holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Update web site for 2.4.0

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2226 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2005-06-05 15:38:00 +00:00
parent aef84305b4
commit a3ad40f97c
2 changed files with 505 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

494
Shorewall-Website/News.htm
View File

@ -19,9 +19,499 @@ Texts. A copy of the license is included in the section entitled “<span
class="quote"><a href="GnuCopyright.htm" target="_self">GNU Free class="quote"><a href="GnuCopyright.htm" target="_self">GNU Free
Documentation License</a></span>”.<br> Documentation License</a></span>”.<br>
</p> </p>
<p>2005-05-26<br> <p>2005-06-05<br>
</p> </p>
<hr style="width: 100%; height: 2px;"><span style="font-weight: bold;">05/20/2005&nbsp; <hr style="width: 100%; height: 2px;"><span style="font-weight: bold;">06/05/2005
Shorewall 2.4.0<br>
<br>
Note:</span> Because of the short time that has elapsed since the
release of Shorewall 2.2.0, Shorewall 2.0 will be supported until 1
December 2005 or until the release of Shorewall 2.6.0, whichever occurs
first.<br>
<br>
New Features:<br>
<ol>
<li>Shorewall 2.4.0 includes support for multiple internet interfaces
to different ISPs.<br>
<br>
The file /etc/shorewall/providers may be used to define the different
providers. It can actually be used to define alternate routing tables
so uses like transparent proxy can use the file as well.<br>
<br>
Columns are:<br>
<br>
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
NAME&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
The provider name.</span><br style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
NUMBER&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The
provider number -- a number between 1 and 15</span><br
style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
MARK&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
A FWMARK value used in your /etc/shorewall/tcrules file to direct
packets for this provider.</span><br style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
DUPLICATE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The name of an existing
table to duplicate. May</span><span style="font-family: monospace;"> be
'main' or the name of a previous provider.</span><br
style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
INTERFACE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The name of the network
interface to the</span><span style="font-family: monospace;"> provider.
Must be listed in</span><span style="font-family: monospace;">
/etc/shorewall/interfaces.</span><br style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
GATEWAY&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The IP address
of the provider's gateway router.</span><span
style="font-family: monospace;"> If you enter "detect" here then
Shorewall will</span><span style="font-family: monospace;"> attempt to
determine the gateway IP address</span><span
style="font-family: monospace;"> automatically.</span><br
style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
OPTIONS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; A
comma-separated list selected from the</span><span
style="font-family: monospace;"> following:</span><br
style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
track&nbsp;&nbsp; If specified, connections FROM this interface are</span><span
style="font-family: monospace;"> to be tracked so that responses may
be routed</span><span style="font-family: monospace;"> back out this
same interface.</span><br style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
You want specify 'track' if internet hosts will be</span><span
style="font-family: monospace;"> connecting to local servers through
this</span><span style="font-family: monospace;"> provider.</span><br
style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
Because of limitations in the 'ip' utility and</span><span
style="font-family: monospace;"> policy routing, you may not use the
SAVE or</span><span style="font-family: monospace;"> RESTORE tcrules
options or use connection</span><span style="font-family: monospace;">
marking on any traffic to or from this</span><br
style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
interface. For traffic control purposes, you</span><span
style="font-family: monospace;"> must mark packets in the FORWARD
chain (or</span><span style="font-family: monospace;"> better yet, use
the CLASSIFY target).</span><br style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
balance The providers that have 'balance' specified will</span><span
style="font-family: monospace;"> get outbound traffic load-balanced
among them. By</span><span style="font-family: monospace;"> default,
all interfaces with 'balance' specified</span><span
style="font-family: monospace;"> will have the same
weight&nbsp;&nbsp;&nbsp; <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
(1). You can change the</span><span style="font-family: monospace;">
weight of the route out of the interface by</span><span
style="font-family: monospace;"> specifiying balance=&lt;weight&gt;
where &lt;weight&gt; is</span><span style="font-family: monospace;">
the desired route weight.</span><br style="font-family: monospace;">
<br style="font-family: monospace;">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Example:&nbsp; You run squid in
your DMZ on IP address 192.168.2.99. Your DMZ interface is eth2<br>
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
#NAME&nbsp;&nbsp; NUMBER&nbsp; MARK DUPLICATE&nbsp; INTERFACE
GATEWAY&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; OPTIONS</span><br
