.168.1.0/24,192.168.2.0/24<br>
-    <br>
-  </li>
-  <li>The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT options have been removed
-    from /etc/shorewall/shorewall.conf. These capabilities are now
-    automatically detected by Shorewall (see below).<br>
-  </li>
-</ol>
-
-<p><b>New Features:</b><br>
-</p>
-<ol>
-  <li>A 'newnotsyn' interface option has been added. This option may be
-    specified in /etc/shorewall/interfaces and overrides the setting
-    NEWNOTSYN=No for packets arriving on the associated interface.<br>
-    <br>
-  </li>
-  <li>The means for specifying a range of IP addresses in /etc/shorewall/masq
-    to use for SNAT is now documented. ADD_SNAT_ALIASES=Yes is enabled for
-    address ranges.<br>
-    <br>
-  </li>
-  <li>Shorewall can now add IP addresses to subnets other than the first one
-    on an interface.<br>
-    <br>
-  </li>
-  <li>DNAT[-] rules may now be used to load balance (round-robin) over a set
-    of servers. Servers may be specified in a range of addresses given as
-    &lt;first address&gt;-&lt;last address&gt;.<br>
-    <br>
-    Example:<br>
-    <br>
-    &nbsp; &nbsp; DNAT net loc:192.168.10.2-192.168.10.5 tcp 80<br>
-    <br>
-  </li>
-  <li>The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration options
-    have been removed and have been replaced by code that detects whether
-    these capabilities are present in the current kernel. The output of the
-    start, restart and check commands have been enhanced to report the
-    outcome:<br>
-    <br>
-    Shorewall has detected the following iptables/netfilter capabilities:<br>
-    &nbsp; &nbsp;NAT: Available<br>
-    &nbsp; &nbsp;Packet Mangling: Available<br>
-    &nbsp; &nbsp;Multi-port Match: Available<br>
-    Verifying Configuration...<br>
-    <br>
-  </li>
-  <li>Support for the Connection Tracking Match Extension has been added.
-    This extension is available in recent kernel/iptables releases and allows
-    for rules which match against elements in netfilter's connection tracking
-    table. Shorewall automatically detects the availability of this extension
-    and reports its availability in the output of the start, restart and
-    check commands.<br>
-    <br>
-    Shorewall has detected the following iptables/netfilter capabilities:<br>
-    &nbsp; &nbsp;NAT: Available<br>
-    &nbsp; &nbsp;Packet Mangling: Available<br>
-    &nbsp; &nbsp;Multi-port Match: Available<br>
-    &nbsp; &nbsp;Connection Tracking Match: Available<br>
-    Verifying Configuration...<br>
-    <br>
-    If this extension is available, the ruleset generated by Shorewall is
-    changed in the following ways:</li>
-  <li
-  style="list-style-type: none; list-style-position: outside; list-style-image: none;"><ul>
-      <li>To handle 'norfc1918' filtering, Shorewall will not create chains
-        in the mangle table but will rather do all 'norfc1918' filtering in
-        the filter table (rfc1918 chain).</li>
-      <li>Recall that Shorewall DNAT rules generate two netfilter rules; one
-        in the nat table and one in the filter table. If the Connection
-        Tracking Match Extension is available, the rule in the filter table
-        is extended to check that the original destination address was the
-        same as specified (or defaulted to) in the DNAT rule.<br>
-        <br>
-      </li>
-    </ul>
-  </li>
-  <li>The shell used to interpret the firewall script
-    (/usr/share/shorewall/firewall) may now be specified using the
-    SHOREWALL_SHELL parameter in shorewall.conf.<br>
-    <br>
-  </li>
-  <li>An 'ipcalc' command has been added to /sbin/shorewall.<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipcalc [ &lt;address&gt; &lt;netmask&gt; |
-    &lt;address&gt;/&lt;vlsm&gt; ]<br>
-    <br>
-    Examples:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [root@wookie root]# shorewall ipcalc
-    192.168.1.0/24<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CIDR=192.168.1.0/24<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; NETMASK=255.255.255.0<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; NETWORK=192.168.1.0<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    BROADCAST=192.168.1.255<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [root@wookie root]#<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [root@wookie root]# shorewall ipcalc
-    192.168.1.0 255.255.255.0<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CIDR=192.168.1.0/24<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; NETMASK=255.255.255.0<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; NETWORK=192.168.1.0<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    BROADCAST=192.168.1.255<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [root@wookie root]#<br>
-    <br>
-    Warning:<br>
-    <br>
-    If your shell only supports 32-bit signed arithmatic (ash or dash), then
-    the ipcalc command produces incorrect information for IP addresses
-    128.0.0.0-1 and for /1 networks. Bash should produce correct information
-    for all valid IP addresses.<br>
-    <br>
-  </li>
-  <li>An 'iprange' command has been added to /sbin/shorewall.<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iprange &lt;address&gt;-&lt;address&gt;<br>
-    <br>
-    This command decomposes a range of IP addressses into a list of network
-    and host addresses. The command can be useful if you need to construct an
-    efficient set of rules that accept connections from a range of network
-    addresses.<br>
-    <br>
-    Note: If your shell only supports 32-bit signed arithmetic (ash or dash)
-    then the range may not span 128.0.0.0.<br>
-    <br>
-    Example:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [root@gateway root]# shorewall iprange
-    192.168.1.4-192.168.12.9<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.4/30<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.8/29<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.16/28<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.32/27<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.64/26<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.128/25<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.2.0/23<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.4.0/22<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.8.0/22<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.12.0/29<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.12.8/31<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [root@gateway root]#<br>
-    <br>
-  </li>
-  <li>A list of host/net addresses is now allowed in an entry in
-    /etc/shorewall/hosts.<br>
-    <br>
-    Example:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp; foo&nbsp;&nbsp;&nbsp;
-    eth1:192.168.1.0/24,192.168.2.0/24<br>
-    <br>
-  </li>
-</ol>
-
-<p><b>7/4/2003 - Shorewall-1.4.6 Beta 1</b></p>
-
-<p><b>Problems Corrected:</b><br>
-</p>
-<ol>
-  <li>A problem seen on RH7.3 systems where Shorewall encountered start
-    errors when started using the "service" mechanism has been worked
-    around.<br>
-    <br>
-  </li>
-  <li>Where a list of IP addresses appears in the DEST column of a DNAT[-]
-    rule, Shorewall incorrectly created multiple DNAT rules in the nat table
-    (one for each element in the list). Shorewall now correctly creates a
-    single DNAT rule with multiple "--to-destination" clauses.<br>
-  </li>
-</ol>
-
-<p><b>New Features:</b><br>
-</p>
-<ol>
-  <li>A 'newnotsyn' interface option has been added. This option may be
-    specified in /etc/shorewall/interfaces and overrides the setting
-    NEWNOTSYN=No for packets arriving on the associated interface.<br>
-    <br>
-  </li>
-  <li>The means for specifying a range of IP addresses in /etc/shorewall/masq
-    to use for SNAT is now documented. ADD_SNAT_ALIASES=Yes is enabled for
-    address ranges.<br>
-    <br>
-  </li>
-  <li>Shorewall can now add IP addresses to subnets other than the first one
-    on an interface.<br>
-    <br>
-  </li>
-  <li>DNAT[-] rules may now be used to load balance (round-robin) over a set
-    of servers. Up to 256 servers may be specified in a range of addresses
-    given as &lt;first address&gt;-&lt;last address&gt;.<br>
-    <br>
-    Example:<br>
-    <br>
-    &nbsp; &nbsp; DNAT net loc:192.168.10.2-192.168.10.5 tcp 80<br>
-    <br>
-    Note that this capability has previously been available using a
-    combination of a DNAT- rule and one or more ACCEPT rules. That technique
-    is still preferable for load-balancing over a large number of servers
-    (&gt; 16) since specifying a range in the DNAT rule causes one filter
-    table ACCEPT rule to be generated for each IP address in the range.<br>
-    <br>
-  </li>
-  <li>The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration options
-    have been removed and have been replaced by code that detects whether
-    these capabilities are present in the current kernel. The output of the
-    start, restart and check commands have been enhanced to report the
-    outcome:<br>
-    <br>
-    Shorewall has detected the following iptables/netfilter capabilities:<br>
-    &nbsp; &nbsp;NAT: Available<br>
-    &nbsp; &nbsp;Packet Mangling: Available<br>
-    &nbsp; &nbsp;Multi-port Match: Available<br>
-    Verifying Configuration...<br>
-    <br>
-  </li>
-  <li>Support for the Connection Tracking Match Extension has been added.
-    This extension is available in recent kernel/iptables releases and allows
-    for rules which match against elements in netfilter's connection tracking
-    table. Shorewall automatically detects the availability of this extension
-    and reports its availability in the output of the start, restart and
-    check commands.<br>
-    <br>
-    Shorewall has detected the following iptables/netfilter capabilities:<br>
-    &nbsp; &nbsp;NAT: Available<br>
-    &nbsp; &nbsp;Packet Mangling: Available<br>
-    &nbsp; &nbsp;Multi-port Match: Available<br>
-    &nbsp; &nbsp;Connection Tracking Match: Available<br>
-    Verifying Configuration...<br>
-    <br>
-    If this extension is available, the ruleset generated by Shorewall is
-    changed in the following ways:</li>
-  <li
-  style="list-style-type: none; list-style-position: outside; list-style-image: none;"><ul>
-      <li>To handle 'norfc1918' filtering, Shorewall will not create chains
-        in the mangle table but will rather do all 'norfc1918' filtering in
-        the filter table (rfc1918 chain).</li>
-      <li>Recall that Shorewall DNAT rules generate two netfilter rules; one
-        in the nat table and one in the filter table. If the Connection
-        Tracking Match Extension is available, the rule in the filter table
-        is extended to check that the original destination address was the
-        same as specified (or defaulted to) in the DNAT rule.<br>
-        <br>
-      </li>
-    </ul>
-  </li>
-  <li>The shell used to interpret the firewall script
-    (/usr/share/shorewall/firewall) may now be specified using the
-    SHOREWALL_SHELL parameter in shorewall.conf.<br>
-  </li>
-</ol>
-
-<p><b>6/17/2003 - Shorewall-1.4.5</b></p>
-
-<p>Problems Corrected:<br>
-</p>
-<ol>
-  <li>The command "shorewall debug try &lt;directory&gt;" now correctly
-    traces the attempt.</li>
-  <li>The INCLUDE directive now works properly in the zones file; previously,
-    INCLUDE in that file was ignored.</li>
-  <li>/etc/shorewall/routestopped records with an empty second column are no
-    longer ignored.<br>
-  </li>
-</ol>
-
-<p>New Features:<br>
-</p>
-<ol>
-  <li>The ORIGINAL DEST column in a DNAT[-] or REDIRECT[-] rule may now
-    contain a list of addresses. If the list begins with "!' then the rule
-    will take effect only if the original destination address in the
-    connection request does not match any of the addresses listed.</li>
-</ol>
-
-<p><b>6/15/2003 - Shorewall, Kernel 2.4.21 and iptables 1.2.8</b></p>
-
-<p>The firewall at shorewall.net has been upgraded to the 2.4.21 kernel and
-iptables 1.2.8 (using the "official" RPM from netfilter.org). No problems
-have been encountered with this set of software. The Shorewall version is
-1.4.4b plus the accumulated changes for 1.4.5.<br>
-</p>
-
-<p><b>6/8/2003 - Updated Samples</b></p>
-
-<p>Thanks to Francesca Smith, the samples have been updated to Shorewall
-version 1.4.4.</p>
-
-<p><b>5/29/2003 - Shorewall-1.4.4b</b></p>
-
-<p>Groan -- This version corrects a problem whereby the --log-level was not
-being set when logging via syslog. The most commonly reported symptom was
-that Shorewall messages were being written to the console even though console
-logging was correctly configured per FAQ 16.<br>
-</p>
-
-<p><b>5/27/2003 - Shorewall-1.4.4a</b></p>
-The Fireparse --log-prefix fiasco continues. Tuomo Soini has pointed out that
-the code in 1.4.4 restricts the length of short zone names to 4 characters.
-I've produced version 1.4.4a that restores the previous 5-character limit by
-conditionally omitting the log rule number when the LOGFORMAT doesn't contain
-'%d'. <br>
-
-
-<p><b>5/23/2003 - Shorewall-1.4.4</b></p>
-I apologize for the rapid-fire releases but since there is a potential
-configuration change required to go from 1.4.3a to 1.4.4, I decided to make
-it a full release rather than just a bug-fix release. <br>
-<br>
-<b>&nbsp;&nbsp;&nbsp; Problems corrected:</b><br>
-
-
-<blockquote>
-  None.<br>
-</blockquote>
-<b>&nbsp;&nbsp;&nbsp; New Features:<br>
-</b> 
-<ol>
-  <li>A REDIRECT- rule target has been added. This target behaves for
-    REDIRECT in the same way as DNAT- does for DNAT in that the Netfilter nat
-    table REDIRECT rule is added but not the companion filter table ACCEPT
-    rule.<br>
-    <br>
-  </li>
-  <li>The LOGMARKER variable has been renamed LOGFORMAT and has been changed
-    to a 'printf' formatting template which accepts three arguments (the
-    chain name, logging rule number and the disposition). To use LOGFORMAT
-    with fireparse (<a
-    href="http://www.fireparse.com">http://www.fireparse.com</a>), set it
-    as:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LOGFORMAT="fp=%s:%d a=%s "<br>
-    &nbsp;<br>
-    <b>CAUTION:</b> /sbin/shorewall uses the leading part of the LOGFORMAT
-    string (up to but not including the first '%') to find log messages in
-    the 'show log', 'status' and 'hits' commands. This part should not be
-    omitted (the LOGFORMAT should not begin with "%") and the leading part
-    should be sufficiently unique for /sbin/shorewall to identify Shorewall
-    messages.<br>
-    <br>
-  </li>
-  <li>When logging is specified on a DNAT[-] or REDIRECT[-] rule, the logging
-    now takes place in the nat table rather than in the filter table. This
-    way, only those connections that actually undergo DNAT or redirection
-    will be logged.<br>
-  </li>
-</ol>
-
-<p><b>5/20/2003 - Shorewall-1.4.3a</b><br>
-</p>
-This version primarily corrects the documentation included in the .tgz and in
-the .rpm. In addition: <br>
-
-<ol>
-  <li>(This change is in 1.4.3 but is not documented) If you are running
-    iptables 1.2.7a and kernel 2.4.20, then Shorewall will return reject
-    replies as follows:<br>
-    &nbsp;&nbsp; a) tcp - RST<br>
-    &nbsp;&nbsp; b) udp - ICMP port unreachable<br>
-    &nbsp;&nbsp; c) icmp - ICMP host unreachable<br>
-    &nbsp;&nbsp; d) Otherwise - ICMP host prohibited<br>
-    If you are running earlier software, Shorewall will follow it's
-    traditional convention:<br>
-    &nbsp;&nbsp; a) tcp - RST<br>
-    &nbsp;&nbsp; b) Otherwise - ICMP port unreachable</li>
-  <li>UDP port 135 is now silently dropped in the common.def chain. Remember
-    that this chain is traversed just before a DROP or REJECT policy is
-    enforced.<br>
-  </li>
-</ol>
-
-<p><b>5/18/2003 - Shorewall 1.4.3</b><br>
-</p>
-&nbsp;&nbsp;&nbsp; <b>Problems Corrected:<br>
-</b> 
-<ol>
-  <li>There were several cases where Shorewall would fail to remove a
-    temporary directory from /tmp. These cases have been corrected.</li>
-  <li>The rules for allowing all traffic via the loopback interface have been
-    moved to before the rule that drops status=INVALID packets. This insures
-    that all loopback traffic is allowed even if Netfilter connection
-    tracking is confused.</li>
-</ol>
-&nbsp;&nbsp;&nbsp; <b>New Features:<br>
-</b> 
-<ol>
-  <li>&nbsp;IPV6-IPV4 (6to4) tunnels are now supported in the
-    /etc/shorewall/tunnels file.</li>
-  <li value="2">You may now change the leading portion of the --log-prefix
-    used by Shorewall using the LOGMARKER variable in shorewall.conf. By
-    default, "Shorewall:" is used.<br>
-  </li>
-</ol>
-
-<p><b>5/10/2003 - Shorewall Mirror in Asia<br>
-</b></p>
-
-<p>Ed Greshko has established a mirror in Taiwan -- Thanks Ed!<br>
-</p>
-
-<p><b>5/8/2003 - Shorewall Mirror in Chile</b></p>
-Thanks to Darcy Ganga, there is now an HTTP mirror in Santiago Chile. 
