forked from extern/shorewall_code
Shorewall 1.4.3 Documentation
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@552 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
cd271ac59f
commit
ee6bdaaec4
File diff suppressed because it is too large
Load Diff
@ -1,226 +1,219 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shorewall Installation</title>
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#ffffff">Shorewall Installation and
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#ffffff">Shorewall Installation and
|
||||
Upgrade</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<p align="center"><b>Before upgrading, be sure to review the <a
|
||||
href="upgrade_issues.htm">Upgrade Issues<br>
|
||||
</a></b></p>
|
||||
|
||||
<div align="left"><b>Before attempting installation, I strongly urge you to
|
||||
read and print a copy of the <a
|
||||
href="shorewall_quickstart_guide.htm">Shorewall QuickStart Guide</a>
|
||||
for the configuration that most closely matches your own.</b><br>
|
||||
</div>
|
||||
|
||||
</a></b></p>
|
||||
|
||||
<div align="left"><b>Before attempting installation, I strongly urge you
|
||||
to read and print a copy of the <a
|
||||
href="shorewall_quickstart_guide.htm">Shorewall QuickStart Guide</a>
|
||||
for the configuration that most closely matches your own.</b><br>
|
||||
</div>
|
||||
|
||||
<p><font size="4"><b><a href="#Install_RPM">Install using RPM</a><br>
|
||||
<a href="#Install_Tarball">Install using tarball<br>
|
||||
</a><a href="#LRP">Install the .lrp</a><br>
|
||||
<a href="#Upgrade_RPM">Upgrade using RPM</a><br>
|
||||
<a href="#Upgrade_Tarball">Upgrade using tarball<br>
|
||||
</a><a href="#LRP_Upgrade">Upgrade the .lrp</a><br>
|
||||
<a href="#Config_Files">Configuring Shorewall</a><br>
|
||||
<a href="fallback.htm">Uninstall/Fallback</a></b></font></p>
|
||||
|
||||
<a href="#Install_Tarball">Install using tarball<br>
|
||||
</a><a href="#LRP">Install the .lrp</a><br>
|
||||
<a href="#Upgrade_RPM">Upgrade using RPM</a><br>
|
||||
<a href="#Upgrade_Tarball">Upgrade using tarball<br>
|
||||
</a><a href="#LRP_Upgrade">Upgrade the .lrp</a><br>
|
||||
<a href="#Config_Files">Configuring Shorewall</a><br>
|
||||
<a href="fallback.htm">Uninstall/Fallback</a></b></font></p>
|
||||
|
||||
<p><a name="Install_RPM"></a>To install Shorewall using the RPM:</p>
|
||||
|
||||
<p><b>If you have RedHat 7.2 and are running iptables version 1.2.3 (at a
|
||||
shell prompt, type "/sbin/iptables --version"), you must upgrade to version
|
||||
|
||||
<p><b>If you have RedHat 7.2 and are running iptables version 1.2.3 (at a
|
||||
shell prompt, type "/sbin/iptables --version"), you must upgrade to version
|
||||
1.2.4 either from the <a
|
||||
href="http://www.redhat.com/support/errata/RHSA-2001-144.html">RedHat update
|
||||
site</a> or from the <a href="errata.htm">Shorewall Errata page</a> before
|
||||
href="http://www.redhat.com/support/errata/RHSA-2001-144.html">RedHat update
|
||||
site</a> or from the <a href="errata.htm">Shorewall Errata page</a> before
|
||||
attempting to start Shorewall.</b></p>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>Install the RPM (rpm -ivh <shorewall rpm>).<br>
|
||||
<br>
|
||||
<b>Note1: </b>Some SuSE users have encountered a problem whereby
|
||||
rpm reports a conflict with kernel <= 2.2 even though a 2.4 kernel
|
||||
is installed. If this happens, simply use the --nodeps option to rpm
|
||||
<li>Install the RPM (rpm -ivh <shorewall rpm>).<br>
|
||||
<br>
|
||||