style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
Squid&nbsp;&nbsp; 1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
1&nbsp;&nbsp;&nbsp;
-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
eth2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.2.99&nbsp; -</span><br>
<br>
&nbsp;&nbsp; Use of this feature requires that your kernel and iptabls
support CONNMARK target and conntrack match support. It does NOT
require the ROUTE target extension.<br>
<br>
&nbsp;&nbsp; WARNING: The current version of iptables (1.3.1) is broken
with respect to CONNMARK and iptables-save/iptables-restore. This means
that if you configure multiple ISPs, "shorewall restore" may<br>
&nbsp;&nbsp; fail. You must patch your iptables using the patch at <a
href="http://shorewall.net/pub/shorewall/contrib/iptables/CONNMARK.diff">http://shorewall.net/pub/shorewall/contrib/iptables/CONNMARK.diff</a>.<br>
<br>
</li>
<li>Shorewall 2.3.0 supports the 'cmd-owner' option of the owner
match facility in Netfilter. Like all owner match options, 'cmd-owner'
may only be applied to traffic that originates on the firewall.<br>
<br>
The syntax of the USER/GROUP column in the following files has been
extended:<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /etc/shorewall/accounting<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /etc/shorewall/rules<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /etc/shorewall/tcrules<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
/usr/share/shorewall/action.template<br>
<br>
To specify a command, prefix the command name with "+".<br>
<br>
&nbsp;&nbsp; Examples:<br>
<br>
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+mozilla-bin&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
#The program is named "mozilla-bin"</span><br
style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
joe+mozilla-bin&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #The
program is named "mozilla-bin" and</span><br
style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
#is being run by user "joe"</span><br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
joe:users+mozilla-bin&nbsp;&nbsp; #The program is named "mozilla-bin"
and</span><br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
#is being run by user "joe" with</span><br
style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
#effective group "users".</span><br style="font-family: monospace;">
<br>
&nbsp;&nbsp; Note that this is not a particularly robust feature and I
would never advertise it as a "Personal Firewall" equivalent. Using
symbolic links, it's easy to alias command names to be anything you
want.<br>
<br>
</li>
<li>Support has been added for ipsets (see <a
href="http://people.netfilter.org/kadlec/ipset/">http://people.netfilter.org/kadlec/ipset/</a>).<br>
<br>
In most places where a host or network address may be used, you may
also use the name of an ipset prefaced by "+".<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Example: "+Mirrors"<br>
<br>
The name of the set may be optionally followed by:<br>
<br>
a) a number from 1 to 6 enclosed in square brackets ([]) -- this number
indicates the maximum number of ipset binding levels that are to be
matched. Depending on the context where the ipset name is used, either
all "src" or all "dst" matches will be used.<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Example: "+Mirrors[4]"<br>
<br>
b) a series of "src" and "dst" options separated by commas and inclosed
in square brackets ([]). These will be passed directly to iptables in
the generated --set clause. See the ipset documentation for details.<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Example:
"+Mirrors[src,dst,src]"<br>
<br>
Note that "+Mirrors[4]" used in the SOURCE column of the rules file is
equivalent to "+Mirrors[src,src,src,src]".<br>
<br>
To generate a negative match, prefix the "+" with "!" as in "!+Mirrors".<br>
<br>
Example 1: Blacklist all hosts in an ipset named "blacklist"<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
/etc/shorewall/blacklist<br>
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
#ADDRESS/SUBNET&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
PROTOCOL&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; PORT</span><br
style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+blacklist</span><br style="font-family: monospace;">
<br>
Example 2: Allow SSH from all hosts in an ipset named "sshok:<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
/etc/shorewall/rules<br>
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
#ACTION&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
SOURCE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DEST&nbsp;&nbsp;&nbsp;&nbsp;
PROTO&nbsp;&nbsp;&nbsp; DEST PORT(S)</span><br
style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
ACCEPT&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+sshok&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
fw&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
tcp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 22</span><br
style="font-family: monospace;">
<br>
Shorewall can automatically capture the contents of your ipsets for
you. If you specify SAVE_IPSETS=Yes in /etc/shorewall/shorewall.conf
then "shorewall save" will save the contents of your ipsets. The file
where the sets are saved is formed by taking the name where the
Shorewall configuration is stored and appending "-ipsets". So if you
enter the command "shorewall save standard" then your Shorewall
configuration will be saved in var/lib/shorewall/standard and your
ipset contents will be saved in /var/lib/shorewall/standard-ipsets.
