From afd9875d3afb68ab42b40fbb4dceac8e5a18da32 Mon Sep 17 00:00:00 2001 From: Tom Eastep Date: Mon, 3 Sep 2012 10:52:22 -0700 Subject: [PATCH] Update Manpages Signed-off-by: Tom Eastep --- Shorewall/manpages/shorewall-routestopped.xml | 4 + Shorewall/manpages/shorewall-stoppedrules.xml | 162 ++++++++++++++++++ .../manpages/shorewall6-routestopped.xml | 4 + .../manpages/shorewall6-stoppedrules.xml | 155 +++++++++++++++++ 4 files changed, 325 insertions(+) create mode 100644 Shorewall/manpages/shorewall-stoppedrules.xml create mode 100644 Shorewall6/manpages/shorewall6-stoppedrules.xml diff --git a/Shorewall/manpages/shorewall-routestopped.xml b/Shorewall/manpages/shorewall-routestopped.xml index 46e35897d..ff5e267ff 100644 --- a/Shorewall/manpages/shorewall-routestopped.xml +++ b/Shorewall/manpages/shorewall-routestopped.xml @@ -24,6 +24,10 @@ Description + This file is deprecated in favor of the shorewall-stoppedrules(5) + file. + This file is used to define the hosts that are accessible when the firewall is stopped or is being stopped. diff --git a/Shorewall/manpages/shorewall-stoppedrules.xml b/Shorewall/manpages/shorewall-stoppedrules.xml new file mode 100644 index 000000000..ebaedc9fe --- /dev/null +++ b/Shorewall/manpages/shorewall-stoppedrules.xml @@ -0,0 +1,162 @@ + + + + + shorewall-stoppedrules + + 5 + + + + stoppedrules + + The Shorewall file that governs what traffic flows through the + firewall while it is in the 'stopped' state. + + + + + /etc/shorewall/stoppedrules + + + + + Description + + This file is used to define the hosts that are accessible when the + firewall is stopped or is being stopped. + + + Changes to this file do not take effect until after the next + shorewall start, shorewall + restart, or command. + + + The columns in the file are as follows (where the column name is + followed by a different name in parentheses, the different name is used in + the alternate specification syntax). + + + + ACTION - + + + + Determines the disposition of the packet. + means that the packet will be accepted. + indicates that no conntrack entry should be + created for the packet. does not imply + . + + + + + SOURCE - [-|[$FW|interface]|[{$FW|interface}[:address[,address]...]]|[address[,address]...] + + + matches packets originating on the + firewall itself, while interface + specifies packets arriving on the named interface. + + This column may also include a omma-separated list of + IP/subnet addresses. If your kernel and iptables include iprange + match support, IP address ranges are also allowed. Ipsets and + exclusion are also supported. When or interface + are specified, the list must be preceeded by a colon (":"). + + If left empty or supplied as "-", 0.0.0.0/0 is assumed. + + + + + DEST - [-|[$FW|interface]|[{$FW|interface}[:address[,address]...]]|[address[,address]...] + + + matches packets addressed the firewall + itself, while interface specifies packets + arriving on the named interface. Neither may be specified if the + target is . + + This column may also include a omma-separated list of + IP/subnet addresses. If your kernel and iptables include iprange + match support, IP address ranges are also allowed. Ipsets and + exclusion are also supported. When or interface + are specified, the list must be preceeded by a colon (":"). + + If left empty or supplied as "-", 0.0.0.0/0 is assumed. + + + + + PROTO (Optional) ‒ + protocol-name-or-number + + + Protocol. + + + + + DEST PORT(S) (dport) ‒ + service-name/port-number-list + + + Optional. A comma-separated list of port numbers and/or + service names from /etc/services. May also + include port ranges of the form + low-port:high-port + if your kernel and iptables include port range support. + + + + + SOURCE PORT(S) (sport) ‒ + service-name/port-number-list + + + Optional. A comma-separated list of port numbers and/or + service names from /etc/services. May also + include port ranges of the form + low-port:high-port + if your kernel and iptables include port range support. + + + + + + The source and dest options work best when used in conjunction + with ADMINISABSENTMINDED=Yes in shorewall.conf(5). + + + + + FILES + + /etc/shorewall/stoppedrules + + + + See ALSO + + http://shorewall.net/starting_and_stopping_shorewall.htm + + http://shorewall.net/configuration_file_basics.htm#Pairs + + shorewall(8), shorewall-accounting(5), shorewall-actions(5), + shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5), + shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5), + shorewall-nat(5), shorewall-netmap(5), shorewall-params(5), + shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5), + shorewall-rtrules(5), shorewall-rules(5), shorewall.conf(5), + shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5), + shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5), + shorewall-zones(5) + + diff --git a/Shorewall6/manpages/shorewall6-routestopped.xml b/Shorewall6/manpages/shorewall6-routestopped.xml index 6b28d98d9..13b60fde9 100644 --- a/Shorewall6/manpages/shorewall6-routestopped.xml +++ b/Shorewall6/manpages/shorewall6-routestopped.xml @@ -24,6 +24,10 @@ Description + This file is deprecated in favor of the shorewall6-stoppedrules(5) + file. + This file is used to define the hosts that are accessible when the firewall is stopped or is being stopped. When shorewall6-shell is being used, the file also determines those hosts that are accessible when the diff --git a/Shorewall6/manpages/shorewall6-stoppedrules.xml b/Shorewall6/manpages/shorewall6-stoppedrules.xml new file mode 100644 index 000000000..c0133e6e2 --- /dev/null +++ b/Shorewall6/manpages/shorewall6-stoppedrules.xml @@ -0,0 +1,155 @@ + + + + + shorewall6-stoppedrules + + 5 + + + + stoppedrules + + The Shorewall file that governs what traffic flows through the + firewall while it is in the 'stopped' state. + + + + + /etc/shorewall6/stoppedrules + + + + + Description + + This file is used to define the hosts that are accessible when the + firewall is stopped or is being stopped. + + + Changes to this file do not take effect until after the next + shorewall start, shorewall + restart, or command. + + + The columns in the file are as follows (where the column name is + followed by a different name in parentheses, the different name is used in + the alternate specification syntax). + + + + ACTION - + + + + Determines the disposition of the packet. + means that the packet will be accepted. + indicates that no conntrack entry should be + created for the packet. does not imply + . + + + + + SOURCE - [-|[$FW|interface]|[{$FW|interface}[:address[,address]...]]|[address[,address]...] + + + matches packets originating on the + firewall itself, while interface + specifies packets arriving on the named interface. + + This column may also include a omma-separated list of + IP/subnet addresses. If your kernel and iptables include iprange + match support, IP address ranges are also allowed. Ipsets and + exclusion are also supported. When or interface + are specified, the list must be preceeded by a colon (":"). + + If left empty or supplied as "-", 0.0.0.0/0 is assumed. + + + + + DEST - [-|[$FW|interface]|[{$FW|interface}[:address[,address]...]]|[address[,address]...] + + + matches packets addressed the firewall + itself, while interface specifies packets + arriving on the named interface. Neither may be specified if the + target is . + + This column may also include a omma-separated list of + IP/subnet addresses. If your kernel and iptables include iprange + match support, IP address ranges are also allowed. Ipsets and + exclusion are also supported. When or interface + are specified, the list must be preceeded by a colon (":"). + + If left empty or supplied as "-", 0.0.0.0/0 is assumed. + + + + + PROTO (Optional) ‒ + protocol-name-or-number + + + Protocol. + + + + + DEST PORT(S) (dport) ‒ + service-name/port-number-list + + + Optional. A comma-separated list of port numbers and/or + service names from /etc/services. May also + include port ranges of the form + low-port:high-port + if your kernel and iptables include port range support. + + + + + SOURCE PORT(S) (sport) ‒ + service-name/port-number-list + + + Optional. A comma-separated list of port numbers and/or + service names from /etc/services. May also + include port ranges of the form + low-port:high-port + if your kernel and iptables include port range support. + + + + + + + FILES + + /etc/shorewall6/stoppedrules + + + + See ALSO + + http://shorewall.net/starting_and_stopping_shorewall.htm + + http://shorewall.net/configuration_file_basics.htm#Pairs + + shorewall(8), shorewall-accounting(5), shorewall-actions(5), + shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5), + shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5), + shorewall-nat(5), shorewall-netmap(5), shorewall-params(5), + shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5), + shorewall-rtrules(5), shorewall-rules(5), shorewall.conf(5), + shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5), + shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5), + shorewall-zones(5) + +