<b>Note1: </b>Some SuSE users have encountered a problem whereby
|
||||
rpm reports a conflict with kernel <= 2.2 even though a 2.4 kernel
|
||||
is installed. If this happens, simply use the --nodeps option to rpm
|
||||
(rpm -ivh --nodeps <shorewall rpm>).<br>
|
||||
<br>
|
||||
<b>Note2: </b>Beginning with Shorewall 1.4.0, Shorewall is dependent
|
||||
on the iproute package. Unfortunately, some distributions call this package
|
||||
iproute2 which will cause the installation of Shorewall to fail with the
|
||||
<br>
|
||||
<b>Note2: </b>Beginning with Shorewall 1.4.0, Shorewall is dependent
|
||||
on the iproute package. Unfortunately, some distributions call this package
|
||||
iproute2 which will cause the installation of Shorewall to fail with the
|
||||
diagnostic:<br>
|
||||
<br>
|
||||
error: failed dependencies:iproute is needed by shorewall-1.4.0-1
|
||||
<br>
|
||||
error: failed dependencies:iproute is needed by shorewall-1.4.0-1
|
||||
<br>
|
||||
<br>
|
||||
This may be worked around by using the --nodeps option of rpm (rpm -ivh
|
||||
--nodeps <shorewall rpm>).<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Edit the <a href="#Config_Files"> configuration files</a> to
|
||||
match your configuration. <font color="#ff0000"><b>WARNING - YOU CAN <u>NOT</u>
|
||||
SIMPLY INSTALL THE RPM AND ISSUE A "shorewall start" COMMAND. SOME CONFIGURATION
|
||||
IS REQUIRED BEFORE THE FIREWALL WILL START. IF YOU ISSUE A "start" COMMAND
|
||||
AND THE FIREWALL FAILS TO START, YOUR SYSTEM WILL NO LONGER ACCEPT ANY
|
||||
NETWORK TRAFFIC. IF THIS HAPPENS, ISSUE A "shorewall clear" COMMAND TO
|
||||
RESTORE NETWORK CONNECTIVITY.</b></font></li>
|
||||
<li>Start the firewall by typing "shorewall start"</li>
|
||||
|
||||
<br>
|
||||
This may be worked around by using the --nodeps option of rpm (rpm -ivh
|
||||
--nodeps <shorewall rpm>).<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Edit the <a href="#Config_Files"> configuration files</a>
|
||||
to match your configuration. <font color="#ff0000"><b>WARNING - YOU CAN
|
||||
<u>NOT</u> SIMPLY INSTALL THE RPM AND ISSUE A "shorewall start" COMMAND.
|
||||
SOME CONFIGURATION IS REQUIRED BEFORE THE FIREWALL WILL START. IF YOU
|
||||
ISSUE A "start" COMMAND AND THE FIREWALL FAILS TO START, YOUR SYSTEM
|
||||
WILL NO LONGER ACCEPT ANY NETWORK TRAFFIC. IF THIS HAPPENS, ISSUE A "shorewall
|
||||
clear" COMMAND TO RESTORE NETWORK CONNECTIVITY.</b></font></li>
|
||||
<li>Start the firewall by typing "shorewall start"</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p><a name="Install_Tarball"></a>To install Shorewall using the tarball
|
||||
|
||||
<p><a name="Install_Tarball"></a>To install Shorewall using the tarball
|
||||
and install script: </p>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>unpack the tarball (tar -zxf shorewall-x.y.z.tgz).</li>
|
||||
<li>cd to the shorewall directory (the version is encoded in the
|
||||
<li>unpack the tarball (tar -zxf shorewall-x.y.z.tgz).</li>
|
||||
<li>cd to the shorewall directory (the version is encoded in the
|
||||
directory name as in "shorewall-1.1.10").</li>
|
||||
<li>If you are using <a
|
||||
<li>If you are using <a
|
||||
href="http://www.caldera.com/openstore/openlinux/">Caldera</a>, <a
|
||||
href="http://www.redhat.com">RedHat</a>, <a
|
||||
href="http://www.linux-mandrake.com">Mandrake</a>, <a
|
||||
href="http://www.corel.com">Corel</a>, <a
|
||||
href="http://www.slackware.com/">Slackware</a> or <a
|
||||
href="http://www.debian.org">Debian</a> then type "./install.sh"</li>