Assuming the default RESTOREFILE setting, if you just enter "shorewall
save" then your Shorewall configuration will be saved in
/var/lib/shorewall/restore and your ipset contents will be saved in
/var/lib/shorewall/restore-ipsets.<br>
<br>
Regardless of the setting of SAVE_IPSETS, the "shorewall -f start" and
"shorewall restore" commands will restore the ipset contents
corresponding to the Shorewall configuration restored provided that the
saved Shorewall configuration specified exists.<br>
<br>
For example, "shorewall restore standard" would restore the ipset
contents from /var/lib/shorewall/standard-ipsets provided that
/var/lib/shorewall/standard exists and is executable and that
/var/lib/shorewall/standard-ipsets exists and is executable.<br>
<br>
Also regardless of the setting of SAVE_IPSETS, the "shorewall forget"
command will purge the saved ipset information (if any) associated with
the saved shorewall configuration being removed.<br>
<br>
You can also associate ipset contents with Shorewall configuration
directories using the following command:<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipset -S &gt; &lt;config
directory&gt;/ipsets<br>
<br>
Example:<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipset -S &gt; /etc/shorewall/ipsets<br>
<br>
When you start or restart Shorewall (including using the 'try' command)
from the configuration directory, your ipsets will be configured from
the saved ipsets file. Once again, this behavior is independent of the
setting of SAVE_IPSETS.<br>
<br>
Ipsets are well suited for large blacklists. You can maintain your
blacklist using the 'ipset' utility without ever having to restart or
refresh Shorewall. If you use the SAVE_IPSETS=Yes feature just be sure
to "shorewall save" after altering the blacklist ipset(s).<br>
<br>
Example /etc/shorewall/blacklist:<br>
<br>
<span style="font-family: monospace;">&nbsp;&nbsp;
#ADDRESS/SUBNET&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
PROTOCOL&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; PORT</span><br
style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;
+Blacklist[src,dst]</span><br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;
+Blacklistnets[src,dst]</span><br style="font-family: monospace;">
<br>
Create the blacklist ipsets using:<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipset -N
Blacklist iphash<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipset -N
Blacklistnets nethash<br>
<br>
Add entries<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipset -A Blacklist 206.124.146.177<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipset -A Blacklistnets
206.124.146.0/24<br>
<br>
To allow entries for individual ports<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipset -N SMTP portmap --from 1
--to 31<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipset -A SMTP 25<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipset -A Blacklist 206.124.146.177<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipset -B Blacklist 206.124.146.177
-b SMTP<br>
<br>
Now only port 25 will be blocked from 206.124.146.177.<br>
<br>
</li>
<li>Shorewall 2.4.0 can now configure routing if your kernel and
iptables support the ROUTE target extension. This extension is
available in Patch-O-Matic-ng. This feature is *EXPERIMENTAL* since the
Netfilter team have no intention of ever releasing the ROUTE target
extension to kernel.org.<br>
<br>
Routing is configured using the /etc/shorewall/routes file. Columns in
the file are as follows:<br>
<br>
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
SOURCE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
Source of the packet. May be any of the</span><span
style="font-family: monospace;"> following:</span><br
style="font-family: monospace;">
<br style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
- A host or network address</span><br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
- A network interface name.</span><br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
- The name of an ipset prefaced with "+"</span><br
style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
- $FW (for packets originating on the firewall)</span><br
style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
- A MAC address in Shorewall format</span><br
style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
- A range of IP addresses (assuming that your</span><span
style="font-family: monospace;"> kernel and iptables support range
match)</span><br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
- A network interface name followed by ":"</span><span
style="font-family: monospace;"> and an address or address range.</span><br
style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
DEST&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
Destination of the packet. May be any of the</span><span
style="font-family: monospace;"> following:</span><br
style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
- A host or network address</span><br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
- A network interface name (determined from</span><br
style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
routing table(s))</span><br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
- The name of an ipset prefaced with "+"</span><br
style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
- A network interface name followed by ":"</span><br
style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
and an address or address range.</span><br
style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
PROTO&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
Protocol - Must be "tcp", "udp", "icmp",</span><span
style="font-family: monospace;"> "ipp2p", a number, or "all". "ipp2p"
requires</span><span style="font-family: monospace;"> ipp2p match
support in your kernel and</span><span style="font-family: monospace;">
iptables.</span><br style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
PORT(S)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Destination
Ports. A comma-separated list of</span><span
style="font-family: monospace;"> Port names (from /etc/services), port
numbers</span><span style="font-family: monospace;"> or port ranges; if
the protocol is "icmp", this</span><span style="font-family: monospace;">
column is interpreted as the destination</span><span
style="font-family: monospace;"> icmp-type(s).</span><br
style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
If the protocol is ipp2p, this column is</span><span
style="font-family: monospace;"> interpreted as an ipp2p option
without the</span><span style="font-family: monospace;"> leading "--"
(example "bit" for bit-torrent).</span><span
style="font-family: monospace;"> If no PORT is given, "ipp2p" is
assumed.</span><br style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
This column is ignored if PROTOCOL = all but</span><span
style="font-family: monospace;"> must be entered if any of the
following field</span><span style="font-family: monospace;"> is
supplied. In that case, it is suggested that</span><span
style="font-family: monospace;"> this field contain "-"</span><br
style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
SOURCE PORT(S)&nbsp; (Optional) Source port(s). If omitted,</span><span
style="font-family: monospace;"> any source port is acceptable.