-
-<p><b>4/21/2003 - Samples updated for Shorewall version 1.4.2</b></p>
-
-<p>Thanks to Francesca Smith, the sample configurations are now upgraded to
-Shorewall version 1.4.2.</p>
-
-<p><b>4/9/2003 - Shorewall 1.4.2</b><br>
-</p>
-
-<p><b>&nbsp;&nbsp;&nbsp; Problems Corrected:</b></p>
-
-<blockquote>
-  <ol>
-    <li>TCP connection requests rejected out of the <b>common</b> chain are
-      now properly rejected with TCP RST; previously, some of these requests
-      were rejected with an ICMP port-unreachable response.</li>
-    <li>'traceroute -I' from behind the firewall previously timed out on the
-      first hop (e.g., to the firewall). This has been worked around.</li>
-  </ol>
-</blockquote>
-
-<p><b>&nbsp;&nbsp;&nbsp; New Features:</b></p>
-<ol>
-  <li>Where an entry in the/etc/shorewall/hosts file specifies a particular
-    host or network, Shorewall now creates an intermediate chain for handling
-    input from the related zone. This can substantially reduce the number of
-    rules traversed by connections requests from such zones.<br>
-    <br>
-  </li>
-  <li>Any file may include an INCLUDE directive. An INCLUDE directive
-    consists of the word INCLUDE followed by a file name and causes the
-    contents of the named file to be logically included into the file
-    containing the INCLUDE. File names given in an INCLUDE directive are
-    assumed to reside in /etc/shorewall or in an alternate configuration
-    directory if one has been specified for the command.<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; Examples:<br>
-    &nbsp;&nbsp; shorewall/params.mgmt:<br>
-    &nbsp;&nbsp; MGMT_SERVERS=1.1.1.1,2.2.2.2,3.3.3.3<br>
-    &nbsp;&nbsp; TIME_SERVERS=4.4.4.4<br>
-    &nbsp;&nbsp; BACKUP_SERVERS=5.5.5.5<br>
-    &nbsp;&nbsp; ----- end params.mgmt -----<br>
-    &nbsp;<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; shorewall/params:<br>
-    &nbsp;&nbsp; # Shorewall 1.3 /etc/shorewall/params<br>
-    &nbsp;&nbsp; [..]<br>
-    &nbsp;&nbsp; #######################################<br>
-    &nbsp;<br>
-    &nbsp; &nbsp;INCLUDE params.mgmt&nbsp;&nbsp;&nbsp;<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; # params unique to this host here<br>
-    &nbsp;&nbsp; #LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT
-    REMOVE<br>
-    &nbsp;&nbsp; ----- end params -----<br>
-    &nbsp;<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; shorewall/rules.mgmt:<br>
-    &nbsp;&nbsp; ACCEPT
-    net:$MGMT_SERVERS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    $FW&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp; 22<br>
-    &nbsp;&nbsp; ACCEPT
-    $FW&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    net:$TIME_SERVERS&nbsp;&nbsp;&nbsp; udp&nbsp;&nbsp;&nbsp; 123<br>
-    &nbsp;&nbsp; ACCEPT
-    $FW&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-    net:$BACKUP_SERVERS&nbsp; tcp&nbsp;&nbsp;&nbsp; 22<br>
-    &nbsp;&nbsp; ----- end rules.mgmt -----<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; shorewall/rules:<br>
-    &nbsp;&nbsp; # Shorewall version 1.3 - Rules File<br>
-    &nbsp;&nbsp; [..]<br>
-    &nbsp;&nbsp; #######################################<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; INCLUDE rules.mgmt&nbsp;&nbsp;&nbsp;&nbsp;<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; # rules unique to this host here<br>
-    &nbsp;&nbsp; #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT
-    REMOVE<br>
-    &nbsp;&nbsp; ----- end rules -----<br>
-    &nbsp;<br>
-    INCLUDE's may be nested to a level of 3 -- further nested INCLUDE
-    directives are ignored with a warning message.<br>
-    <br>
-  </li>
-  <li>Routing traffic from an interface back out that interface continues to
-    be a problem. While I firmly believe that this should never happen,
-    people continue to want to do it. To limit the damage that such nonsense
-    produces, I have added a new 'routeback' option in
-    /etc/shorewall/interfaces and /etc/shorewall/hosts. When used in
-    /etc/shorewall/interfaces, the 'ZONE' column may not contain '-'; in
-    other words, 'routeback' can't be used as an option for a multi-zone
-    interface. The 'routeback' option CAN be specified however on individual
-    group entries in /etc/shorewall/hosts.<br>
-    &nbsp;<br>
-    The 'routeback' option is similar to the old 'multi' option with two
-    exceptions:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; a) The option pertains to a particular
-    zone,interface,address tuple.<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; b) The option only created infrastructure to pass traffic
-    from (zone,interface,address) tuples back to themselves (the 'multi'
-    option affected all (zone,interface,address) tuples associated with the
-    given 'interface').<br>
-    &nbsp;<br>
-    See the '<a href="upgrade_issues.htm">Upgrade Issues</a>' for information
-    about how this new option may affect your configuration.<br>
-  </li>
-</ol>
-
-<p><b>3/24/2003 - Shorewall 1.4.1</b></p>
-
-<p>This release follows up on 1.4.0. It corrects a problem introduced in
-1.4.0 and removes additional warts.<br>
-<br>
-<b>Problems Corrected:</b><br>
-</p>
-<ol>
-  <li>When Shorewall 1.4.0 is run under the ash shell (such as on
-    Bering/LEAF), it can attempt to add ECN disabling rules even if the
-    /etc/shorewall/ecn file is empty. That problem has been corrected so that
-    ECN disabling rules are only added if there are entries in
-    /etc/shorewall/ecn.</li>
-</ol>
-<b>New Features:</b><br>
-
-
-<blockquote>
-  Note: In the list that follows, the term <i>group</i> refers to a
-  particular network or subnetwork (which may be 0.0.0.0/0 or it may be a
-  host address) accessed through a particular interface. Examples:<br>
-
-
-  <blockquote>
-    eth0:0.0.0.0/0<br>
-    eth2:192.168.1.0/24<br>
-    eth3:192.0.2.123<br>
-  </blockquote>
-  You can use the "shorewall check" command to see the groups associated with
-  each of your zones.<br>
-</blockquote>
-<ol>
-  <li>Beginning with Shorewall 1.4.1, if a zone Z comprises more than one
-    group then if there is no explicit Z to Z policy and there are no rules
-    governing traffic from Z to Z then Shorewall will permit all traffic
-    between the groups in the zone.</li>
-  <li>Beginning with Shorewall 1.4.1, Shorewall will never create rules to
-    handle traffic from a group to itself.</li>
-  <li>A NONE policy is introduced in 1.4.1. When a policy of NONE is
-    specified from Z1 to Z2:</li>
-</ol>
-<ul>
-  <li>There may be no rules created that govern connections from Z1 to
-  Z2.</li>
-  <li>Shorewall will not create any infrastructure to handle traffic from Z1
-    to Z2.</li>
-</ul>
-See the <a href="upgrade_issues.htm">upgrade issues</a> for a discussion of
-how these changes may affect your configuration. 
-
-<p><b>3/17/2003 - Shorewall 1.4.0</b></p>
-Shorewall 1.4 represents the next step in the evolution of Shorewall. The
-main thrust of the initial release is simply to remove the cruft that has
-accumulated in Shorewall over time. <br>
-<br>
-<b>IMPORTANT: Shorewall 1.4.0 requires</b> <b>the iproute package ('ip'
-utility).</b><br>
-<br>
-Function from 1.3 that has been omitted from this version include:<br>
-
-<ol>
-  <li>The MERGE_HOSTS variable in shorewall.conf is no longer supported.
-    Shorewall 1.4 behavior is the same as 1.3 with MERGE_HOSTS=Yes.<br>
-    <br>
-  </li>
-  <li>Interface names of the form &lt;device&gt;:&lt;integer&gt; in
-    /etc/shorewall/interfaces now generate an error.<br>
-    <br>
-  </li>
-  <li>Shorewall 1.4 implements behavior consistent with OLD_PING_HANDLING=No.
-    OLD_PING_HANDLING=Yes will generate an error at startup as will
-    specification of the 'noping' or 'filterping' interface options.<br>
-    <br>
-  </li>
-  <li>The 'routestopped' option in the /etc/shorewall/interfaces and
-    /etc/shorewall/hosts files is no longer supported and will generate an
-    error at startup if specified.<br>
-    <br>
-  </li>
-  <li>The Shorewall 1.2 syntax for DNAT and REDIRECT rules is no longer
-    accepted.<br>
-    <br>
-  </li>
-  <li>The ALLOWRELATED variable in shorewall.conf is no longer supported.
-    Shorewall 1.4 behavior is the same as 1.3 with ALLOWRELATED=Yes.<br>
-    <br>
-  </li>
-  <li>The icmp.def file has been removed.<br>
-  </li>
-</ol>
-Changes for 1.4 include:<br>
-
-<ol>
-  <li>The /etc/shorewall/shorewall.conf file has been completely reorganized
-    into logical sections.<br>
-    <br>
-  </li>
-  <li>LOG is now a valid action for a rule (/etc/shorewall/rules).<br>
-    <br>
-  </li>
-  <li>The firewall script and version file are now installed in
-    /usr/share/shorewall.<br>
-    <br>
-  </li>
-  <li>Late arriving DNS replies are now silently dropped in the common chain
-    by default.<br>
-    <br>
-  </li>
-  <li>In addition to behaving like OLD_PING_HANDLING=No, Shorewall 1.4 no
-    longer unconditionally accepts outbound ICMP packets. So if you want to
-    'ping' from the firewall, you will need the appropriate rule or
-    policy.<br>
-    <br>
-  </li>
-  <li>CONTINUE is now a valid action for a rule (/etc/shorewall/rules).<br>
-    <br>
-  </li>
-  <li>802.11b devices with names of the form wlan&lt;n&gt; now support the
-    'maclist' option.<br>
-    <br>
-  </li>
-  <li>Explicit Congestion Notification (ECN - RFC 3168) may now be turned off
-    on a host or network basis using the new /etc/shorewall/ecn file. To use
-    this facility:<br>
-    <br>
-    &nbsp;&nbsp; a) You must be running kernel 2.4.20<br>
-    &nbsp;&nbsp; b) You must have applied the patch in<br>
-    &nbsp;&nbsp; http://www.shorewall/net/pub/shorewall/ecn/patch.<br>
-    &nbsp;&nbsp; c) You must have iptables 1.2.7a installed.<br>
-    <br>
-  </li>
-  <li>The /etc/shorewall/params file is now processed first so that variables
-    may be used in the /etc/shorewall/shorewall.conf file.<br>
-    <br>
-  </li>
-  <li value="10">Shorewall now gives a more helpful diagnostic when the
-    'ipchains' compatibility kernel module is loaded and a 'shorewall start'
-    command is issued.<br>
-    <br>
-  </li>
-  <li>The SHARED_DIR variable has been removed from shorewall.conf. This
-    variable was for use by package maintainers and was not documented for
-    general use.<br>
-    <br>
-  </li>
-  <li>Shorewall now ignores 'default' routes when detecting masq'd
-  networks.</li>
-</ol>
-
-<p><b>3/10/2003 - Shoreall 1.3.14a</b></p>
-
-<p>A roleup of the following bug fixes and other updates:</p>
-<ul>
-  <li>There is an updated rfc1918 file that reflects the resent allocation of
-    222.0.0.0/8 and 223.0.0.0/8.</li>
-</ul>
-<ul>
-  <li>The documentation for the routestopped file claimed that a
-    comma-separated list could appear in the second column while the code
-    only supported a single host or network address.</li>
-  <li>Log messages produced by 'logunclean' and 'dropunclean' were not
-    rate-limited.</li>
-  <li>802.11b devices with names of the form <i>wlan</i>&lt;n&gt; don't
-    support the 'maclist' interface option.</li>
-  <li>Log messages generated by RFC 1918 filtering are not rate limited.</li>
-  <li>The firewall fails to start in the case where you have "eth0 eth1" in
-    /etc/shorewall/masq and the default route is through eth1</li>
-</ul>
-
-<p><b>2/8/2003 - Shoreawall 1.3.14</b></p>
-
-<p>New features include</p>
-<ol>
-  <li>An OLD_PING_HANDLING option has been added to shorewall.conf. When set
-    to Yes, Shorewall ping handling is as it has always been (see
-    http://www.shorewall.net/ping.html).<br>
-    <br>
-    When OLD_PING_HANDLING=No, icmp echo (ping) is handled via rules and
-    policies just like any other connection request. The FORWARDPING=Yes
-    option in shorewall.conf and the 'noping' and 'filterping' options in
-    /etc/shorewall/interfaces will all generate an error.<br>
-    <br>
-  </li>
-  <li>It is now possible to direct Shorewall to create a "label" such
-    as&nbsp; "eth0:0" for IP addresses that it creates under
-    ADD_IP_ALIASES=Yes and ADD_SNAT_ALIASES=Yes. This is done by specifying
-    the label instead of just the interface name:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; a) In the INTERFACE column of /etc/shorewall/masq<br>
-    &nbsp;&nbsp; b) In the INTERFACE column of /etc/shorewall/nat<br>
-    &nbsp;</li>
-  <li>Support for OpenVPN Tunnels.<br>
-    <br>
-  </li>
-  <li>Support for VLAN devices with names of the form $DEV.$VID (e.g.,
-    eth0.0)<br>
-    <br>
-  </li>
-  <li>In /etc/shorewall/tcrules, the MARK value may be optionally followed by
-    ":" and either 'F' or 'P' to designate that the marking will occur in the
-    FORWARD or PREROUTING chains respectively. If this additional
-    specification is omitted, the chain used to mark packets will be
-    determined by the setting of the MARK_IN_FORWARD_CHAIN option in <a
-    href="Documentation.htm#Conf">shorewall.conf</a>.<br>
-    <br>
-  </li>
-  <li>When an interface name is entered in the SUBNET column of the
-    /etc/shorewall/masq file, Shorewall previously masqueraded traffic from
-    only the first subnet defined on that interface. It did not masquerade
-    traffic from:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; a) The subnets associated with other addresses on the
-    interface.<br>
-    &nbsp;&nbsp; b) Subnets accessed through local routers.<br>
-    &nbsp;<br>
-    Beginning with Shorewall 1.3.14, if you enter an interface name in the
-    SUBNET column, shorewall will use the firewall's routing table to
-    construct the masquerading/SNAT rules.<br>
-    &nbsp;<br>
-    Example 1 -- This is how it works in 1.3.14.<br>
-    &nbsp;&nbsp;<br>
-
-    <pre>   [root@gateway test]# cat /etc/shorewall/masq<br>
-   #INTERFACE              SUBNET                  ADDRESS<br>
-   eth0                    eth2                    206.124.146.176<br>
-   #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
-    <pre>   [root@gateway test]# ip route show dev eth2<br>
-   192.168.1.0/24  scope link<br>
-   192.168.10.0/24  proto kernel  scope link  src 192.168.10.254<br>
- </pre>
-    <pre>   [root@gateway test]# shorewall start<br>
-   ...<br>
-   Masqueraded Subnets and Hosts:<br>
-       To 0.0.0.0/0 from 192.168.1.0/24 through eth0 using 206.124.146.176<br>
-       To 0.0.0.0/0 from 192.168.10.0/24 through eth0 using 206.124.146.176<br>
-   Processing /etc/shorewall/tos...</pre>
-    &nbsp;<br>
-    When upgrading to Shorewall 1.3.14, if you have multiple local subnets
-    connected to an interface that is specified in the SUBNET column of an
-    /etc/shorewall/masq entry, your /etc/shorewall/masq file will need
-    changing. In most cases, you will simply be able to remove redundant
-    entries. In some cases though, you might want to change from using the
-    interface name to listing specific subnetworks if the change described
-    above will cause masquerading to occur on subnetworks that you don't wish
-    to masquerade.<br>
-    &nbsp;<br>
-    Example 2 -- Suppose that your current config is as follows:<br>
-    &nbsp;&nbsp;<br>
-
-    <pre>   [root@gateway test]# cat /etc/shorewall/masq<br>
-   #INTERFACE              SUBNET                  ADDRESS<br>
-   eth0                    eth2                    206.124.146.176<br>
-   eth0                    192.168.10.0/24         206.124.146.176<br>
-   #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
-    <pre>   [root@gateway test]# ip route show dev eth2<br>
-   192.168.1.0/24  scope link<br>
-   192.168.10.0/24  proto kernel  scope link  src 192.168.10.254<br>
-   [root@gateway test]#</pre>
-    &nbsp;<br>
-    &nbsp;&nbsp; In this case, the second entry in /etc/shorewall/masq is no
-    longer required.<br>
-    &nbsp;<br>
-    Example 3 -- What if your current configuration is like this?<br>
-    &nbsp;<br>
-
-    <pre>   [root@gateway test]# cat /etc/shorewall/masq<br>
-   #INTERFACE              SUBNET                  ADDRESS<br>
-   eth0                    eth2                    206.124.146.176<br>
-   #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