|
||||
<li>If you are using <a href="http://www.suse.com">SuSe</a> then
|
||||
<li>If you are using <a href="http://www.suse.com">SuSe</a> then
|
||||
type "./install.sh /etc/init.d"</li>
|
||||
<li>If your distribution has directory /etc/rc.d/init.d
|
||||
<li>If your distribution has directory /etc/rc.d/init.d
|
||||
or /etc/init.d then type "./install.sh"</li>
|
||||
<li>For other distributions, determine where your distribution
|
||||
installs init scripts and type "./install.sh <init script
|
||||
directory></li>
|
||||
<li>Edit the <a href="#Config_Files"> configuration files</a> to
|
||||
match your configuration.</li>
|
||||
<li>Start the firewall by typing "shorewall start"</li>
|
||||
<li>If the install script was unable to configure Shorewall to
|
||||
<li>For other distributions, determine where your
|
||||
distribution installs init scripts and type "./install.sh
|
||||
<init script directory></li>
|
||||
<li>Edit the <a href="#Config_Files"> configuration files</a>
|
||||
to match your configuration.</li>
|
||||
<li>Start the firewall by typing "shorewall start"</li>
|
||||
<li>If the install script was unable to configure Shorewall to
|
||||
be started automatically at boot, see <a
|
||||
href="starting_and_stopping_shorewall.htm">these instructions</a>.</li>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
<p><a name="LRP"></a>To install my version of Shorewall on a fresh Bering
|
||||
disk, simply replace the "shorwall.lrp" file on the image with the file
|
||||
that you downloaded. See the <a href="two-interface.htm">two-interface QuickStart
|
||||
Guide</a> for information about further steps required.</p>
|
||||
|
||||
<p><a name="Upgrade_RPM"></a>If you already have the Shorewall RPM installed
|
||||
|
||||
<p><a name="LRP"></a>To install my version of Shorewall on a fresh Bering
|
||||
disk, simply replace the "shorwall.lrp" file on the image with the file
|
||||
that you downloaded. See the <a href="two-interface.htm">two-interface
|
||||
QuickStart Guide</a> for information about further steps required.</p>
|
||||
|
||||
<p><a name="Upgrade_RPM"></a>If you already have the Shorewall RPM installed
|
||||
and are upgrading to a new version:</p>
|
||||
|
||||
<p>If you are upgrading from a 1.2 version of Shorewall to a 1.4 version
|
||||
or and you have entries in the /etc/shorewall/hosts file then please check
|
||||
your /etc/shorewall/interfaces file to be sure that it contains an entry
|
||||
for each interface mentioned in the hosts file. Also, there are certain
|
||||
1.2 rule forms that are no longer supported under 1.4 (you must use the
|
||||
new 1.4 syntax). See <a href="errata.htm#Upgrade">the upgrade issues </a>for
|
||||
details.</p>
|
||||
|
||||
|
||||
<p>If you are upgrading from a 1.2 version of Shorewall to a 1.4 version or
|
||||
and you have entries in the /etc/shorewall/hosts file then please check
|
||||
your /etc/shorewall/interfaces file to be sure that it contains an entry
|
||||
for each interface mentioned in the hosts file. Also, there are certain
|
||||
1.2 rule forms that are no longer supported under 1.4 (you must use the
|
||||
new 1.4 syntax). See <a href="errata.htm#Upgrade">the upgrade issues </a>for
|
||||
details.</p>
|
||||
|
||||
<ul>
|
||||
<li>Upgrade the RPM (rpm -Uvh <shorewall rpm file>) <b>Note:
|
||||
</b>If you are installing version 1.2.0 and have one of the 1.2.0
|
||||
Beta RPMs installed, you must use the "--oldpackage" option to rpm
|
||||
(e.g., "rpm -Uvh --oldpackage shorewall-1.2-0.noarch.rpm").
