diff --git a/docs/CompiledPrograms.xml b/docs/CompiledPrograms.xml index 294038c38..978767bf1 100644 --- a/docs/CompiledPrograms.xml +++ b/docs/CompiledPrograms.xml @@ -217,7 +217,8 @@ - On each firewall system, you run: + If you are running Shorewall 3.2.5 or earlier, then on each + firewall system, you run: /usr/share/shorewall-lite/shorecap > capabilities scp capabilities <admin system>:<this system's config dir> @@ -274,19 +275,45 @@ - cd <export directory> + If you are running Shorewall 3.2.5 or earlier then: + +
+ cd <export directory> /sbin/shorewall load firewall - The load - command compiles a firewall script from the configuration files in - the current working directory (using shorewall compile - -e), copies that file to the remote system via scp and - starts Shorewall Lite on the remote system via ssh. + The load + command compiles a firewall script from the configuration files + in the current working directory (using shorewall + compile -e), copies that file to the remote system via + scp and starts Shorewall Lite on the remote system via + ssh. - Example (firewall's DNS name is 'gateway'): + Example (firewall's DNS name is 'gateway'): - /sbin/shorewall load gateway + /sbin/shorewall load gateway +
+ + If you are running Shorewall 3.2.6 or later then: + +
+ cd <export directory> +/sbin/shorewall load -c firewall + + The load + command compiles a firewall script from the configuration files + in the current working directory (using shorewall + compile -e), copies that file to the remote system via + scp and starts Shorewall Lite on the remote system via ssh. The + -c option causes the capabilities of the remote system to be + generated and copied to a file named capabilities in the export + directory. See below. + + Example (firewall's DNS name is 'gateway'): + + /sbin/shorewall load -c gateway +
@@ -303,7 +330,22 @@ command compiles a firewall script from the configuration files in the current working directory (using shorewall compile -e), copies that file to the remote system via scp and - restarts Shorewall Lite on the remote system via ssh. + restarts Shorewall Lite on the remote system via ssh. #Note: In + Shorewall 3.2.6 and later, the reload + command also supports the '-c' option. + + I personally place a Makefile in each export directory as + follows: + +
+ ignorefiles = firewall* Makefile* trace* +all: firewall +firewall: $(filter-out $(ignorefiles) , $(wildcard *) ) + @shorewall reload -c -s gateway +
+ + That way, after I've change the configuration, I can simply type + make. @@ -498,7 +540,7 @@ -
+
The /etc/shorewall/capabilities file and the shorecap program