-    <pre>   [root@gateway test]# ip route show dev eth2<br>
-   192.168.1.0/24  scope link<br>
-   192.168.10.0/24  proto kernel  scope link  src 192.168.10.254<br>
-   [root@gateway test]#</pre>
-    &nbsp;<br>
-    &nbsp;&nbsp; In this case, you would want to change the entry in&nbsp;
-    /etc/shorewall/masq to:<br>
-
-    <pre>   #INTERFACE              SUBNET                  ADDRESS<br>
-   eth0                    192.168.1.0/24          206.124.146.176<br>
-   #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
-  </li>
-</ol>
-
-<p><br>
-<b>2/5/2003 - Shorewall Support included in Webmin 1.060</b></p>
-
-<p>Webmin version 1.060 now has Shorewall support included as standard. See
-<a href="http://www.webmin.com">http://www.webmin.com</a>.<br>
-<b><br>
-2/4/2003 - Shorewall 1.3.14-RC1</b></p>
-
-<p>Includes the Beta 2 content plus support for OpenVPN tunnels.</p>
-
-<p><b>1/28/2003 - Shorewall 1.3.14-Beta2</b></p>
-
-<p>Includes the Beta 1 content plus restores VLAN device names of the form
-$dev.$vid (e.g., eth0.1)</p>
-
-<p><b>1/25/2003 - Shorewall 1.3.14-Beta1</b><br>
-</p>
-
-<p>The Beta includes the following changes:<br>
-</p>
-<ol>
-  <li>An OLD_PING_HANDLING option has been added to shorewall.conf. When set
-    to Yes, Shorewall ping handling is as it has always been (see
-    http://www.shorewall.net/ping.html).<br>
-    <br>
-    When OLD_PING_HANDLING=No, icmp echo (ping) is handled via rules and
-    policies just like any other connection request. The FORWARDPING=Yes
-    option in shorewall.conf and the 'noping' and 'filterping' options in
-    /etc/shorewall/interfaces will all generate an error.<br>
-    <br>
-  </li>
-  <li>It is now possible to direct Shorewall to create a "label" such
-    as&nbsp; "eth0:0" for IP addresses that it creates under
-    ADD_IP_ALIASES=Yes and ADD_SNAT_ALIASES=Yes. This is done by specifying
-    the label instead of just the interface name:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; a) In the INTERFACE column of /etc/shorewall/masq<br>
-    &nbsp;&nbsp; b) In the INTERFACE column of /etc/shorewall/nat<br>
-    &nbsp;</li>
-  <li>When an interface name is entered in the SUBNET column of the
-    /etc/shorewall/masq file, Shorewall previously masqueraded traffic from
-    only the first subnet defined on that interface. It did not masquerade
-    traffic from:<br>
-    &nbsp;<br>
-    &nbsp;&nbsp; a) The subnets associated with other addresses on the
-    interface.<br>
-    &nbsp;&nbsp; b) Subnets accessed through local routers.<br>
-    &nbsp;<br>
-    Beginning with Shorewall 1.3.14, if you enter an interface name in the
-    SUBNET column, shorewall will use the firewall's routing table to
-    construct the masquerading/SNAT rules.<br>
-    &nbsp;<br>
-    Example 1 -- This is how it works in 1.3.14.<br>
-    &nbsp;&nbsp;<br>
-
-    <pre>   [root@gateway test]# cat /etc/shorewall/masq<br>
-   #INTERFACE              SUBNET                  ADDRESS<br>
-   eth0                    eth2                    206.124.146.176<br>
-   #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
-    <pre>   [root@gateway test]# ip route show dev eth2<br>
-   192.168.1.0/24  scope link<br>
-   192.168.10.0/24  proto kernel  scope link  src 192.168.10.254<br>
- </pre>
-    <pre>   [root@gateway test]# shorewall start<br>
-   ...<br>
-   Masqueraded Subnets and Hosts:<br>
-       To 0.0.0.0/0 from 192.168.1.0/24 through eth0 using 206.124.146.176<br>
-       To 0.0.0.0/0 from 192.168.10.0/24 through eth0 using 206.124.146.176<br>
-   Processing /etc/shorewall/tos...</pre>
-    &nbsp;<br>
-    When upgrading to Shorewall 1.3.14, if you have multiple local subnets
-    connected to an interface that is specified in the SUBNET column of an
-    /etc/shorewall/masq entry, your /etc/shorewall/masq file will need
-    changing. In most cases, you will simply be able to remove redundant
-    entries. In some cases though, you might want to change from using the
-    interface name to listing specific subnetworks if the change described
-    above will cause masquerading to occur on subnetworks that you don't wish
-    to masquerade.<br>
-    &nbsp;<br>
-    Example 2 -- Suppose that your current config is as follows:<br>
-    &nbsp;&nbsp;<br>
-
-    <pre>   [root@gateway test]# cat /etc/shorewall/masq<br>
-   #INTERFACE              SUBNET                  ADDRESS<br>
-   eth0                    eth2                    206.124.146.176<br>
-   eth0                    192.168.10.0/24         206.124.146.176<br>
-   #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
-    <pre>   [root@gateway test]# ip route show dev eth2<br>
-   192.168.1.0/24  scope link<br>
-   192.168.10.0/24  proto kernel  scope link  src 192.168.10.254<br>
-   [root@gateway test]#</pre>
-    &nbsp;<br>
-    &nbsp;&nbsp; In this case, the second entry in /etc/shorewall/masq is no
-    longer required.<br>
-    &nbsp;<br>
-    Example 3 -- What if your current configuration is like this?<br>
-    &nbsp;<br>
-
-    <pre>   [root@gateway test]# cat /etc/shorewall/masq<br>
-   #INTERFACE              SUBNET                  ADDRESS<br>
-   eth0                    eth2                    206.124.146.176<br>
-   #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
-    <pre>   [root@gateway test]# ip route show dev eth2<br>
-   192.168.1.0/24  scope link<br>
-   192.168.10.0/24  proto kernel  scope link  src 192.168.10.254<br>
-   [root@gateway test]#</pre>
-    &nbsp;<br>
-    &nbsp;&nbsp; In this case, you would want to change the entry in&nbsp;
-    /etc/shorewall/masq to:<br>
-
-    <pre>   #INTERFACE              SUBNET                  ADDRESS<br>
-   eth0                    192.168.1.0/24          206.124.146.176<br>
-   #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
-  </li>
-</ol>
-
-<p><b>1/18/2003 - Shorewall 1.3.13 Documentation in PDF Format</b></p>
-
-<p>Juraj Ontkanin has produced a PDF containing the Shorewall 1.3.13
-documenation. the PDF may be downloaded from</p>
-&nbsp;&nbsp;&nbsp; <a
-href="ftp://slovakia.shorewall.net/mirror/shorewall/pdf/"
-target="_self">ftp://slovakia.shorewall.net/mirror/shorewall/pdf/</a><br>
-&nbsp;&nbsp;&nbsp; <a
-href="http://slovakia.shorewall.net/pub/shorewall/pdf/">http://slovakia.shorewall.net/pub/shorewall/pdf/</a> 
-
-<p><b>1/17/2003 - shorewall.net has MOVED</b><b>&nbsp;</b></p>
-
-<p>Thanks to the generosity of Alex Martin and <a
-href="http://www.rettc.com">Rett Consulting</a>, www.shorewall.net and
-ftp.shorewall.net are now hosted on a system in Bellevue, Washington. A big
-thanks to Alex for making this happen.<br>
-</p>
-
-<p><b>1/13/2003 - Shorewall 1.3.13<br>
-</b></p>
-
-<p>Just includes a few things that I had on the burner:<br>
-</p>
-<ol>
-  <li>A new 'DNAT-' action has been added for entries in the
-    /etc/shorewall/rules file. DNAT- is intended for advanced users who wish
-    to minimize the number of rules that connection requests must
-    traverse.<br>
-    <br>
-    A Shorewall DNAT rule actually generates two iptables rules: a header
-    rewriting rule in the 'nat' table and an ACCEPT rule in the 'filter'
-    table. A DNAT- rule only generates the first of these rules. This is
-    handy when you have several DNAT rules that would generate the same
-    ACCEPT rule.<br>
-    <br>
-    &nbsp;&nbsp; Here are three rules from my previous rules file:<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DNAT&nbsp;&nbsp; net&nbsp;
-    dmz:206.124.146.177 tcp smtp - 206.124.146.178<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DNAT&nbsp;&nbsp; net&nbsp;
-    dmz:206.124.146.177 tcp smtp - 206.124.146.179<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ACCEPT net&nbsp;
-    dmz:206.124.146.177 tcp www,smtp,ftp,...<br>
-    <br>
-    &nbsp;&nbsp; These three rules ended up generating _three_ copies of<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ACCEPT net&nbsp;
-    dmz:206.124.146.177 tcp smtp<br>
-    <br>
-    &nbsp;&nbsp; By writing the rules this way, I end up with only one copy
-    of the ACCEPT rule.<br>
-    <br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DNAT-&nbsp; net&nbsp;
-    dmz:206.124.146.177 tcp smtp -&nbsp; 206.124.146.178<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DNAT-&nbsp; net&nbsp;
-    dmz:206.124.146.177 tcp smtp -&nbsp; 206.124.146.179<br>
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ACCEPT net&nbsp;
-    dmz:206.124.146.177 tcp www,smtp,ftp,....<br>
-    <br>
-  </li>
-  <li>The 'shorewall check' command now prints out the applicable policy
-    between each pair of zones.<br>
-    <br>
-  </li>
-  <li>A new CLEAR_TC option has been added to shorewall.conf. If this option
-    is set to 'No' then Shorewall won't clear the current traffic control
-    rules during [re]start. This setting is intended for use by people that
-    prefer to configure traffic shaping when the network interfaces come up
-    rather than when the firewall is started. If that is what you want to do,
-    set TC_ENABLED=Yes and CLEAR_TC=No and do not supply an
-    /etc/shorewall/tcstart file. That way, your traffic shaping rules can
-    still use the 'fwmark' classifier based on packet marking defined in
-    /etc/shorewall/tcrules.<br>
-    <br>
-  </li>
-  <li>A new SHARED_DIR variable has been added that allows distribution
-    packagers to easily move the shared directory (default
-    /usr/lib/shorewall). Users should never have a need to change the value
-    of this shorewall.conf setting.<br>
-  </li>
-</ol>
-
-<p><b>1/6/2003 - <big><big><big>BURNOUT</big></big></big></b></p>
-
-<p><b>Until further notice, I will not be involved in either Shorewall
-Development or Shorewall Support</b></p>
-
-<p><b>-Tom Eastep</b><br>
-</p>
-
-<p><b>12/30/2002 - Shorewall Documentation in PDF Format</b></p>
-
-<p>Juraj Ontkanin has produced a PDF containing the Shorewall 1.3.12
-documenation. the PDF may be downloaded from</p>
-
-<p>&nbsp;&nbsp;&nbsp; <a
-href="ftp://slovakia.shorewall.net/mirror/shorewall/pdf/"
-target="_self">ftp://slovakia.shorewall.net/mirror/shorewall/pdf/</a><br>
-&nbsp;&nbsp;&nbsp; <a
-href="http://slovakia.shorewall.net/pub/shorewall/pdf/">http://slovakia.shorewall.net/pub/shorewall/pdf/</a><br>
-</p>
-
-<p><b>12/27/2002 - Shorewall 1.3.12 Released</b></p>
-
-<p>Features include:<br>
-</p>
-<ol>
-  <li>"shorewall refresh" now reloads the traffic shaping rules (tcrules and
-    tcstart).</li>
-  <li>"shorewall debug [re]start" now turns off debugging after an error
-    occurs. This places the point of the failure near the end of the trace
-    rather than up in the middle of it.</li>
-  <li>"shorewall [re]start" has been speeded up by more than 40% with my
-    configuration. Your milage may vary.</li>
-  <li>A "shorewall show classifiers" command has been added which shows the
-    current packet classification filters. The output from this command is
-    also added as a separate page in "shorewall monitor"</li>
-  <li>ULOG (must be all caps) is now accepted as a valid syslog level and
-    causes the subject packets to be logged using the ULOG target rather than
-    the LOG target. This allows you to run ulogd (available from <a
-    href="http://www.netfilter.org/projects/ulogd/index.html">http://www.netfilter.org/projects/ulogd/index.html</a>)
-    and log all Shorewall messages <a href="shorewall_logging.html">to a
-    separate log file</a>.</li>
-  <li>If you are running a kernel that has a FORWARD chain in the mangle
-    table ("shorewall show mangle" will show you the chains in the mangle
-    table), you can set MARK_IN_FORWARD_CHAIN=Yes in <a
-    href="Documentation.htm#Conf">shorewall.conf</a>. This allows for marking
-    input packets based on their destination even when you are using
-    Masquerading or SNAT.</li>
-  <li>I have cluttered up the /etc/shorewall directory with empty 'init',
-    'start', 'stop' and 'stopped' files. If you already have a file with one
-    of these names, don't worry -- the upgrade process won't overwrite your
-    file.</li>
-  <li>I have added a new RFC1918_LOG_LEVEL variable to <a
-    href="Documentation.htm#Conf">shorewall.conf</a>. This variable specifies
-    the syslog level at which packets are logged as a result of entries in
-    the /etc/shorewall/rfc1918 file. Previously, these packets were always
-    logged at the 'info' level.<br>
-  </li>
-</ol>
-
-<p><b>12/20/2002 - Shorewall 1.3.12 Beta 3<br>
-</b></p>
-This version corrects a problem with Blacklist logging. In Beta 2, if
-BLACKLIST_LOG_LEVEL was set to anything but ULOG, the firewall would fail to
-start and "shorewall refresh" would also fail.<br>
-
-
-<p><b>12/20/2002 - Shorewall 1.3.12 Beta 2</b></p>
-
-<p>The first public Beta version of Shorewall 1.3.12 is now available (Beta 1
-was made available only to a limited audience).<br>
-</p>
-Features include:<br>
-
-<ol>
-  <li>"shorewall refresh" now reloads the traffic shaping rules (tcrules and
-    tcstart).</li>
-  <li>"shorewall debug [re]start" now turns off debugging after an error
-    occurs. This places the point of the failure near the end of the trace
-    rather than up in the middle of it.</li>
-  <li>"shorewall [re]start" has been speeded up by more than 40% with my
-    configuration. Your milage may vary.</li>
-  <li>A "shorewall show classifiers" command has been added which shows the
-    current packet classification filters. The output from this command is
-    also added as a separate page in "shorewall monitor"</li>
-  <li>ULOG (must be all caps) is now accepted as a valid syslog level and
-    causes the subject packets to be logged using the ULOG target rather than
-    the LOG target. This allows you to run ulogd (available from <a
-    href="http://www.netfilter.org/projects/ulogd/index.html">http://www.netfilter.org/projects/ulogd/index.html</a>)
-    and log all Shorewall messages <a href="shorewall_logging.html">to a
-    separate log file</a>.</li>
-  <li>If you are running a kernel that has a FORWARD chain in the mangle
-    table ("shorewall show mangle" will show you the chains in the mangle
-    table), you can set MARK_IN_FORWARD_CHAIN=Yes in shorewall.conf. This
-    allows for marking input packets based on their destination even when you
-    are using Masquerading or SNAT.</li>
-  <li>I have cluttered up the /etc/shorewall directory with empty 'init',
-    'start', 'stop' and 'stopped' files. If you already have a file with one
-    of these names, don't worry -- the upgrade process won't overwrite your
-    file.</li>
-</ol>
-You may download the Beta from:<br>
-
-
-<blockquote>
-  <a
-  href="http://www.shorewall.net/pub/shorewall/Beta">http://www.shorewall.net/pub/shorewall/Beta</a><br>
-  <a href="ftp://ftp.shorewall.net/pub/shorewall/Beta"
-  target="_top">ftp://ftp.shorewall.net/pub/shorewall/Beta</a><br>
-</blockquote>
-
-<p><b>12/12/2002 - Mandrake Multi Network Firewall <a
-href="http://www.mandrakesoft.com"><img src="images/logo2.png"
-alt="Powered by Mandrake Linux" border="0" height="21" width="140" />
-</a></b></p>
-Shorewall is at the center of MandrakeSoft's recently-announced <a
-href="http://www.mandrakestore.com/mdkinc/index.php?PAGE=tab_0/menu_0.php&amp;id_art=250&amp;LANG_=en#GOTO_250">Multi
-Network Firewall (MNF)</a> product. Here is the <a
-href="http://www.mandrakesoft.com/company/press/pr?n=/pr/products/2403">press
-release</a>.<br>
-
-
-<p><b>12/7/2002 - Shorewall Support for Mandrake 9.0</b></p>
-
-<p>Two months and 3 days after I ordered Mandrake 9.0, it was finally
-delivered. I have installed 9.0 on one of my systems and I am now in a
-position to support Shorewall users who run Mandrake 9.0.</p>
-
-<p><b>12/6/2002 - Debian 1.3.11a Packages Available<br>
-</b></p>
-
-<p>Apt-get sources listed at <a
-href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html.</a></p>
-
-<p><b>12/3/2002 - Shorewall 1.3.11a</b></p>
-
-<p>This is a bug-fix roll up which includes Roger Aich's fix for DNAT with
-excluded subnets (e.g., "DNAT foo!bar ..."). Current 1.3.11 users who don't
-need rules of this type need not upgrade to 1.3.11.</p>
-
-<p><b>11/24/2002 - Shorewall 1.3.11</b></p>