|
||||
|
||||
<p> <b>Note1: </b>Some SuSE users have encountered a problem whereby
|
||||
rpm reports a conflict with kernel <= 2.2 even though a 2.4 kernel
|
||||
is installed. If this happens, simply use the --nodeps option to rpm
|
||||
(rpm -Uvh --nodeps <shorewall rpm>).<br>
|
||||
<li>Upgrade the RPM (rpm -Uvh <shorewall rpm file>) <b>Note:
|
||||
</b>If you are installing version 1.2.0 and have one of the 1.2.0
|
||||
Beta RPMs installed, you must use the "--oldpackage" option to rpm (e.g.,
|
||||
"rpm -Uvh --oldpackage shorewall-1.2-0.noarch.rpm").
|
||||
|
||||
<p> <b>Note1: </b>Some SuSE users have encountered a problem whereby
|
||||
rpm reports a conflict with kernel <= 2.2 even though a 2.4 kernel
|
||||
is installed. If this happens, simply use the --nodeps option to rpm
|
||||
(rpm -Uvh --nodeps <shorewall rpm>).<br>
|
||||
<br>
|
||||
<b>Note2: </b>Beginning with Shorewall 1.4.0, Shorewall is dependent
|
||||
on the iproute package. Unfortunately, some distributions call this package
|
||||
iproute2 which will cause the upgrade of Shorewall to fail with the diagnostic:<br>
|
||||
<br>
|
||||
<b>Note2: </b>Beginning with Shorewall 1.4.0, Shorewall is dependent
|
||||
on the iproute package. Unfortunately, some distributions call this package
|
||||
iproute2 which will cause the upgrade of Shorewall to fail with the diagnostic:<br>
|
||||
error: failed dependencies:iproute is needed by shorewall-1.4.0-1
|
||||
<br>
|
||||
error: failed dependencies:iproute is needed by shorewall-1.4.0-1
|
||||
<br>
|
||||
<br>
|
||||
This may be worked around by using the --nodeps option of rpm (rpm -Uvh
|
||||
<br>
|
||||
This may be worked around by using the --nodeps option of rpm (rpm -Uvh
|
||||
--nodeps <shorewall rpm>). </p>
|
||||
</li>
|
||||
<li>See if there are any incompatibilities between your configuration
|
||||
and the new Shorewall version (type "shorewall check") and correct as
|
||||
</li>
|
||||
<li>See if there are any incompatibilities between your configuration
|
||||
and the new Shorewall version (type "shorewall check") and correct as
|
||||
necessary.</li>
|
||||
<li>Restart the firewall (shorewall restart).</li>
|
||||
|
||||
<li>Restart the firewall (shorewall restart).</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p><a name="Upgrade_Tarball"></a>If you already have Shorewall installed and
|
||||
are upgrading to a new version using the tarball:</p>
|
||||
|
||||
<p>If you are upgrading from a 1.2 version of Shorewall to a 1.4 version and
|
||||
you have entries in the /etc/shorewall/hosts file then please check your
|
||||
/etc/shorewall/interfaces file to be sure that it contains an entry for
|
||||
each interface mentioned in the hosts file. Also, there are certain 1.2
|
||||
rule forms that are no longer supported under 1.4 (you must use the new
|
||||
1.4 syntax). See <a href="errata.htm#Upgrade">the upgrade issues</a> for
|
||||
details. </p>
|
||||
|
||||
|
||||
<p><a name="Upgrade_Tarball"></a>If you already have Shorewall installed
|
||||
and are upgrading to a new version using the tarball:</p>
|
||||
|
||||
<p>If you are upgrading from a 1.2 version of Shorewall to a 1.4 version
|
||||
and you have entries in the /etc/shorewall/hosts file then please check
|
||||
your /etc/shorewall/interfaces file to be sure that it contains an entry
|
||||
for each interface mentioned in the hosts file. Also, there are certain
|
||||
1.2 rule forms that are no longer supported under 1.4 (you must use the
|
||||
new 1.4 syntax). See <a href="errata.htm#Upgrade">the upgrade issues</a>
|
||||
for details. </p>