Specified as a</span><span style="font-family: monospace;">
comma-separated list of port names, port</span><span
style="font-family: monospace;"> numbers or port ranges.</span><br
style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
TEST&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
Defines a test on the existing packet or</span><span
style="font-family: monospace;"> connection mark.</span><br
style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
The rule will match only if the test returns</span><span
style="font-family: monospace;"> true. Tests have the format</span><span
style="font-family: monospace;"> [!]&lt;value&gt;[/&lt;mask&gt;][:C]</span><br
style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
Where:</span><br style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
!&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Inverts the test (not equal)</span><span
style="font-family: monospace;"> &lt;value&gt; Value of the packet or</span><span
style="font-family: monospace;"> connection mark.</span><br
style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&lt;mask&gt;&nbsp; A mask to be applied to the</span><span
style="font-family: monospace;"> mark before testing</span><br
style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
:C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Designates a connection</span><span
style="font-family: monospace;"> mark. If omitted, the packet</span><span
style="font-family: monospace;"> mark's value is tested.</span><br
style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
INTERFACE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The interface that the
packet is to be routed</span><span style="font-family: monospace;"> out
of. If you do not specify this field then</span><span
style="font-family: monospace;"> you must place "-" in this column and
enter an</span><span style="font-family: monospace;"> IP address in the
GATEWAY column.</span><br style="font-family: monospace;">
<br style="font-family: monospace;">
<span style="font-family: monospace;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
GATEWAY&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The gateway
that the packet is to be forewarded</span><span
style="font-family: monospace;"> through.</span><br
style="font-family: monospace;">
<br style="font-family: monospace;">
</li>
<li>Normally when Shorewall is stopped, starting or restarting then
connections are allowed from hosts listed in
/etc/shorewall/routestopped to the firewall and to other hosts listed
in /etc/shorewall/routestopped.<br>
<br>
A new 'source' option is added for entries in that file which will
cause Shorewall to allow traffic from the host listed in the entry to
ANY other host. When 'source' is specified in an entry, it is
unnecessary to also specify 'routeback'.<br>
<br>
Similarly, a new 'dest' option is added which will cause Shorewall to
allow traffic to the host listed in the entry from ANY other host. When
'source' is specified in an entry, it is unnecessary to also specify
'routeback'.<br>
<br>
</li>
<li>This change was implemented by Lorenzo Martignoni. It provides
two new commands: "safe-start" and "safe-restart".<br>
<br>
<span style="font-weight: bold;">safe-start</span> starts Shorewall
then prompts you to ask you if everything looks ok. If you answer "no"
or if you don't answer within 60 seconds, a "shorewall clear" is
executed.<br>
<br>
<span style="font-weight: bold;">safe-restart</span> saves your
current configuration to /var/lib/shorewall/safe-restart then issues a
"shorewall restart"; It then prompts you to ask if you if you want to
accept the new configuration. If you answer "no" or if you don't answer
within 60 seconds, the configuration is restored to its prior state.<br>
<br>