-
-<p>In this version:</p>
-<ul>
-  <li>A 'tcpflags' option has been added to entries in <a
-    href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>. This
-    option causes Shorewall to make a set of sanity check on TCP packet
-    header flags.</li>
-  <li>It is now allowed to use 'all' in the SOURCE or DEST column in a <a
-    href="Documentation.htm#Rules">rule</a>. When used, 'all' must appear by
-    itself (in may not be qualified) and it does not enable intra-zone
-    traffic. For example, the rule<br>
-    <br>
-    &nbsp; &nbsp; ACCEPT loc all tcp 80<br>
-    <br>
-    does not enable http traffic from 'loc' to 'loc'.</li>
-  <li>Shorewall's use of the 'echo' command is now compatible with bash
-    clones such as ash and dash.</li>
-  <li>fw-&gt;fw policies now generate a startup error. fw-&gt;fw rules
-    generate a warning and are ignored</li>
-</ul>
-
-<p><b>11/14/2002 - Shorewall Documentation in PDF Format</b></p>
-
-<p>Juraj Ontkanin has produced a PDF containing the Shorewall 1.3.10
-documenation. the PDF may be downloaded from</p>
-
-<p>&nbsp;&nbsp;&nbsp; <a
-href="ftp://slovakia.shorewall.net/mirror/shorewall/pdf/"
-target="_self">ftp://slovakia.shorewall.net/mirror/shorewall/pdf/</a><br>
-&nbsp;&nbsp;&nbsp; <a
-href="http://slovakia.shorewall.net/pub/shorewall/pdf/">http://slovakia.shorewall.net/pub/shorewall/pdf/</a><br>
-</p>
-
-<p><b>11/09/2002 - Shorewall is Back at SourceForge</b></p>
-
-<p>The main Shorewall 1.3 web site is now back at SourceForge at <a
-href="http://shorewall.sf.net" target="_top">http://shorewall.sf.net</a>.<br>
-</p>
-
-<p><b>11/09/2002 - Shorewall 1.3.10</b></p>
-
-<p>In this version:</p>
-<ul>
-  <li>You may now <a href="IPSEC.htm#Dynamic">define the contents of a zone
-    dynamically</a> with the <a
-    href="starting_and_stopping_shorewall.htm">"shorewall add" and "shorewall
-    delete" commands</a>. These commands are expected to be used primarily
-    within <a href="http://www.xs4all.nl/%7Efreeswan/">FreeS/Wan</a> updown
-    scripts.</li>
-  <li>Shorewall can now do <a href="MAC_Validation.html">MAC verification</a>
-    on ethernet segments. You can specify the set of allowed MAC addresses on
-    the segment and you can optionally tie each MAC address to one or more IP
-    addresses.</li>
-  <li>PPTP Servers and Clients running on the firewall system may now be
-    defined in the <a href="PPTP.htm">/etc/shorewall/tunnels</a> file.</li>
-  <li>A new 'ipsecnat' tunnel type is supported for use when the <a
-    href="IPSEC.htm">remote IPSEC endpoint is behind a NAT gateway</a>.</li>
-  <li>The PATH used by Shorewall may now be specified in <a
-    href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf.</a></li>
-  <li>The main firewall script is now /usr/lib/shorewall/firewall. The script
-    in /etc/init.d/shorewall is very small and uses /sbin/shorewall to do the
-    real work. This change makes custom distributions such as for Debian and
-    for Gentoo easier to manage since it is /etc/init.d/shorewall that tends
-    to have distribution-dependent code</li>
-</ul>
-
-<p><b>10/24/2002 - Shorewall is now in Gentoo Linux</b> <a
-href="http://www.gentoo.org"><br>
-</a></p>
-Alexandru Hartmann reports that his Shorewall package is now a part of <a
-href="http://www.gentoo.org">the Gentoo Linux distribution</a>. Thanks
-Alex!<br>
-
-
-<p><b>10/23/2002 - Shorewall 1.3.10 Beta 1</b></p>
-In this version:<br>
-
-<ul>
-  <li>You may now <a href="IPSEC.htm#Dynamic">define the contents of a zone
-    dynamically</a> with the <a
-    href="starting_and_stopping_shorewall.htm">"shorewall add" and "shorewall
-    delete" commands</a>. These commands are expected to be used primarily
-    within <a href="http://www.xs4all.nl/%7Efreeswan/">FreeS/Wan</a> updown
-    scripts.</li>
-  <li>Shorewall can now do <a href="MAC_Validation.html">MAC verification</a>
-    on ethernet segments. You can specify the set of allowed MAC addresses on
-    the segment and you can optionally tie each MAC address to one or more IP
-    addresses.</li>
-  <li>PPTP Servers and Clients running on the firewall system may now be
-    defined in the <a href="PPTP.htm">/etc/shorewall/tunnels</a> file.</li>
-  <li>A new 'ipsecnat' tunnel type is supported for use when the <a
-    href="IPSEC.htm">remote IPSEC endpoint is behind a NAT gateway</a>.</li>
-  <li>The PATH used by Shorewall may now be specified in <a
-    href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf.</a></li>
-  <li>The main firewall script is now /usr/lib/shorewall/firewall. The script
-    in /etc/init.d/shorewall is very small and uses /sbin/shorewall to do the
-    real work. This change makes custom distributions such as for Debian and
-    for Gentoo easier to manage since it is /etc/init.d/shorewall that tends
-    to have distribution-dependent code.</li>
-</ul>
-You may download the Beta from:<br>
-
-<ul>
-  <li><a
-    href="http://www.shorewall.net/pub/shorewall/Beta">http://www.shorewall.net/pub/shorewall/Beta</a></li>
-  <li><a href="ftp://ftp.shorewall.net/pub/shorewall/Beta"
-    target="_top">ftp://ftp.shorewall.net/pub/shorewall/Beta</a></li>
-</ul>
-
-<p><b>10/10/2002 - &nbsp;Debian 1.3.9b Packages Available<br>
-</b></p>
-
-<p>Apt-get sources listed at <a
-href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html.</a></p>
-
-<p><b>10/9/2002 - Shorewall 1.3.9b</b></p>
-This release rolls up fixes to the installer and to the firewall script.<br>
-
-
-<p><b>10/6/2002 - Shorewall.net now running on RH8.0<br>
-</b><br>
-The firewall and server here at shorewall.net are now running RedHat release
-8.0.<br>
-<b><br>
-9/30/2002 - Shorewall 1.3.9a</b></p>
-Roles up the fix for broken tunnels.<br>
-
-
-<p><b>9/30/2002 - TUNNELS Broken in 1.3.9!!!</b></p>
-There is an updated firewall script at <a
-href="ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall"
-target="_top">ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall</a>
--- copy that file to /usr/lib/shorewall/firewall.<br>
-
-
-<p><b>9/28/2002 - Shorewall 1.3.9</b></p>
-
-<p>In this version:<br>
-</p>
-<ul>
-  <li><a href="configuration_file_basics.htm#dnsnames">DNS Names</a> are now
-    allowed in Shorewall config files (although I recommend against using
-    them).</li>
-  <li>The connection SOURCE may now be qualified by both interface and IP
-    address in a <a href="Documentation.htm#Rules">Shorewall rule</a>.</li>
-  <li>Shorewall startup is now disabled after initial installation until the
-    file /etc/shorewall/startup_disabled is removed. This avoids nasty
-    surprises during reboot for users who install Shorewall but don't
-    configure it.</li>
-  <li>The 'functions' and 'version' files and the 'firewall' symbolic link
-    have been moved from /var/lib/shorewall to /usr/lib/shorewall to appease
-    the LFS police at Debian.<br>
-  </li>
-</ul>
-
-<p><b>9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability
-Restored</b><br>
-</p>
-<img src="images/j0233056.gif" alt="Brown Paper Bag" align="left" height="86"
-width="50" /> A couple of recent configuration changes at www.shorewall.net
-broke the Search facility:<br>
-
-
-<blockquote>
-  <ol>
-    <li>Mailing List Archive Search was not available.</li>
-    <li>The Site Search index was incomplete</li>
-    <li>Only one page of matches was presented.</li>
-  </ol>
-</blockquote>
-Hopefully these problems are now corrected. 
-
-<p><b>9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability
-Restored<br>
-</b></p>
-A couple of recent configuration changes at www.shorewall.net had the
-negative effect of breaking the Search facility:<br>
-
-<ol>
-  <li>Mailing List Archive Search was not available.</li>
-  <li>The Site Search index was incomplete</li>
-  <li>Only one page of matches was presented.</li>
-</ol>
-Hopefully these problems are now corrected.<br>
-
-
-<p><b>9/18/2002 - &nbsp;Debian 1.3.8 Packages Available<br>
-</b></p>
-
-<p>Apt-get sources listed at <a
-href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html.</a></p>
-
-<p><b>9/16/2002 - Shorewall 1.3.8</b></p>
-
-<p>In this version:<br>
-</p>
-<ul>
-  <li>A <a href="Documentation.htm#Conf">NEWNOTSYN</a> option has been added
-    to shorewall.conf. This option determines whether Shorewall accepts TCP
-    packets which are not part of an established connection and that are not
-    'SYN' packets (SYN flag on and ACK flag off).</li>
-  <li>The need for the 'multi' option to communicate between zones za and zb
-    on the same interface is removed in the case where the chain 'za2zb'
-    and/or 'zb2za' exists. 'za2zb' will exist if:</li>
-  <li
-  style="list-style-type: none; list-style-position: outside; list-style-image: none;"><ul>
-      <li>There is a policy for za to zb; or</li>
-      <li>There is at least one rule for za to zb.</li>
-    </ul>
-  </li>
-</ul>
-<ul>
-  <li>The /etc/shorewall/blacklist file now contains three columns. In
-    addition to the SUBNET/ADDRESS column, there are optional PROTOCOL and
-    PORT columns to block only certain applications from the blacklisted
-    addresses.<br>
-  </li>
-</ul>
-
-<p><b>9/11/2002 - Debian 1.3.7c Packages Available</b></p>
-
-<p>Apt-get sources listed at <a
-href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
-
-<p><b>9/2/2002 - Shorewall 1.3.7c</b></p>
-
-<p>This is a role up of a fix for "DNAT" rules where the source zone is $FW
-(fw).</p>
-
-<p><b>8/31/2002 - I'm not available</b></p>
-
-<p>I'm currently on vacation&nbsp; -- please respect my need for a couple of
-weeks free of Shorewall problem reports.</p>
-
-<p>-Tom</p>
-
-<p><b>8/26/2002 - Shorewall 1.3.7b</b></p>
-
-<p>This is a role up of the "shorewall refresh" bug fix and the change which
-reverses the order of "dhcp" and "norfc1918" checking.</p>
-
-<p><b>8/26/2002 - French FTP Mirror is Operational</b></p>
-
-<p><a target="_blank"
-href="ftp://france.shorewall.net/pub/mirrors/shorewall">ftp://france.shorewall.net/pub/mirrors/shorewall</a>
-is now available.</p>
-
-<p><b>8/25/2002 - Shorewall Mirror in France</b></p>
-
-<p>Thanks to a Shorewall user in Paris, the Shorewall web site is now
-mirrored at <a target="_top"
-href="http://france.shorewall.net">http://france.shorewall.net</a>.</p>
-
-<p><b>8/25/2002 - Shorewall 1.3.7a Debian Packages Available</b></p>
-
-<p>Lorenzo Martignoni reports that the packages for version 1.3.7a are
-available at <a
-href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
-
-<p><b>8/22/2002 - Shorewall 1.3.7 Wins a Brown Paper Bag Award for its Author
--- Shorewall 1.3.7a released<img src="images/j0233056.gif"
-alt="Brown Paper Bag Graphic" align="middle" border="0" height="80"
-width="50" /></b></p>
-
-<p>1.3.7a corrects problems occurring in rules file processing when starting
-Shorewall 1.3.7.</p>
-
-<p><b>8/22/2002 - Shorewall 1.3.7 Released 8/13/2002</b></p>
-
-<p>Features in this release include:</p>
-<ul>
-  <li>The 'icmp.def' file is now empty! The rules in that file were required
-    in ipchains firewalls but are not required in Shorewall. Users who have
-    ALLOWRELATED=No in <a href="Documentation.htm#Conf">shorewall.conf</a>
-    should see the <a href="errata.htm#Upgrade">Upgrade Issues</a>.</li>
-  <li>A 'FORWARDPING' option has been added to <a
-    href="Documentation.htm#Conf">shorewall.conf</a>. The effect of setting
-    this variable to Yes is the same as the effect of adding an ACCEPT rule
-    for ICMP echo-request in <a
-    href="shorewall_extension_scripts.htm">/etc/shorewall/icmpdef</a>. Users
-    who have such a rule in icmpdef are encouraged to switch to
-    FORWARDPING=Yes.</li>
-  <li>The loopback CLASS A Network (127.0.0.0/8) has been added to the
-    rfc1918 file.</li>
-  <li>Shorewall now works with iptables 1.2.7</li>
-  <li>The documentation and web site no longer uses FrontPage themes.</li>
-</ul>
-
-<p>I would like to thank John Distler for his valuable input regarding TCP
-SYN and ICMP treatment in Shorewall. That input has led to marked improvement
-in Shorewall in the last two releases.</p>
-
-<p><b>8/13/2002 - Documentation in the <a target="_top"
-href="http://www.shorewall.net/cgi-bin/cvs/cvsweb.cgi">CVS
-Repository</a></b></p>
-
-<p>The Shorewall-docs project now contains just the HTML and image files -
-the Frontpage files have been removed.</p>
-
-<p><b>8/7/2002 - <i>STABLE</i></b> <b>branch added to <a target="_top"
-href="http://www.shorewall.net/cgi-bin/cvs/cvsweb.cgi">CVS
-Repository</a></b></p>
-
-<p>This branch will only be updated after I release a new version of
-Shorewall so you can always update from this branch to get the latest stable
-tree.</p>
-
-<p><b>8/7/2002 - <a href="errata.htm#Upgrade">Upgrade Issues</a> section
-added to the <a href="errata.htm">Errata Page</a></b></p>
-
-<p>Now there is one place to go to look for issues involved with upgrading to
-recent versions of Shorewall.</p>
-
-<p><b>8/7/2002 - Shorewall 1.3.6</b></p>
-
-<p>This is primarily a bug-fix rollup with a couple of new features:</p>
-<ul>
-  <li>The latest <a href="shorewall_quickstart_guide.htm">QuickStart
-    Guides</a> including the <a href="shorewall_setup_guide.htm">Shorewall
-    Setup Guide.</a></li>
-  <li>Shorewall will now DROP TCP packets that are not part of or related to
-    an existing connection and that are not SYN packets. These "New not SYN"
-    packets may be optionally logged by setting the LOGNEWNOTSYN option in <a
-    href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf</a>.</li>
-  <li>The processing of "New not SYN" packets may be extended by commands in
-    the new <a href="shorewall_extension_scripts.htm">newnotsyn extension
-    script</a>.</li>
-</ul>
-
-<p><b>7/30/2002 - Shorewall 1.3.5b Released</b></p>
-
-<p>This interim release:</p>
-<ul>
-  <li>Causes the firewall script to remove the lock file if it is killed.</li>
-  <li>Once again allows lists in the second column of the <a
-    href="Documentation.htm#Hosts">/etc/shorewall/hosts</a> file.</li>
-  <li>Includes the latest <a href="shorewall_quickstart_guide.htm">QuickStart
-    Guides</a>.</li>
-</ul>
-
-<p><b>7/29/2002 - New Shorewall Setup Guide Available</b></p>
-
-<p>The first draft of this guide is available at <a
-href="http://www.shorewall.net/shorewall_setup_guide.htm">http://www.shorewall.net/shorewall_setup_guide.htm</a>.
-The guide is intended for use by people who are setting up Shorewall to
-manage multiple public IP addresses and by people who want to learn more
-about Shorewall than is described in the single-address guides. Feedback on
-the new guide is welcome.</p>
-
-<p><b>7/28/2002 - Shorewall 1.3.5 Debian Package Available</b></p>
-
-<p>Lorenzo Martignoni reports that the packages are version 1.3.5a and are
-available at <a
-href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
-
-<p><b>7/27/2002 - Shorewall 1.3.5a Released</b></p>
-
-<p>This interim release restores correct handling of REDIRECT rules.</p>
-
-<p><b>7/26/2002 - Shorewall 1.3.5 Released</b></p>
-
-<p>This will be the last Shorewall release for a while. I'm going to be
-focusing on rewriting a lot of the documentation.</p>
-
-<p><b>&nbsp;</b> In this version:</p>
-<ul>
-  <li>Empty and invalid source and destination qualifiers are now detected in
-    the rules file. It is a good idea to use the 'shorewall check' command
-    before you issue a 'shorewall restart' command be be sure that you don't
-    have any configuration problems that will prevent a successful
-  restart.</li>
-  <li>Added <b>MERGE_HOSTS</b> variable in <a
-    href="Documentation.htm#Conf">shorewall.conf</a> to provide saner
-    behavior of the /etc/shorewall/hosts file.</li>
-  <li>The time that the counters were last reset is now displayed in the
-    heading of the 'status' and 'show' commands.</li>
-  <li>A <b>proxyarp</b> option has been added for entries in <a
-    href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>. This
-    option facilitates Proxy ARP sub-netting as described in the Proxy ARP
-    subnetting mini-HOWTO (<a
-    href="http://www.tldp.org/HOWTO/mini/Proxy-ARP-Subnet/">http://www.tldp.org/HOWTO/mini/Proxy-ARP-Subnet/</a>).
-    Specifying the proxyarp option for an interface causes Shorewall to set
-    /proc/sys/net/ipv4/conf/&lt;interface&gt;/proxy_arp.</li>
-  <li>The Samples have been updated to reflect the new capabilities in this
-    release.</li>
-</ul>
-
-<p><b>7/16/2002 - New Mirror in Argentina</b></p>
-
-<p>Thanks to Arturo "Buanzo" Busleiman, there is now a Shorewall mirror in
-Argentina. Thanks Buanzo!!!</p>
-
-<p><b>7/16/2002 - Shorewall 1.3.4 Released</b></p>
-
-<p>In this version:</p>
-<ul>
-  <li>A new <a
-    href="Documentation.htm#Routestopped">/etc/shorewall/routestopped</a>
-    file has been added. This file is intended to eventually replace the
-    <b>routestopped</b> option in the /etc/shorewall/interface and
-    /etc/shorewall/hosts files. This new file makes remote firewall
-    administration easier by allowing any IP or subnet to be enabled while
-    Shorewall is stopped.</li>
-  <li>An /etc/shorewall/stopped <a href="Documentation.htm#Scripts">extension
-    script</a> has been added. This script is invoked after Shorewall has
-    stopped.</li>
-  <li>A <b>DETECT_DNAT_ADDRS</b> option has been added to <a
-    href="Documentation.htm#Conf">/etc/shoreall/shorewall.conf</a>. When this
-    option is selected, DNAT rules only apply when the destination address is
-    the external interface's primary IP address.</li>
-  <li>The <a href="shorewall_quickstart_guide.htm">QuickStart Guide</a> has
-    been broken into three guides and has been almost entirely rewritten.</li>
-  <li>The Samples have been updated to reflect the new capabilities in this
-    release.</li>
-</ul>
-
-<p><b>7/8/2002 - Shorewall 1.3.3 Debian Package Available</b></p>
-
-<p>Lorenzo Marignoni reports that the packages are available at <a
-href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
-
-<p><b>7/6/2002 - Shorewall 1.3.3 Released</b></p>
-
-<p>In this version:</p>
-<ul>
-  <li>Entries in /etc/shorewall/interface that use the wildcard character
-    ("+") now have the "multi" option assumed.</li>
-  <li>The 'rfc1918' chain in the mangle table has been renamed 'man1918' to
-    make log messages generated from that chain distinguishable from those
-    generated by the 'rfc1918' chain in the filter table.</li>
-  <li>Interface names appearing in the hosts file are now validated against
-    the interfaces file.</li>
-  <li>The TARGET column in the rfc1918 file is now checked for
-  correctness.</li>
-  <li>The chain structure in the nat table has been changed to reduce the
-    number of rules that a packet must traverse and to correct problems with
-    NAT_BEFORE_RULES=No</li>
-  <li>The "hits" command has been enhanced.</li>
-</ul>
-
-<p><b>6/25/2002 - Samples Updated for 1.3.2</b></p>
-
-<p>The comments in the sample configuration files have been updated to
-reflect new features introduced in Shorewall 1.3.2.</p>
-
-<p><b>6/25/2002 - Shorewall 1.3.1 Debian Package Available</b></p>
-
-<p>Lorenzo Marignoni reports that the package is available at <a
-href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
-
-<p><b>6/19/2002 - Documentation Available in PDF Format</b></p>
-
-<p>Thanks to Mike Martinez, the Shorewall Documentation is now available for
-<a href="download.htm">download</a> in <a
-href="http://www.adobe.com">Adobe</a> PDF format.</p>
-
-<p><b>6/16/2002 - Shorewall 1.3.2 Released</b></p>
-
-<p>In this version:</p>
-<ul>
-  <li>A <a href="Documentation.htm#Starting">logwatch command</a> has been
-    added to /sbin/shorewall.</li>
-  <li>A <a href="blacklisting_support.htm">dynamic blacklist facility</a> has
-    been added.</li>
-  <li>Support for the <a href="Documentation.htm#Conf">Netfilter multiport
-    match function</a> has been added.</li>
-  <li>The files <b>firewall, functions</b> and <b>version</b> have been moved
-    from /etc/shorewall to /var/lib/shorewall.</li>
-</ul>
-
-<p><b>6/6/2002 - Why CVS Web access is Password Protected</b></p>
-
-<p>Last weekend, I installed the CVS Web package to provide brower-based
-access to the Shorewall CVS repository. Since then, I have had several
-instances where my server was almost unusable due to the high load generated
-by website copying tools like HTTrack and WebStripper. These mindless
-tools:</p>
-<ul>
-  <li>Ignore robot.txt files.</li>
-  <li>Recursively copy everything that they find.</li>
-  <li>Should be classified as weapons rather than tools.</li>
-</ul>
-
-<p>These tools/weapons are particularly damaging when combined with CVS Web
-because they doggedly follow every link in the cgi-generated HTML resulting
-in 1000s of executions of the cvsweb.cgi script. Yesterday, I spend several
-hours implementing measures to block these tools but unfortunately, these
-measures resulted in my server OOM-ing under even moderate load.</p>
-
-<p>Until I have the time to understand the cause of the OOM (or until I buy
-more RAM if that is what is required), CVS Web access will remain Password
-Protected.</p>
-
-<p><b>6/5/2002 - Shorewall 1.3.1 Debian Package Available</b></p>
-
-<p>Lorenzo Marignoni reports that the package is available at <a
-href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
-
-<p><b>6/2/2002 - Samples Corrected</b></p>
-
-<p>The 1.3.0 samples configurations had several serious problems that
-prevented DNS and SSH from working properly. These problems have been
-corrected in the <a href="/pub/shorewall/samples-1.3.1">1.3.1 samples.</a></p>
-
-<p><b>6/1/2002 - Shorewall 1.3.1 Released</b></p>
-
-<p>Hot on the heels of 1.3.0, this release:</p>
-<ul>
-  <li>Corrects a serious problem with "all <i>&lt;zone&gt;</i> CONTINUE"
-    policies. This problem is present in all versions of Shorewall that
-    support the CONTINUE policy. These previous versions optimized away the
-    "all2<i>&lt;zone&gt;</i>" chain and replaced it with the "all2all" chain
-    with the usual result that a policy of REJECT was enforced rather than
-    the intended CONTINUE policy.</li>
-  <li>Adds an <a href="Documentation.htm#rfc1918">/etc/shorewall/rfc1918</a>
-    file for defining the exact behavior of the <a
-    href="Documentation.htm#Interfaces">'norfc1918' interface option</a>.</li>
-</ul>
-
-<p><b>5/29/2002 - Shorewall 1.3.0 Released</b></p>
-
-<p>In addition to the changes in Beta 1, Beta 2 and RC1, Shorewall 1.3.0
-includes:</p>
-<ul>
-  <li>A 'filterping' interface option that allows ICMP echo-request (ping)
-    requests addressed to the firewall to be handled by entries in
-    /etc/shorewall/rules and /etc/shorewall/policy.</li>
-</ul>
-
-<p><b>5/23/2002 - Shorewall 1.3 RC1 Available</b></p>
-
-<p>In addition to the changes in Beta 1 and Beta 2, RC1 (Version 1.2.92)
-incorporates the following:</p>
-<ul>
-  <li>Support for the /etc/shorewall/whitelist file has been withdrawn. If
-    you need whitelisting, see <a
-    href="/1.3/whitelisting_under_shorewall.htm">these instructions</a>.</li>
-</ul>
-
-<p><b>5/19/2002 - Shorewall 1.3 Beta 2 Available</b></p>
-
-<p>In addition to the changes in Beta 1, this release which carries the
-designation 1.2.91 adds:</p>
-<ul>
-  <li>The structure of the firewall is changed markedly. There is now an
-    INPUT and a FORWARD chain for each interface; this reduces the number of
-    rules that a packet must traverse, especially in complicated setups.</li>
-  <li><a href="Documentation.htm#Exclude">Sub-zones may now be excluded from
-    DNAT and REDIRECT rules.</a></li>
-  <li>The names of the columns in a number of the configuration files have
-    been changed to be more consistent and self-explanatory and the
-    documentation has been updated accordingly.</li>
-  <li>The sample configurations have been updated for 1.3.</li>
-</ul>
-
-<p><b>5/17/2002 - Shorewall 1.3 Beta 1 Available</b></p>
-
-<p>Beta 1 carries the version designation 1.2.90 and implements the following
-features:</p>
-<ul>
-  <li>Simplified rule syntax which makes the intent of each rule clearer and
-    hopefully makes Shorewall easier to learn.</li>
-  <li>Upward compatibility with 1.2 configuration files has been maintained
-    so that current users can migrate to the new syntax at their
-  convenience.</li>
-  <li><b><font color="#CC6666">WARNING:&nbsp; Compatibility with the old
-    parameterized sample configurations has NOT been maintained. Users still
-    running those configurations should migrate to the new sample
-    configurations before upgrading to 1.3 Beta 1.</font></b></li>
-</ul>
-
-<p><b>5/4/2002 - Shorewall 1.2.13 is Available</b></p>
-
-<p>In this version:</p>
-<ul>
-  <li><a href="Documentation.htm#Whitelist">White-listing</a> is
-  supported.</li>
-  <li><a href="Documentation.htm#Policy">SYN-flood protection</a> is
-  added.</li>
-  <li>IP addresses added under <a
-    href="Documentation.htm#Conf">ADD_IP_ALIASES and ADD_SNAT_ALIASES</a> now
-    inherit the VLSM and Broadcast Address of the interface's primary IP
-    address.</li>
-  <li>The order in which port forwarding DNAT and Static DNAT <a
-    href="Documentation.htm#Conf">can now be reversed</a> so that port
-    forwarding rules can override the contents of <a
-    href="Documentation.htm#NAT">/etc/shorewall/nat</a>.</li>
-</ul>
-
-<p><b>4/30/2002 - Shorewall Debian News</b></p>
-
-<p>Lorenzo Marignoni reports that Shorewall 1.2.12 is now in both the <a
-href="http://packages.debian.org/testing/net/shorewall.html">Debian Testing
-Branch</a> and the <a
-href="http://packages.debian.org/unstable/net/shorewall.html">Debian Unstable
-Branch</a>.</p>
-
-<p><b>4/20/2002 - Shorewall 1.2.12 is Available</b></p>
-<ul>
-  <li>The 'try' command works again</li>
-  <li>There is now a single RPM that also works with SUSE.</li>
-</ul>
-
-<p><b>4/17/2002 - Shorewall Debian News</b></p>
-
-<p>Lorenzo Marignoni reports that:</p>
-<ul>
-  <li>Shorewall 1.2.10 is in the <a
-    href="http://packages.debian.org/testing/net/shorewall.html">Debian
-    Testing Branch</a></li>
-  <li>Shorewall 1.2.11 is in the <a
-    href="http://packages.debian.org/unstable/net/shorewall.html">Debian
-    Unstable Branch</a></li>
-</ul>
-
-<p>Thanks, Lorenzo!</p>
-
-<p><b>4/16/2002 - Shorewall 1.2.11 RPM Available for SUSE</b></p>
-
-<p>Thanks to <a href="mailto:s.mohr@familie-mohr.com">Stefan Mohr</a>, there
-is now a Shorewall 1.2.11 <a
-href="http://www.shorewall.net/pub/shorewall/shorewall-1.2-11.i686.suse73.rpm">SUSE
-RPM</a> available.</p>
-
-<p><b>4/13/2002 - Shorewall 1.2.11 Available</b></p>
-
-<p>In this version:</p>
-<ul>
-  <li>The 'try' command now accepts an optional timeout. If the timeout is
-    given in the command, the standard configuration will automatically be
-    restarted after the new configuration has been running for that length of
-    time. This prevents a remote admin from being locked out of the firewall
-    in the case where the new configuration starts but prevents access.</li>
-  <li>Kernel route filtering may now be enabled globally using the new
-    ROUTE_FILTER parameter in <a
-    href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf</a>.</li>
-  <li>Individual IP source addresses and/or subnets may now be excluded from
-    masquerading/SNAT.</li>
-  <li>Simple "Yes/No" and "On/Off" values are now case-insensitive in
-    /etc/shorewall/shorewall.conf.</li>
-</ul>
-
-<p><b>4/13/2002 - Hamburg Mirror now has FTP</b></p>
-
-<p>Stefan now has an FTP mirror at <a target="_blank"
-href="ftp://germany.shorewall.net/pub/shorewall">ftp://germany.shorewall.net/pub/shorewall</a>.&nbsp;
-Thanks Stefan!</p>
-
-<p><b>4/12/2002 - New Mirror in Hamburg</b></p>
-
-<p>Thanks to <a href="mailto:s.mohr@familie-mohr.com">Stefan Mohr</a>, there
-is now a mirror of the Shorewall website at <a target="_top"
-href="http://germany.shorewall.net">http://germany.shorewall.net</a>.</p>
-
-<p><b>4/10/2002 - Shorewall QuickStart Guide Version 1.1 Available</b></p>
-
-<p><a href="shorewall_quickstart_guide.htm">Version 1.1 of the QuickStart
-Guide</a> is now available. Thanks to those who have read version 1.0 and
-offered their suggestions. Corrections have also been made to the sample
-scripts.</p>
-
-<p><b>4/9/2002 - Shorewall QuickStart Guide Version 1.0 Available</b></p>
-
-<p><a href="shorewall_quickstart_guide.htm">Version 1.0 of the QuickStart
-Guide</a> is now available. This Guide and its accompanying sample
-configurations are expected to provide a replacement for the recently
-withdrawn parameterized samples.</p>
-
-<p><b>4/8/2002 - Parameterized Samples Withdrawn</b></p>
-
-<p>Although the <a
-href="http://www.shorewall.net/pub/shorewall/samples-1.2.1/">parameterized
-samples</a> have allowed people to get a firewall up and running quickly,
-they have unfortunately set the wrong level of expectation among those who
-have used them. I am therefore withdrawing support for the samples and I am
-recommending that they not be used in new Shorewall installations.</p>
-
-<p><b>4/2/2002 - Updated Log Parser</b></p>
-
-<p><a href="mailto:JML@redwoodtech.com">John Lodge</a> has provided an
-updated version of his <a href="pub/shorewall/parsefw/">CGI-based log
-parser</a> with corrected date handling.</p>
-
-<p><b>3/30/2002 - Shorewall Website Search Improvements</b></p>
-
-<p>The quick search on the home page now excludes the mailing list archives.
-The <a href="htdig/search.html">Extended Search</a> allows excluding the
-archives or restricting the search to just the archives. An archive search
-form is also available on the <a
-href="http://lists.shorewall.net/mailing_list.htm">mailing list information
-page</a>.</p>
-
-<p><b>3/28/2002 - Debian Shorewall News (From Lorenzo Martignoni)</b></p>
-<ul>
-  <li>The 1.2.10 Debian Package is available at <a
-    href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</li>
-  <li>Shorewall 1.2.9 is now in the <a
-    href="http://packages.debian.org/unstable/net/shorewall.html">Debian
-    Unstable Distribution</a>.</li>
-</ul>
-
-<p><b>3/25/2002 - Log Parser Available</b></p>
-
-<p><a href="mailto:JML@redwoodtech.com">John Lodge</a> has provided a <a
-href="pub/shorewall/parsefw/">CGI-based log parser</a> for Shorewall. Thanks
-John.</p>
-
-<p><b>3/20/2002 - Shorewall 1.2.10 Released</b></p>
-
-<p>In this version:</p>
-<ul>
-  <li>A "shorewall try" command has been added (syntax: shorewall try
-    <i>&lt;configuration directory&gt;</i>). This command attempts "shorewall
-    -c <i>&lt;configuration directory&gt;</i> start" and if that results in
-    the firewall being stopped due to an error, a "shorewall start" command
-    is executed. The 'try' command allows you to create a new <a
-    href="Documentation.htm#Configs">configuration</a> and attempt to start
-    it; if there is an error that leaves your firewall in the stopped state,
-    it will automatically be restarted using the default configuration (in
-    /etc/shorewall).</li>
-  <li>A new variable ADD_SNAT_ALIASES has been added to <a
-    href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf</a>. If this
-    variable is set to "Yes", Shorewall will automatically add IP addresses
-    listed in the third column of the <a
-    href="Documentation.htm#Masq">/etc/shorewall/masq</a> file.</li>
-  <li>Copyright notices have been added to the documenation.</li>
-</ul>
-
-<p><b>3/11/2002 - Shorewall 1.2.9 Released</b></p>
-
-<p>In this version:</p>
-<ul>
-  <li>Filtering by <a href="Documentation.htm#MAC">MAC address</a> has been
-    added. MAC addresses may be used as the source address in: 
-    <ul>
-      <li>Filtering rules (<a
-        href="Documentation.htm#Rules">/etc/shorewall/rules</a>)</li>
-      <li>Traffic Control Classification Rules (<a
-        href="traffic_shaping.htm#tcrules">/etc/shorewall/tcrules</a>)</li>
-      <li>TOS Rules (<a
-      href="Documentation.htm#TOS">/etc/shorewall/tos</a>)</li>
-      <li>Blacklist (<a
-        href="Documentation.htm#Blacklist">/etc/shorewall/blacklist</a>)</li>
-    </ul>
-  </li>
-  <li>Several bugs have been fixed</li>
-  <li>The 1.2.9 Debian Package is also available at <a
-    href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</li>
-</ul>
-
-<p><b>3/1/2002 - 1.2.8 Debian Package is Available</b></p>
-
-<p>See <a
-href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a></p>
-
-<p><b>2/25/2002 - New Two-interface Sample</b></p>
-
-<p>I've enhanced the two interface sample to allow access from the firewall
-to servers in the local zone - <a
-href="http://www.shorewall.net/pub/shorewall/LATEST.samples/two-interfaces.tgz">http://www.shorewall.net/pub/shorewall/LATEST.samples/two-interfaces.tgz</a></p>
-
-<p><b>2/23/2002 - Shorewall 1.2.8 Released</b></p>
-
-<p>Do to a serious problem with 1.2.7, I am releasing 1.2.8. It corrects
-problems associated with the lock file used to prevent multiple
-state-changing operations from occuring simultaneously. My apologies for any
-inconvenience my carelessness may have caused.</p>
-
-<p><b>2/22/2002 - Shorewall 1.2.7 Released</b></p>
-
-<p>In this version:</p>
-<ul>
-  <li>UPnP probes (UDP destination port 1900) are now silently dropped in the
-    <i>common</i> chain</li>
-  <li>RFC 1918 checking in the mangle table has been streamlined to no longer
-    require packet marking. RFC 1918 checking in the filter table has been
-    changed to require half as many rules as previously.</li>
-  <li>A 'shorewall check' command has been added that does a cursory
-    validation of the zones, interfaces, hosts, rules and policy files.</li>
-</ul>
-
-<p><b>2/18/2002 - 1.2.6 Debian Package is Available</b></p>
-
-<p>See <a
-href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a></p>
-
-<p><b>2/8/2002 - Shorewall 1.2.6 Released</b></p>
-
-<p>In this version:</p>
-<ul>
-  <li>$-variables may now be used anywhere in the configuration files except
-    /etc/shorewall/zones.</li>
-  <li>The interfaces and hosts files now have their contents validated before
-    any changes are made to the existing Netfilter configuration. The
-    appearance of a zone name that isn't defined in /etc/shorewall/zones
-    causes "shorewall start" and "shorewall restart" to abort without
-    changing the Shorewall state. Unknown options in either file cause a