These new commands require either that your /bin/sh supports the "-t"
option to the 'read' command or that you have /bin/bash installed.<br>
</li>
</ol>
<span style="font-weight: bold;">05/20/2005&nbsp;
Shorewall CVS Repository has Moved to Sourceforge<br> Shorewall CVS Repository has Moved to Sourceforge<br>
<br> <br>
</span>The CVS repository may now be accessed at <a target="_top" </span>The CVS repository may now be accessed at <a target="_top"

26
Shorewall-Website/shorewall_index.htm
View File

@ -12,8 +12,15 @@
<h1><span style="font-weight: bold;"></span>Shorewall 2.x</h1> <h1><span style="font-weight: bold;"></span>Shorewall 2.x</h1>
<h2><a <h2><a
href="http://lists.shorewall.net/pipermail/shorewall-users/2005-May/018605.html">A href="http://lists.shorewall.net/pipermail/shorewall-users/2005-May/018605.html">A
Note About the Future of Shorewall from Tom Eastep</a><br> Note About the Future of Shorewall from Tom Eastep</a></h2>
<h2>A Note of Thanks<br>
</h2> </h2>
I would like to thank each and every one of you who have written to
offer your best wishes regarding my retirement from Shorewall. There
have been just too many posts to try to answer individually but I want
you to know that I appreciate your having taking the time to write.<br>
<br>
-Tom<br>
<hr style="width: 100%; height: 2px;"> <hr style="width: 100%; height: 2px;">
<p>The information on this site applies only <p>The information on this site applies only
to 2.x releases of Shorewall. For older versions:</p> to 2.x releases of Shorewall. For older versions:</p>
@ -31,19 +38,12 @@ to 2.x releases of Shorewall. For older versions:</p>
target="_top">here</a>. </p> target="_top">here</a>. </p>
</li> </li>
</ul> </ul>
<p>The current 2.2 Stable Release is 2.2.5 -- Here are the <a <p>The current 2.4 Stable Release is 2.4.0 -- Here are the <a
href="http://shorewall.net/pub/shorewall/2.2/shorewall-2.2.5/releasenotes.txt">release href="http://shorewall.net/pub/shorewall/2.4/shorewall-2.4.0/releasenotes.txt">release
notes</a> and here are the <a notes</a> and here are the <a
href="http://shorewall.net/pub/shorewall/2.2/shorewall-2.2.5/known_problems.txt">known href="http://shorewall.net/pub/shorewall/2.4/shorewall-2.4.0/known_problems.txt">known
problems</a> and <a problems</a> and <a
href="http://shorewall.net/pub/shorewall/2.2/shorewall-2.2.5/errata/">updates</a>.<br> href="http://shorewall.net/pub/shorewall/2.4/shorewall-2.4.0/errata/">updates</a>.<br>
</p>
<p>The current 2.3 Development Release is 2.4.0-RC2 -- Here are the <a
href="http://shorewall.net/pub/shorewall/2.4/shorewall-2.4.0-RC2/releasenotes.txt">release
notes</a> and here are the <a
href="http://shorewall.net/pub/shorewall/2.4/shorewall-2.4.0-RC2/known_problems.txt">known
problems</a> and <a
href="http://shorewall.net/pub/shorewall/2.4/shorewall-2.4.0-RC2/errata/">updates</a>.
</p> </p>
<p><a <p><a
href="http://lists.shorewall.net/pipermail/shorewall-announce/2004-December/000451.html"><span href="http://lists.shorewall.net/pipermail/shorewall-announce/2004-December/000451.html"><span
@ -58,7 +58,7 @@ Foundation; with no Invariant Sections, with no Front-Cover, and with
no Back-Cover Texts. A copy of the license is included in the section no Back-Cover Texts. A copy of the license is included in the section
entitled “<a href="GnuCopyright.htm" target="_self">GNU entitled “<a href="GnuCopyright.htm" target="_self">GNU
Free Documentation License</a>”.</p> Free Documentation License</a>”.</p>
<p>2005-05-30</p> <p>2005-06-05</p>
<hr style="width: 100%; height: 2px;"> <hr style="width: 100%; height: 2px;">
<h3>Table of Contents</h3> <h3>Table of Contents</h3>
<p style="margin-left: 0.42in; margin-bottom: 0in;"><a href="#Intro">Introduction <p style="margin-left: 0.42in; margin-bottom: 0in;"><a href="#Intro">Introduction