-    warning to be issued.</li>
-  <li>A problem occurring when BLACKLIST_LOGLEVEL was not set has been
-    corrected.</li>
-</ul>
-
-<p><b>2/4/2002 - Shorewall 1.2.5 Debian Package Available</b></p>
-
-<p>see <a
-href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a></p>
-
-<p><b>2/1/2002 - Shorewall 1.2.5 Released</b></p>
-
-<p>Due to installation problems with Shorewall 1.2.4, I have released
-Shorewall 1.2.5. Sorry for the rapid-fire development.</p>
-
-<p>In version 1.2.5:</p>
-<ul>
-  <li>The installation problems have been corrected.</li>
-  <li><a href="Documentation.htm#Masq">SNAT</a> is now supported.</li>
-  <li>A "shorewall version" command has been added</li>
-  <li>The default value of the STATEDIR variable in
-    /etc/shorewall/shorewall.conf has been changed to /var/lib/shorewall in
-    order to conform to the GNU/Linux File Hierarchy Standard, Version
-  2.2.</li>
-</ul>
-
-<p><b>1/28/2002 - Shorewall 1.2.4 Released</b></p>
-<ul>
-  <li>The "fw" zone <a href="Documentation.htm#FW">may now be given a
-    different name</a>.</li>
-  <li>You may now place end-of-line comments (preceded by '#') in any of the
-    configuration files</li>
-  <li>There is now protection against against two state changing operations
-    occuring concurrently. This is implemented using the 'lockfile' utility
-    if it is available (lockfile is part of procmail); otherwise, a less
-    robust technique is used. The lockfile is created in the STATEDIR defined
-    in /etc/shorewall/shorewall.conf and has the name "lock".</li>
-  <li>"shorewall start" no longer fails if "detect" is specified in <a
-    href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a> for an
-    interface with subnet mask 255.255.255.255.</li>
-</ul>
-
-<p><b>1/27/2002 - Shorewall 1.2.3 Debian Package Available</b> -- see <a
-href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a></p>
-
-<p><b>1/20/2002 - Corrected firewall script available&nbsp;</b></p>
-
-<p>Corrects a problem with BLACKLIST_LOGLEVEL. See <a href="errata.htm">the
-errata</a> for details.</p>
-
-<p><b>1/19/2002 - Shorewall 1.2.3 Released</b></p>
-
-<p>This is a minor feature and bugfix release. The single new feature is:</p>
-<ul>
-  <li>Support for TCP MSS Clamp to PMTU -- This support is usually required
-    when the internet connection is via PPPoE or PPTP and may be enabled
-    using the <a href="Documentation.htm#ClampMSS">CLAMPMSS</a> option in
-    /etc/shorewall/shorewall.conf.</li>
-</ul>
-
-<p>The following problems were corrected:</p>
-<ul>
-  <li>The "shorewall status" command no longer hangs.</li>
-  <li>The "shorewall monitor" command now displays the icmpdef chain</li>
-  <li>The CLIENT PORT(S) column in tcrules is no longer ignored</li>
-</ul>
-
-<p><b>1/18/2002 - Shorewall 1.2.2 packaged with new</b> <a
-href="http://leaf.sourceforge.net">LEAF</a> <b>release</b></p>
-
-<p>Jacques Nilo and Eric Wolzak have released a kernel 2.4.16 LEAF
-distribution that includes Shorewall 1.2.2. See <a
-href="http://leaf.sourceforge.net/devel/jnilo">http://leaf.sourceforge.net/devel/jnilo</a>
-for details.</p>
-
-<p><b>1/11/2002 - Debian Package (.deb) Now Available -</b> Thanks to <a
-href="mailto:lorenzo.martignoni@milug.org">Lorenzo Martignoni</a>, a 1.2.2
-Shorewall Debian package is now available. There is a link to Lorenzo's site
-from the <a href="download.htm">Shorewall download page</a>.</p>
-
-<p><b>1/9/2002 - Updated 1.2.2 /sbin/shorewall available -</b> <a
-href="/pub/shorewall/errata/1.2.2/shorewall">This corrected version</a>
-restores the "shorewall status" command to health.</p>
-
-<p><b>1/8/2002 - Shorewall 1.2.2 Released</b></p>
-
-<p>In version 1.2.2</p>
-<ul>
-  <li>Support for IP blacklisting has been added 
-    <ul>
-      <li>You specify whether you want packets from blacklisted hosts dropped
-        or rejected using the <a
-        href="Documentation.htm#BLDisposition">BLACKLIST_DISPOSITION</a>
-        setting in /etc/shorewall/shorewall.conf</li>
-      <li>You specify whether you want packets from blacklisted hosts logged
-        and at what syslog level using the <a
-        href="Documentation.htm#BLLoglevel">BLACKLIST_LOGLEVEL</a> setting in
-        /etc/shorewall/shorewall.conf</li>
-      <li>You list the IP addresses/subnets that you wish to blacklist in <a
-        href="Documentation.htm#Blacklist">/etc/shorewall/blacklist</a></li>
-      <li>You specify the interfaces you want checked against the blacklist
-        using the new "<a href="Documentation.htm#BLInterface">blacklist</a>"
-        option in /etc/shorewall/interfaces.</li>
-      <li>The black list is refreshed from /etc/shorewall/blacklist by the
-        "shorewall refresh" command.</li>
-    </ul>
-  </li>
-  <li>Use of TCP RST replies has been expanded&nbsp; 
-    <ul>
-      <li>TCP connection requests rejected because of a REJECT policy are now
-        replied with a TCP RST packet.</li>
-      <li>TCP connection requests rejected because of a protocol=all rule in
-        /etc/shorewall/rules are now replied with a TCP RST packet.</li>
-    </ul>
-  </li>
-  <li>A <a href="Documentation.htm#Logfile">LOGFILE</a> specification has
-    been added to /etc/shorewall/shorewall.conf. LOGFILE is used to tell the
-    /sbin/shorewall program where to look for Shorewall messages.</li>
-</ul>
-
-<p><b>1/5/2002 - New Parameterized Samples (<a
-href="ftp://ftp.shorewall.net/pub/shorewall/samples-1.2.0/"
-target="_blank">version 1.2.0</a>) released.</b> These are minor updates to
-the previously-released samples. There are two new rules added:</p>
-<ul>
-  <li>Unless you have explicitly enabled Auth connections (tcp port 113) to
-    your firewall, these connections will be REJECTED rather than DROPPED.
-    This speeds up connection establishment to some servers.</li>
-  <li>Orphan DNS replies are now silently dropped.</li>
-</ul>
-
-<p>See the README file for upgrade instructions.</p>
-
-<p><b>1/1/2002 - <u><font color="#FF6633">Shorewall Mailing List
-Moving</font></u></b></p>
-
-<p>The Shorewall mailing list hosted at <a
-href="http://sourceforge.net">Sourceforge</a> is moving to Shorewall.net. If
-you are a current subscriber to the list at Sourceforge, please <a
-href="shorewall_mailing_list_migration.htm">see these instructions</a>. If
-you would like to subscribe to the new list, visit <a
-href="http://www.shorewall.net/mailman/listinfo/shorewall-users">http://www.shorewall.net/mailman/listinfo/shorewall-users</a>.</p>
-
-<p><b>12/31/2001 - Shorewall 1.2.1 Released</b></p>
-
-<p>In version 1.2.1:</p>
-<ul>
-  <li><a href="Documentation.htm#LogUncleanOption">Logging of Mangled/Invalid
-    Packets</a> is added.&nbsp;</li>
-  <li>The <a href="IPIP.htm">tunnel script</a> has been corrected.</li>
-  <li>'shorewall show tc' now correctly handles tunnels.</li>
-</ul>
-
-<p><b>12/21/2001 - Shorewall 1.2.0 Released!</b> - <b>I couldn't resist
-releasing 1.2 on 12/21/2001</b></p>
-
-<p>Version 1.2 contains the following new features:</p>
-<ul>
-  <li>Support for <a href="traffic_shaping.htm">Traffic
-  Control/Shaping</a></li>
-  <li>Support for <a href="Documentation.htm#Unclean">Filtering of
-    Mangled/Invalid Packets</a></li>
-  <li>Support for <a href="IPIP.htm">GRE Tunnels</a></li>
-</ul>
-
-<p>For the next month or so, I will continue to provide corrections to
-version 1.1.18 as necessary so that current version 1.1.x users will not be
-forced into a quick upgrade to 1.2.0 just to have access to bug fixes.</p>
-
-<p>For those of you who have installed one of the Beta RPMS, you will need to
-use the "--oldpackage" option when upgrading to 1.2.0:</p>
-
-<blockquote>
-  <p>rpm -Uvh --oldpackage shorewall-1.2-0.noarch.rpm</p>
-</blockquote>
-
-<p><b>12/19/2001 - Thanks to <a href="mailto:scowles@infohiiway.com">Steve
-Cowles</a>, there is now a Shorewall mirror in Texas.</b> This web site is
-mirrored at <a href="http://www.infohiiway.com/shorewall"
-target="_top">http://www.infohiiway.com/shorewall</a> and the ftp site is at
-<a
-href="ftp://ftp.infohiiway.com/pub/mirrors/shorewall">ftp://ftp.infohiiway.com/pub/mirrors/shorewall</a>.
-<b>&nbsp;</b></p>
-
-<p><b>11/30/2001 - A new set of the parameterized <a
-href="ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.18">Sample
-Configurations</a> has been released</b>. In this version:</p>
-<ul>
-  <li>Ping is now allowed between the zones.</li>
-  <li>In the three-interface configuration, it is now possible to configure
-    the internet services that are to be available to servers in the
-    DMZ.&nbsp;</li>
-</ul>
-
-<p><b>11/20/2001 - The current version of Shorewall is 1.1.18.&nbsp;</b></p>
-
-<p>In this version:</p>
-<ul>
-  <li>The spelling of ADD_IP_ALIASES has been corrected in the shorewall.conf
-    file</li>
-  <li>The logic for deleting user-defined chains has been simplified so that
-    it avoids a bug in the LRP version of the 'cut' utility.</li>
-  <li>The /var/lib/lrpkg/shorwall.conf file has been corrected to properly
-    display the NAT entry in that file.</li>
-</ul>
-
-<p><b>11/19/2001 - Thanks to <a href="mailto:shorewall@timelord.sk">Juraj
-Ontkanin</a>, there is now a Shorewall mirror in the Slovak Republic</b>. The
-website is now mirrored at <a href="http://www.nrg.sk/mirror/shorewall"
-target="_top">http://www.nrg.sk/mirror/shorewall</a> and the FTP site is
-mirrored at <a
-href="ftp://ftp.nrg.sk/mirror/shorewall">ftp://ftp.nrg.sk/mirror/shorewall</a>.</p>
-
-<p><b>11/2/2001 - Announcing Shorewall Parameter-driven Sample
-Configurations.</b> There are three sample configurations:</p>
-<ul>
-  <li>One Interface -- for a standalone system.</li>
-  <li>Two Interfaces -- A masquerading firewall.</li>
-  <li>Three Interfaces -- A masquerading firewall with DMZ.</li>
-</ul>
-
-<p>Samples may be downloaded from <a
-href="ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.17">ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.17</a>
-. See the README file for instructions.</p>
-
-<p><b>11/1/2001 - The current version of Shorewall is 1.1.17</b>.&nbsp; I
-intend this to be the last of the 1.1 Shorewall releases.</p>
-
-<p>In this version:</p>
-<ul>
-  <li>The handling of <a href="Documentation.htm#Aliases">ADD_IP_ALIASES</a>
-    has been corrected.&nbsp;</li>
-</ul>
-
-<p><b>10/22/2001 - The current version of Shorewall is 1.1.16</b>. In this
-version:</p>
-<ul>
-  <li>A new "shorewall show connections" command has been added.</li>
-  <li>In the "shorewall monitor" output, the currently tracked connections
-    are now shown on a separate page.</li>
-  <li>Prior to this release, Shorewall unconditionally added the external IP
-    adddress(es) specified in /etc/shorewall/nat. Beginning with version
-    1.1.16, a new parameter (<a
-    href="Documentation.htm#Aliases">ADD_IP_ALIASES</a>) may be set to "no"
-    (or "No") to inhibit this behavior. This allows IP aliases created using
-    your distribution's network configuration tools to be used in static
-    NAT.&nbsp;</li>
-</ul>
-
-<p><b>10/15/2001 - The current version of Shorewall is 1.1.15.</b> In this
-version:</p>
-<ul>
-  <li>Support for nested zones has been improved. See <a
-    href="Documentation.htm#Nested">the documentation</a> for details</li>
-  <li>Shorewall now correctly checks the alternate configuration directory
-    for the 'zones' file.</li>
-</ul>
-
-<p><b>10/4/2001 - The current version of Shorewall is 1.1.14.</b> In this
-version</p>
-<ul>
-  <li>Shorewall now supports alternate configuration directories. When an
-    alternate directory is specified when starting or restarting Shorewall
-    (e.g., "shorewall -c /etc/testconf restart"), Shorewall will first look
-    for configuration files in the alternate directory then in
-    /etc/shorewall. To create an alternate configuration simply:<br>
-    1. Create a New Directory<br>
-    2. Copy to that directory any of your configuration files that you want
-    to change.<br>
-    3. Modify the copied files as needed.<br>
-    4. Restart Shorewall specifying the new directory.</li>
-  <li>The rules for allowing/disallowing icmp echo-requests (pings) are now
-    moved after rules created when processing the rules file. This allows you
-    to add rules that selectively allow/deny ping based on source or
-    destination address.</li>
-  <li>Rules that specify multiple client ip addresses or subnets no longer
-    cause startup failures.</li>
-  <li>Zone names in the policy file are now validated against the zones
-  file.</li>
-  <li>If you have <a href="Documentation.htm#MangleEnabled">packet
-    mangling</a> support enabled, the "<a
-    href="Documentation.htm#Interfaces">norfc1918</a>" interface option now
-    logs and drops any incoming packets on the interface that have an RFC
-    1918 destination address.</li>
-</ul>
-
-<p><b>9/12/2001 - The current version of Shorewall is 1.1.13</b>. In this
-version</p>
-<ul>
-  <li>Shell variables can now be used to parameterize Shorewall rules.</li>
-  <li>The second column in the hosts file may now contain a comma-separated
-    list.<br>
-    <br>
-    Example:<br>
-    &nbsp;&nbsp;&nbsp; sea&nbsp;&nbsp;&nbsp;
-    eth0:130.252.100.0/24,206.191.149.0/24</li>
-  <li>Handling of multi-zone interfaces has been improved. See the <a
-    href="Documentation.htm#Interfaces">documentation for the
-    /etc/shorewall/interfaces file</a>.</li>
-</ul>
-
-<p><b>8/28/2001 - The current version of Shorewall is 1.1.12</b>. In this
-version</p>
-<ul>
-  <li>Several columns in the rules file may now contain comma-separated
-  lists.</li>
-  <li>Shorewall is now more rigorous in parsing the options in
-    /etc/shorewall/interfaces.</li>
-  <li>Complementation using "!" is now supported in rules.</li>
-</ul>
-
-<p><b>7/28/2001 - The current version of Shorewall is 1.1.11</b>. In this
-version</p>
-<ul>
-  <li>A "shorewall refresh" command has been added to allow for refreshing
-    the rules associated with the broadcast address on a dynamic interface.
-    This command should be used in place of "shorewall restart" when the
-    internet interface's IP address changes.</li>
-  <li>The /etc/shorewall/start file (if any) is now processed after all
-    temporary rules have been deleted. This change prevents the accidental
-    removal of rules added during the processing of that file.</li>
-  <li>The "dhcp" interface option is now applicable to firewall interfaces
-    used by a DHCP server running on the firewall.</li>
-  <li>The RPM can now be built from the .tgz file using "rpm -tb"&nbsp;</li>
-</ul>
-
-<p><b>7/6/2001 - The current version of Shorewall is 1.1.10.</b> In this
-version</p>
-<ul>
-  <li>Shorewall now enables Ipv4 Packet Forwarding by default. Packet
-    forwarding may be disabled by specifying IP_FORWARD=Off in
-    /etc/shorewall/shorewall.conf. If you don't want Shorewall to enable or
-    disable packet forwarding, add IP_FORWARDING=Keep to your
-    /etc/shorewall/shorewall.conf file.</li>
-  <li>The "shorewall hits" command no longer lists extraneous service names
-    in its last report.</li>
-  <li>Erroneous instructions in the comments at the head of the firewall
-    script have been corrected.</li>
-</ul>
-
-<p><b>6/23/2001 - The current version of Shorewall is 1.1.9.</b> In this
-version</p>
-<ul>
-  <li>The "tunnels" file <u>really</u> is in the RPM now.</li>
-  <li>SNAT can now be applied to port-forwarded connections.</li>
-  <li>A bug which would cause firewall start failures in some dhcp
-    configurations has been fixed.</li>
-  <li>The firewall script now issues a message if you have the name of an
-    interface in the second column in an entry in /etc/shorewall/masq and
-    that interface is not up.</li>
-  <li>You can now configure Shorewall so that it <a
-    href="Documentation.htm#NatEnabled">doesn't require the NAT and/or mangle
-    netfilter modules</a>.</li>
-  <li>Thanks to Alex&nbsp; Polishchuk, the "hits" command from seawall is now
-    in shorewall.</li>
-  <li>Support for <a href="IPIP.htm">IPIP tunnels</a> has been added.</li>
-</ul>
-
-<p><b>6/18/2001 - The current version of Shorewall is 1.1.8</b>. In this
-version</p>
-<ul>
-  <li>A typo in the sample rules file has been corrected.</li>
-  <li>It is now possible to restrict masquerading by <a
-    href="Documentation.htm#Masq">destination host or subnet.</a></li>
-  <li>It is now possible to have static <a href="NAT.htm#LocalPackets">NAT
-    rules applied to packets originating on the firewall itself</a>.</li>
-</ul>
-
-<p><b>6/2/2001 - The current version of Shorewall is 1.1.7.</b> In this
-version</p>
-<ul>
-  <li>The TOS rules are now deleted when the firewall is stopped.</li>
-  <li>The .rpm will now install regardless of which version of iptables is
-    installed.</li>
-  <li>The .rpm will now install without iproute2 being installed.</li>
-  <li>The documentation has been cleaned up.</li>
-  <li>The sample configuration files included in Shorewall have been
-    formatted to 80 columns for ease of editing on a VGA console.</li>
-</ul>
-
-<p><b>5/25/2001 - The current version of Shorewall is 1.1.6</b>. In this
-version</p>
-<ul>
-  <li><a href="Documentation.htm#lograte">You may now rate-limit the packet
-    log.</a></li>
-  <li>Previous versions of Shorewall have an implementation of Static NAT
-    which violates the principle of least surprise.&nbsp; NAT only occurs for
-    packets arriving at (DNAT) or send from (SNAT) the interface named in the
-    INTERFACE column of /etc/shorewall/nat. Beginning with version 1.1.6, NAT
-    effective regardless of which interface packets come from or are destined
-    to. To get compatibility with prior versions, I have added a new "ALL <a
-    href="NAT.htm#AllInterFaces">"ALL INTERFACES"&nbsp; column to
-    /etc/shorewall/nat</a>. By placing "no" or "No" in the new column, the
-    NAT behavior of prior versions may be retained.&nbsp;</li>
-  <li>The treatment of <a href="IPSEC.htm#RoadWarrior">IPSEC Tunnels where
-    the remote gateway is a standalone system has been improved</a>.
-    Previously, it was necessary to include an additional rule allowing UDP
-    port 500 traffic to pass through the tunnel. Shorewall will now create
-    this rule automatically when you place the name of the remote peer's zone
-    in a new GATEWAY ZONE column in /etc/shorewall/tunnels.&nbsp;</li>
-</ul>
-
-<p><b>5/20/2001 - The current version of Shorewall is 1.1.5.</b> In this
-version</p>
-<ul>
-  <li><a href="Documentation.htm#modules">You may now pass parameters when
-    loading netfilter modules and you can specify the modules to
-  load.</a></li>
-  <li>Compressed modules are now loaded. This requires that you modutils
-    support loading compressed modules.</li>
-  <li><a href="Documentation.htm#TOS">You may now set the Type of Service
-    (TOS) field in packets.</a></li>
-  <li>Corrected rules generated for port redirection (again).</li>
-</ul>
-
-<p><b>5/10/2001 - The current version of Shorewall is 1.1.4.</b> In this
-version</p>
-<ul>
-  <li><a href="Documentation.htm#Conf">Accepting RELATED connections is now
-    optional.</a></li>
-  <li>Corrected problem where if "shorewall start" aborted early (due to
-    kernel configuration errors for example), superfluous 'sed' error
-    messages were reported.</li>
-  <li>Corrected rules generated for port redirection.</li>
-  <li>The order in which iptables kernel modules are loaded has been
-    corrected (Thanks to Mark Pavlidis).&nbsp;</li>
-</ul>
-
-<p><b>4/28/2001 - The current version of Shorewall is 1.1.3.</b> In this
-version</p>
-<ul>
-  <li>Correct message issued when Proxy ARP address added (Thanks to Jason
-    Kirtland).</li>
-  <li>/tmp/shorewallpolicy-$$ is now removed if there is an error while
-    starting the firewall.</li>
-  <li>/etc/shorewall/icmp.def and /etc/shorewall/common.def are now used to
-    define the icmpdef and common chains unless overridden by the presence of
-    /etc/shorewall/icmpdef or /etc/shorewall/common.</li>
-  <li>In the .lrp, the file /var/lib/lrpkg/shorwall.conf has been corrected.
-    An extra space after "/etc/shorwall/policy" has been removed and
-    "/etc/shorwall/rules" has been added.</li>
-  <li>When a sub-shell encounters a fatal error and has stopped the firewall,
-    it now kills the main shell so that the main shell will not continue.</li>
-  <li>A problem has been corrected where a sub-shell stopped the firewall and
-    main shell continued resulting in a perplexing error message referring to
-    "common.so" resulted.</li>
-  <li>Previously, placing "-" in the PORT(S) column in /etc/shorewall/rules
-    resulted in an error message during start. This has been corrected.</li>
-  <li>The first line of "install.sh" has been corrected -- I had
-    inadvertently deleted the initial "#".</li>
-</ul>
-
-<p><b>4/12/2001 - The current version of Shorewall is 1.1.2.</b> In this
-version</p>
-<ul>
-  <li>Port redirection now works again.</li>
-  <li>The icmpdef and common chains <a href="Documentation.htm#Icmpdef">may
-    now be user-defined</a>.</li>
-  <li>The firewall no longer fails to start if "routefilter" is specified for
-    an interface that isn't started. A warning message is now issued in this
-    case.</li>
-  <li>The LRP Version is renamed "shorwall" for 8,3 MSDOS file system
-    compatibility.</li>
-  <li>A couple of LRP-specific problems were corrected.</li>
-</ul>
-
-<p><b>4/8/2001 - Shorewall is now affiliated with the <a
-href="http://leaf.sourceforge.net">Leaf Project</a></b> <a
-href="http://leaf.sourceforge.net"><img src="images/leaflogo.gif"
-alt="Leaf Logo" border="0" height="36" width="49" /></a></p>
-
-<p><b>4/5/2001 - The current version of Shorewall is 1.1.1. In this
-version:</b></p>
-<ul>
-  <li>The common chain is traversed from INPUT, OUTPUT and FORWARD before
-    logging occurs</li>
-  <li>The source has been cleaned up dramatically</li>
-  <li>DHCP DISCOVER packets with RFC1918 source addresses no longer generate
-    log messages. Linux DHCP clients generate such packets and it's annoying
-    to see them logged.&nbsp;</li>
-</ul>
-
-<p><b>3/25/2001 - The current version of Shorewall is 1.1.0. In this
-version:</b></p>
-<ul>
-  <li>Log messages now indicate the packet disposition.</li>
-  <li>Error messages have been improved.</li>
-  <li>The ability to define zones consisting of an enumerated set of hosts
-    and/or subnetworks has been added.</li>
-  <li>The zone-to-zone chain matrix is now sparse so that only those chains
-    that contain meaningful rules are defined.</li>
-  <li>240.0.0.0/4 and 169.254.0.0/16 have been added to the source
-    subnetworks whose packets are dropped under the <i>norfc1918</i>
-    interface option.</li>
-  <li>Exits are now provided for executing an user-defined script when a
-    chain is defined, when the firewall is initialized, when the firewall is
-    started, when the firewall is stopped and when the firewall is
-  cleared.</li>
-  <li>The Linux kernel's route filtering facility can now be specified
-    selectively on network interfaces.</li>
-</ul>
-
-<p><b>3/19/2001 - The current version of Shorewall is 1.0.4. This
-version:</b></p>
-<ul>
-  <li>Allows user-defined zones. Shorewall now has only one pre-defined zone
-    (fw) with the remaining zones being defined in the new configuration file
-    /etc/shorewall/zones. The /etc/shorewall/zones file released in this
-    version provides behavior that is compatible with Shorewall
-  1.0.3.&nbsp;</li>
-  <li>Adds the ability to specify logging in entries in the
-    /etc/shorewall/rules file.</li>
-  <li>Correct handling of the icmp-def chain so that only ICMP packets are
-    sent through the chain.</li>
-  <li>Compresses the output of "shorewall monitor" if awk is installed.
-    Allows the command to work if awk isn't installed (although it's not
-    pretty).</li>
-</ul>
-
-<p><b>3/13/2001 - The current version of Shorewall is 1.0.3. This is a
-bug-fix release with no new features.</b></p>
-<ul>
-  <li>The PATH variable in the firewall script now includes /usr/local/bin
-    and /usr/local/sbin.</li>
-  <li>DMZ-related chains are now correctly deleted if the DMZ is deleted.</li>
-  <li>The interface OPTIONS for "gw" interfaces are no longer ignored.</li>
-</ul>
-
-<p><b>3/8/2001 - The current version of Shorewall is 1.0.2. It supports an
-additional "gw" (gateway) zone for tunnels and it supports IPSEC tunnels with
-end-points on the firewall. There is also a .lrp available now.</b></p>
-</body>
-</html>
diff --git a/web/search.html b/web/search.html
deleted file mode 100644
index ffefe00f7..000000000
--- a/web/search.html
+++ /dev/null
@@ -1,78 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
-
-<html>
-  <head>
-    <meta name="generator" content=
-    "HTML Tidy for Linux (vers 1st April 2002), see www.w3.org">
-
-    <title>ht://Dig WWW Search</title>
-    <meta name="Microsoft Theme" content="none">
-  </head>
-
-  <body>
-    <h1>Shorewall Site Searches</h1>
-    <hr>
-    This search will allow you to search the contents of <b>all the
-    publicly available WWW documents at shorewall.net</b>.
-    Currently searches only the shorewall.net mirror in Washington
-    State, USA. 
-
-    <center>
-      <form method="get" action="http://www.google.com/search">
-        <input name="ie" value="UTF-8" type="hidden"> <input name=
-        "oe" value="UTF-8" type="hidden"> <input name=
-        "as_sitesearch" value="www.shorewall.net" type="hidden"> 
-
-        <table style="background-color: rgb(255, 255, 240);"
-        border="0" cellspacing="0">
-          <tbody>
-            <tr>
-              <td><a href="http://www.google.com/"><img src=
-              "http://www.google.com/logos/Logo_40wht.gif" alt=
-              "Google" align="middle" border="0"></a> <input name=
-              "q" size="25" maxlength="255" value="" type="text">
-              <input name="btnG" value="Site Search by Google"
-              type="submit"></td>
-            </tr>
-          </tbody>
-        </table>
-      </form>
-    </center>
-    <br>
-    <hr>
-
-    <p>This search will allow you to search the contents of the
-    <b>Mailing List Archives</b> at shorewall.net. Currently
-    searches at the main shorewall.net site only.</p>
-
-    <center>
-      <form method="get" action="http://www.google.com/search"
-      target="_top">
-        <input name="ie" value="UTF-8" type="hidden"> <input name=
-        "oe" value="UTF-8" type="hidden"><input name=
-        "as_sitesearch" value="lists.shorewall.net" type="hidden"> 
-
-        <table style="width: 534px; height: 63px;" bgcolor=
-        "#ffffff">
-          <tbody>
-            <tr>
-              <td><a href="http://www.google.com/"><img src=
-              "http://www.google.com/logos/Logo_40wht.gif" alt=
-              "Google" align="middle" border="0"></a><input name=
-              "q" size="25" maxlength="255" value="" type="text">
-              <input name="btnG" value=
-              "List Archive Search by Google" type="submit"></td>
-            </tr>
-          </tbody>
-        </table>
-      </form>
-    </center>
-    <hr>
-
-    <p><a href="http://www.htdig.org/"><br>
-    </a></p>
-    <br>
-    <br>
-  </body>
-</html>
-
diff --git a/web/shoreline.htm b/web/shoreline.htm
deleted file mode 100644
index ba26cb2f1..000000000
--- a/web/shoreline.htm
+++ /dev/null
@@ -1,119 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
-  <title>About the Shorewall Author</title>
-  <meta name="ProgId" content="FrontPage.Editor.Document">
-  <meta name="Microsoft Theme" content="none">
-</head>
-<body>
-<h1 style="text-align: center;">Tom Eastep</h1>
-<div style="text-align: center;">
-<span style="font-style: italic;">Open Source Software is not free; it
-comes
-at a very high cost.<br>
-<br>
--</span> Wietse Venema<br>
-<br>
-<div style="text-align: center;">
-<span style="font-style: italic;">The painful task of thinking belongs
-to
-me.<br>
-<br>
--</span> Baron George Brydges Rodney<br>
-<br>
-<span style="font-style: italic;">Perfection in design is achieved not
-when
-there is nothing left to add, but rather when there is nothing left to
-take
-away.</span><br>
-</div>
-<br>
-<div style="text-align: center;">
-&nbsp;- Antoine de Saint-Exupery<br>
-<div style="text-align: left;">
-<br>
-<div style="text-align: center;">
-<div style="text-align: left;">
-<div style="text-align: center;"><span style="font-style: italic;">Nothing
-is foolproof to a
-sufficiently-talented fool</span><br>
-</div>
-<span style="font-style: italic;"><br>
-</span>
-<div style="text-align: center;">- Anonymous<br>
-<span style="font-style: italic;"></span><br>
-<span style="font-style: italic;">Still, it is an error to argue in
-front of your data. You find yourself insensibly twisting them round to
-fit your theories.<br>
-<br>
-</span>- Holmes to Watson, "<span style="font-style: italic;">The
-Adventure of Wisteria Lodge", </span>Arthur Conan Doyle<br>
-<br>
-Copyright © 2001-2008 Thomas M. Eastep<br>
-<br>
-</div>
-</div>
-</div>
-</div>
-</div>
-<p>Permission is granted to copy, distribute and/or modify this
-document
-under the terms of the GNU Free Documentation License, Version 1.2 or
-any
-later version published by the Free Software Foundation; with no
-Invariant
-Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of
-the
-license is included in the section entitled “<span class="quote"><a
- href="GnuCopyright.htm" target="_self">GNU Free Documentation
-License</a></span>”.<br>
-</p>
-<p>2008-12-21<br>
-</p>
-<hr style="width: 100%; height: 2px;">
-<p style="text-align: center;"><a href="images/p1000221-600-800.jpg"><img
- src="images/p1000221-600-800.jpg"
- alt="Tom, his dog, and his new car - May 2006"
- style="border: 3px solid ; width: 400px; height: 300px;"></a></p>
-<div style="text-align: center;">
-"Tom, his dog Tipper, and his new car" -- May 2006<br>
-</div>
-<p align="center"><br>
-</p>
-<ul>
-  <li>Born 1945 in <a href="http://www.experiencewashington.com"
- target="_top">Washington State</a> .</li>
-  <li>BA Mathematics from <a href="http://www.wsu.edu" target="_top">Washington
-State University</a> 1967</li>
-  <li>MA Mathematics from <a href="http://www.washington.edu"
- target="_top">University of Washington</a> 1969</li>
-  <li>Burroughs Corporation (now <a href="http://www.unisys.com"
- target="_top">Unisys</a> ) 1969 - 1980</li>
-  <li>Tandem Computers, Incorporated (now part of <a
- href="http://www.hp.com" target="_top">Hewlett-Packard</a>) 1980 -
-present</li>
-  <li>Married 1969 - no children.</li>
-</ul>
-<p>I am currently an architect in the Open System Services development
-group
-within the NonStop Enterprise Division of HP.<br>
-</p>
-<p>I became interested in Internet Security when I established a home
-office
-in 1999 and had DSL service installed in our home. I investigated
-ipchains
-and developed the scripts which are now collectively known as <a
- href="http://seawall.sourceforge.net">Seattle Firewall</a>. Expanding
-on what
-I learned from Seattle Firewall, I then designed and wrote Shorewall.</p>
-<p>I telework from our <a
- href="http://lists.shorewall.net/SeattleInTheSpring.html">home</a>
-in&nbsp;<a href="http://www.cityofshoreline.com" target="_top">Shoreline,
-Washington</a>
-where I live with my wife Tarry.&nbsp;</p>
-<p>For information about our home network see <a
- href="XenMyWay-Routed.html">my Shorewall Configuration files.</a></p>
-</div>
-</body>
-</html>
diff --git a/web/shorewall.css b/web/shorewall.css
deleted file mode 100644
index 74249ca9f..000000000
--- a/web/shorewall.css
+++ /dev/null
@@ -1,47 +0,0 @@
-/* CSS stylesheet for the upcoming new shorewall website
-
-Author :  Cristian Rodriguez webmaster@shorewall.net
-
-*/
-
-HTML {background: rgb(51, 102, 255); }
-
-BODY {
-
-background: rgb(51, 102, 255);
-margin: 0em;
-
-}
-
-.menu { 
-
-font-family : Verdana, Eyechart, Geneva, Arial, Helvetica, sans-serif; 
-color : white; 
-font-weight: bold;
-font-size: small;
-padding: 4px;
-}
-
-.submenu { 
-
-font-family : Verdana, Eyechart, Geneva, Arial, Helvetica, sans-serif; 
-color : white;
-font-size: small;
-padding: 4px;
-
-}
-
-.copyright
-
-{
-
-text-align: left;
-color: white;
-font-family: Verdana, Eyechart, Geneva, Arial, Helvetica, sans-serif; 
-font-size: xx-small;
-}
-
-A:link {color: white; text-decoration: none }
-A:active {color: white;text-decoration: none}
-A:hover {color: white; text-decoration: underline; }
-A:visited {color: #E9E9E9; text-decoration: none; }
diff --git a/web/shorewall_index.htm b/web/shorewall_index.htm
deleted file mode 100644
index 1978d7161..000000000
--- a/web/shorewall_index.htm
+++ /dev/null
@@ -1,216 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
-<html>
-<head>
-  <meta http-equiv="CONTENT-TYPE" content="text/html; charset=UTF-8">
-  <title>Shoreline Firewall (Shorewall)</title>
-  <base target="_self">
-  <meta name="CREATED" content="20040920;15031500">
-  <meta name="CHANGED" content="$Id$">
-</head>
-<body dir="ltr" lang="en-US">
-<hr style="width: 100%; height: 2px;">
-<table
- style="text-align: left; width: 100%; background-color: rgb(255, 255, 255);"
- border="0" cellpadding="2" cellspacing="0">
-  <tbody>
-    <tr>
-      <td
- style="vertical-align: top; font-weight: bold; color: rgb(255, 255, 255);"><a
- href="#Releases">Current Shorewall Releases</a><br>
-      </td>
-      <td
- style="vertical-align: top; font-weight: bold; color: rgb(255, 255, 255); background-color: rgb(255, 255, 255);"><a
- href="#GettingStarted">Getting Started with Shorewall</a><br>
-      </td>
-      <td
- style="vertical-align: top; font-weight: bold; color: rgb(255, 255, 255);"><a
- href="#Info">Looking for Information?</a><br>
-      </td>
-      <td
- style="vertical-align: top; font-weight: bold; color: rgb(255, 255, 255);"><a
- href="#WhatIs">What is Shorewall?</a><br>
-      </td>
-      <td
- style="vertical-align: top; font-weight: bold; color: rgb(255, 255, 255);"><a
- href="#License">License<br>
-      </a></td>
-      <td
- style="vertical-align: top; font-weight: bold; color: rgb(255, 255, 255);"><a
- href="#Donations">Donations</a><br>
-      </td>
-      <td style="vertical-align: top;"><a href="#Logo"><span
- style="font-weight: bold;">Logo</span></a><br>
-      </td>
-      <td style="vertical-align: top; color: rgb(255, 255, 255);"><a
- href="#Copyright"><span style="font-weight: bold;">Copyright</span></a><br>
-      </td>
-    </tr>
-  </tbody>
-</table>
-<hr style="width: 100%; height: 2px;"><span style="font-weight: bold;">2009-08-03</span><br>
-<h3><a href="Notices.html"><span style="text-decoration: underline;">No
-Shorewall-shell in Shorewall 4.4 -- read the details</span></a><br>
-</h3>
-<h3><a name="Releases"></a>Current Shorewall Releases</h3>
-<table style="text-align: left; width: 100%;" border="0" cellpadding="2"
- cellspacing="0">
-  <tbody>
-    <tr>
-      <td style="vertical-align: top;">
-      <div style="margin-left: 40px;"><span style="font-weight: bold;">Current
-Stable Release</span><br>
-      </div>
-      </td>
-      <td style="vertical-align: top;"><span style="font-weight: bold;">4.2.10</span>
-(includes <a href="IPv6Support.html">IPv6 support.</a>)</td>
-      <td style="vertical-align: top;"><a
- href="http://www1.shorewall.net/pub/shorewall/4.2/shorewall-4.2.10/releasenotes.txt">Release
-notes</a> </td>
-      <td style="vertical-align: top;"><a
- href="http://www1.shorewall.net/pub/shorewall/4.2/shorewall-4.2.10/known_problems.txt">Known
-Problems</a></td>
-    </tr>
-    <tr>
-      <td style="vertical-align: top;">
-      <div style="margin-left: 40px;"><span style="font-weight: bold;">Previous
-Stable Release</span><br>
-      </div>
-      </td>
-      <td style="vertical-align: top;"><span style="font-weight: bold;">4.0.15</span><br>
-      </td>
-      <td style="vertical-align: top;"><a
- href="http://www1.shorewall.net/pub/shorewall/4.0/shorewall-4.0.15/releasenotes.txt">Release
-Notes</a><br>
-      </td>
-      <td style="vertical-align: top;"><a
- href="http://www1.shorewall.net/pub/shorewall/4.0/shorewall-4.0.15/known_problems.txt">Known
-Problems</a><br>
-      </td>
-    </tr>
-    <tr>
-      <td style="vertical-align: top;">
-      <div style="margin-left: 40px;"><span style="font-weight: bold;">Development
-Release</span><br>
-      </div>
-      </td>
-      <td style="vertical-align: top;"><span style="font-weight: bold;">4.4.0
-RC 2</span><br>
-      </td>
-      <td style="vertical-align: top;"><a
- href="http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-RC2/releasenotes.txt">Release
-Notes<br>
-      </a> </td>
-      <td style="vertical-align: top;"><a
- href="http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-RC2/known_problems.txt">Known
-Problems</a> </td>
-    </tr>
-  </tbody>
-</table>
-<p style="margin-left: 40px;">Read more about the Shorewall <a
- href="Shorewall-4.html">4.x
-releases here</a>. Get them from the <a href="download.htm">download
-sites</a></p>
-<h3><a name="GettingStarted"></a>Getting Started with Shorewall</h3>
-<p style="margin-left: 0.42in;">New to Shorewall? Download the current
-Stable
-version (see above) then select the <a
- href="shorewall_quickstart_guide.htm">QuickStart Guide</a> that most
-closely
-matches your environment and follow the step by step instructions.</p>
-<h3><a name="Info"></a>Looking for Information?</h3>
-<p style="margin-left: 0.42in;">The <a href="Documentation_Index.html">Documentation
-Index</a> is a good place to start as
-is the Site Search in the frame above.</p>
-<h3><a name="WhatIs"></a>What is Shorewall?<br>
-</h3>
-<p style="margin-left: 0.42in;">For a high level description of
-Shorewall, see the <a href="Introduction.html">Introduction to
-Shorewall</a>. To review Shorewall functionality, see the <a
- href="shorewall_features.htm">Features Page</a>.<br>
-</p>
-<h3><a name="License"></a>License</h3>
-<p style="margin-left: 0.42in;">This program is free software; you can
-redistribute it and/or modify it under the terms of <a
- href="http://www.gnu.org/licenses/gpl.html">Version 2 of the GNU
-General
-Public License</a> as published by the Free Software Foundation.</p>
-<p style="margin-left: 0.42in;">This program is distributed in the hope
-that
-it will be useful, but WITHOUT ANY WARRANTY; without even the implied
-warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
-the GNU
-General Public License for more detail.</p>
-<p style="margin-left: 0.42in;">You should have received a copy of the
-GNU
-General Public License along with this program; if not, write to the
-Free
-Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
-02110-1301 USA.</p>
-<p style="margin-left: 0.42in;">Permission is granted to copy,
-distribute
-and/or modify this document under the terms of the GNU Free
-Documentation
-License, Version 1.2 or any later version published by the Free
-Software
-Foundation; with no Invariant Sections, with no Front-Cover, and with
-no
-Back-Cover Texts. A copy of the license is included in the section
-entitled
-"GNU Free Documentation License"</p>
-<h3><a name="Donations"></a>Donations</h3>
-<div style="margin-left: 40px;"><a href="http://www.alz.org/"
- target="_top"><font color="#000080"><img
- alt="(Alzheimer's Association Logo)" src="images/alz_logo2.gif"
- name="Graphic2" align="right" border="1" height="66" width="306"></font></a><a
- href="http://www.starlight.org/" target="_top"><font color="#000080"><img
- alt="(Starlight Foundation Logo)" src="images/newlog.gif"
- name="Graphic3" align="right" border="1" height="108" width="65"></font></a>Shorewall
-is free but if you try it and
-find it useful, please consider making a donation to the <a
- href="http://www.alz.org/" target="_top">Alzheimer's Association</a>
-or to
-the <a href="http://www.starlight.org/" target="_top">Starlight
-Children's
-Foundation</a>. <br>
-</div>
-<p><br>
-</p>
-<div style="margin-left: 40px;">Thank You</div>
-<h3><a name="Logo">Logo</a></h3>
-<p style="margin-left: 40px;">The <a target="_top"
- href="http://wiki.shorewall.net/wiki/LogoDesignCompetition">Shorewall
-Logo</a> is the work of Gareth Davies of <a target="_top"
- href="http://thusa.co.za/">Thusa</a> and is licensed under the
-Creative
-Commons
-Attribution-Share Alike 2.5 South Africa License. To view a copy of
-this
-licence, visit <a
- href="http://creativecommons.org/licenses/by-sa/2.5/za/">http://creativecommons.org/licenses/by-sa/2.5/za/
-</a>or send a
-letter to Creative Commons, 171 Second Street, Suite 300, San
-Francisco,
-California 94105, USA.<br>
-</p>
-<h3><a name="Copyright">Copyright</a></h3>
-<div style="margin-left: 40px;">Copyright © 2001-2009 Thomas M.
-Eastep
-</div>
-<br>
-<div style="margin-left: 40px;">Permission is granted to copy,
-distribute and/or modify
-this
-document
-under the terms of the GNU Free Documentation License, Version 1.2 or
-any
-later version published by the Free Software Foundation; with no
-Invariant
-Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of
-the
-license is included in the section entitled <span
- style="text-decoration: underline;">"</span><a href="GnuCopyright.htm"
- target="_self">GNU Free Documentation License</a>".</div>
-<p align="left"><br>
-</p>
-</body>
-</html>
diff --git a/web/shorewall_index.html b/web/shorewall_index.html
deleted file mode 100644
index fe20fa8de..000000000
--- a/web/shorewall_index.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Frameset//EN">
-
-<html>
-  <head>
-    <meta name="generator" content=
-    "HTML Tidy for Linux (vers 1st April 2002), see www.w3.org">
-    <meta http-equiv="Content-Type" content=
-    "text/html; charset=windows-1252">
-
-    <title>Shoreline Firewall</title>
-    <meta name="GENERATOR" content="Microsoft FrontPage 4.0">
-    <meta name="ProgId" content="FrontPage.Editor.Document">
-    <meta name="Microsoft Border" content="none, default">
-  </head>
-
-  <frameset rows="90,*">
-    <frame name="banner" scrolling="no" noresize target="contents"
-    src="Banner.html">
-
-    <frameset cols="262,*">
-      <frame name="contents" target="main" src=
-      "Shorewall_index_frame.htm">
-      <frame name="main" src="shorewall_index.htm" target="_self">
-    </frameset>
-
-    <noframes>
-      <body>
-        <p>This page uses frames, but your browser doesn't support
-        them.</p>
-      </body>
-    </noframes>
-  </frameset>
-</html>
-
diff --git a/web/shorewall_mirrors.htm b/web/shorewall_mirrors.htm
deleted file mode 100644
index b3f793085..000000000
--- a/web/shorewall_mirrors.htm
+++ /dev/null
@@ -1,146 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
-<html>
-<head>
-  <meta http-equiv="CONTENT-TYPE" content="text/html; charset=UTF-8">
-  <title>Shorewall Mirrors</title>
-  <meta name="CREATED" content="20060304;10392000">
-  <meta name="CHANGED" content="20060304;10410000">
-  <meta name="ProgId" content="FrontPage.Editor.Document">
-  <meta http-equiv="Content-Language" content="en-us">
-</head>
-<body dir="ltr" lang="en-US">
-<h1 align="left">Shorewall Mirrors<br>
-</h1>
-<hr>
-<p style="font-weight: bold;" align="left">2009-01-14</p>
-<p align="left"><b>Remember that updates to the mirrors are often
-delayed for
-6-12 hours after an update to the primary site. The primary site has a
-very low bandwidth so we
-encourage
-you to use a mirror site whenever possible.<br>
-</b></p>
-<p align="left">The primary web site is <a href="http://shorewall.net/"
- target="_top">http://www1.shorewall.net</a> (Shoreline, Washington,
-USA).<br>
-</p>
-<p align="left">It
-is mirrored via rsync at:</p>
-<table style="text-align: left; width: 100%;" border="0" cellpadding="2"
- cellspacing="0">
-  <tbody>
-    <tr>
-      <td style="vertical-align: top;"><span style="font-weight: bold;">North
-America</span><br>
-      </td>
-      <td style="vertical-align: top;"><a
- href="http://www.shorewall.net/" target="_top">http://[www.]shorewall.net</a>
-(Seattle Washington, USA)</td>
-    </tr>
-    <tr>
-      <td style="vertical-align: top;"><span style="font-weight: bold;">South
-America</span><br>
-      </td>
-      <td style="vertical-align: top;"><a
- href="http://argentina.shorewall.net/" target="_top">http://argentina.shorewall.net</a>
-(Argentina)</td>
-    </tr>
-    <tr>
-      <td style="vertical-align: top;"><span style="font-weight: bold;">Europe</span><br>
-      </td>
-      <td style="vertical-align: top;"><a
- href="http://slovakia.shorewall.net/" target="_top">http://slovakia.shorewall.net</a>
-(Slovak Republic)</td>
-    </tr>
-    <tr>
-      <td style="vertical-align: top;"><br>
-      </td>
-      <td style="vertical-align: top;"><a target="_top"
- href="http://shorewall.ru/">http://shorewall.ru</a>
-(Moscow,
-Russia)</td>
-    </tr>
-    <tr>
-      <td style="vertical-align: top;"><span style="font-weight: bold;">Asia</span><br>
-      </td>
-      <td style="vertical-align: top;">Volunteers, anyone?<br>
-      </td>
-    </tr>
-    <tr>
-      <td style="vertical-align: top;"><span style="font-weight: bold;">Australia</span><br>
-      </td>
-      <td style="vertical-align: top;"><a
- href="http://www.shorewall.com.au/" target="_top">http://www.shorewall.com.au</a>
-(Australia) Downloads Only</td>
-    </tr>
-  </tbody>
-</table>
-<br>
-The primary FTP site is <a
- href="ftp://ftp1.shorewall.net/pub/shorewall/" target="_blank">ftp://ftp1.shorewall.net/pub/shorewall/</a>&nbsp;
-(Shoreline,
-Washington, USA). It is mirrored via rsync at:<br>
-<br>
-<table style="text-align: left; width: 100%;" border="0" cellpadding="2"
- cellspacing="0">
-  <tbody>
-    <tr>
-      <td style="vertical-align: top;"><span style="font-weight: bold;">North
-America</span><br>
-      </td>
-      <td style="vertical-align: top;"><a
- href="ftp://ftp.shorewall.net/pub/shorewall" target="_blank">ftp://[ftp.]shorewall.net</a>
-(Seattle, Washington, USA)</td>
-    </tr>
-    <tr>
-      <td style="vertical-align: top;"><span style="font-weight: bold;">South
-America</span></td>
-      <td style="vertical-align: top;">Volunteers, anyone?<br>
-      </td>
-    </tr>
-    <tr>
-      <td style="vertical-align: top;"><span style="font-weight: bold;">Europe</span><br>
-      </td>
-      <td style="vertical-align: top;"><a
- href="ftp://slovakia.shorewall.net/mirror/shorewall/" target="_blank">ftp://slovakia.shorewall.net/mirror/shorewall</a>
-(Slovak Republic)</td>
-    </tr>
-    <tr>
-      <td style="vertical-align: top;"><br>
-      </td>
-      <td style="vertical-align: top;"><a href="ftp://shorewall.ru/">ftp://shorewall.ru</a>
-(Moscow,
-Russia)</td>
-    </tr>
-    <tr>
-      <td style="vertical-align: top;"><br>
-      </td>
-      <td style="vertical-align: top;"><a
- href="http://shorewall.de/pub/shorewall/" target="_top">http://shorewall.de/pub/shorewall/</a>
-(Frankfurt/Main, Germany)</td>
-    </tr>
-    <tr>
-      <td style="vertical-align: top;"><span style="font-weight: bold;">Asia</span></td>
-      <td style="vertical-align: top;">Volunteers, anyone?</td>
-    </tr>
-    <tr>
-      <td style="vertical-align: top;"><span style="font-weight: bold;">Australia</span></td>
-      <td style="vertical-align: top;">Volunteers, anyone?</td>
-    </tr>
-  </tbody>
-</table>
-<br>
-<hr style="width: 100%; height: 2px;">Copyright © 2001-2009 Thomas M .
-Eastep
-<p>Permission is granted to copy, distribute and/or modify this
-document
-under the terms of the GNU Free Documentation License, Version 1.2 or
-any
-later version published by the Free Software Foundation; with no
-Invariant
-Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of
-the
-license is included in the section entitled “<a href="GnuCopyright.htm"
- target="_self">GNU Free Documentation License</a>”.</p>
-</body>
-</html>
diff --git a/web/support.html b/web/support.html
deleted file mode 100644
index dd44a51d4..000000000
--- a/web/support.html
+++ /dev/null
@@ -1,72 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
-<html>
-<head>
-  <meta name="generator"
- content="HTML Tidy for Linux (vers 1st April 2002), see www.w3.org">
-  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
-  <title>Shorewall Support</title>
-</head>
-<body>
-<h1 style="text-align: left;">Shorewall Support<br>
-</h1>
-<span style="font-weight: bold;">Tom Eastep<br>
-<br>
-</span>Copyright © 2005,2006,2007 Thomas M. Eastep<br>
-<p>Permission is granted to copy, distribute and/or modify this
-document under the terms of the GNU Free Documentation License, Version
-1.2 or any later version published by the Free Software Foundation;
-with no Invariant Sections, with no Front-Cover, and with no Back-Cover
-Texts. A copy of the license is included in the section entitled “<span
- class="quote"><a href="GnuCopyright.htm" target="_self">GNU Free
-Documentation License</a></span>”.<br>
-</p>
-<p>2007-02-09<br>
-</p>
-<hr style="width: 100%; height: 2px;"> <span style="font-weight: bold;"></span><span
- style="font-weight: bold;"><span style="text-decoration: underline;"></span></span>
-<h2>Self-Help Resources</h2>
-<ul>
-  <li><a href="shorewall_quickstart_guide.htm">QuickStart Guides</a>
-(HOWTOs for setting up Shorewall in popular configurations) </li>
-  <li><a href="Install.htm">Installation/Upgrade Instructions</a><br>
-  </li>
-  <li><a href="shorewall_features.htm">Shorewall Features</a> (What it
-can do)<br>
-  </li>
-  <li><a href="Shorewall_Doesnt.html">Limitations</a> (Some things that
-it cannot do)<br>
-  </li>
-  <li><a href="FAQ.htm">FAQs</a><br>
-  </li>
-  <li><a href="troubleshoot.htm">Troubleshooting Guide</a><br>
-  </li>
-  <li><a href="upgrade_issues.htm">Upgrade&nbsp;Issues</a> (when you
-encounter problems after upgrading your Shorewall installation)</li>
-  <li><a target="_blank"
- href="http://dir.gmane.org/gmane.comp.security.shorewall">Shorewall
-Users Mailing List Archive</a><br>
-  </li>
-</ul>
-<h2>Errata</h2>
-<ul>
-  <li>At each download site (with the exception of SourceForge), the
-directory for each release contains the following:</li>
-  <ul>
-    <li>A <span style="font-weight: bold;">known_problems.txt</span>
-file that details the problems found in that release</li>
-    <li>An <span style="font-weight: bold;">errata</span> directory
-containing updated Shorewall components that correct problems described
-in the known_problems.txt file.</li>
-  </ul>
-  <li>If you are not running the latest minor release, be sure to check
-the releases newer than yours to see if your issue has been addressed
-in a later version.<br>
-  </li>
-</ul>
-<h2>Getting Help</h2>
-<ul>
-  <li><a href="support.htm">Reporting a problem or asking for help</a><br>
-  </li>
-</ul>
-</body>
-</html>