|
||||
|
||||
<ul>
|
||||
<li>unpack the tarball (tar -zxf shorewall-x.y.z.tgz).</li>
|
||||
<li>cd to the shorewall directory (the version is encoded in the
|
||||
<li>unpack the tarball (tar -zxf shorewall-x.y.z.tgz).</li>
|
||||
<li>cd to the shorewall directory (the version is encoded in the
|
||||
directory name as in "shorewall-3.0.1").</li>
|
||||
<li>If you are using <a
|
||||
<li>If you are using <a
|
||||
href="http://www.caldera.com/openstore/openlinux/">Caldera</a>, <a
|
||||
href="http://www.redhat.com">RedHat</a>, <a
|
||||
href="http://www.linux-mandrake.com">Mandrake</a>, <a
|
||||
href="http://www.corel.com">Corel</a>, <a
|
||||
href="http://www.slackware.com/">Slackware</a> or <a
|
||||
href="http://www.debian.org">Debian</a> then type "./install.sh"</li>
|
||||
<li>If you are using<a href="http://www.suse.com"> SuSe</a> then
|
||||
<li>If you are using<a href="http://www.suse.com"> SuSe</a> then
|
||||
type "./install.sh /etc/init.d"</li>
|
||||
<li>If your distribution has directory /etc/rc.d/init.d
|
||||
<li>If your distribution has directory /etc/rc.d/init.d
|
||||
or /etc/init.d then type "./install.sh"</li>
|
||||
<li>For other distributions, determine where your distribution
|
||||
installs init scripts and type "./install.sh <init script
|
||||
directory></li>
|
||||
<li>See if there are any incompatibilities between your configuration
|
||||
and the new Shorewall version (type "shorewall check") and correct as
|
||||
<li>For other distributions, determine where your
|
||||
distribution installs init scripts and type "./install.sh
|
||||
<init script directory></li>
|
||||
<li>See if there are any incompatibilities between your configuration
|
||||
and the new Shorewall version (type "shorewall check") and correct as
|
||||
necessary.</li>
|
||||
<li>Restart the firewall by typing "shorewall restart"</li>
|
||||
|
||||
<li>Restart the firewall by typing "shorewall restart"</li>
|
||||
|
||||
</ul>
|
||||
<a name="LRP_Upgrade"></a>If you already have a running Bering
|
||||
<a name="LRP_Upgrade"></a>If you already have a running Bering
|
||||
installation and wish to upgrade to a later version of Shorewall:<br>
|
||||
<br>
|
||||
<b>UNDER CONSTRUCTION...</b><br>
|
||||
|
||||
<h3><a name="Config_Files"></a>Configuring Shorewall</h3>
|
||||
|
||||
<p>You will need to edit some or all of the configuration files to match
|
||||
your setup. In most cases, the <a href="shorewall_quickstart_guide.htm">Shorewall
|
||||
QuickStart Guides</a> contain all of the information you need.</p>
|
||||
|
||||
<ul>
|
||||
|
||||
</ul>
|
||||
|
||||
<p><font size="2">Updated 4/8/2003 - <a href="support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<b>UNDER CONSTRUCTION...</b><br>
|
||||
|
||||
<h3><a name="Config_Files"></a>Configuring Shorewall</h3>
|
||||
|
||||
<p>You will need to edit some or all of the configuration files to match your
|
||||
setup. In most cases, the <a href="shorewall_quickstart_guide.htm">Shorewall
|
||||
QuickStart Guides</a> contain all of the information you need.</p>
|
||||
|
||||
<ul>
|
||||
|
||||
</ul>
|
||||
|
||||
<p><font size="2">Updated 4/8/2003 - <a href="support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||
</p>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -2,372 +2,300 @@
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shoreline Firewall (Shorewall) 1.4</title>
|
||||
|
||||
<base target="_self">
|
||||
<base target="_self">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="4"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber3"
|
||||
bgcolor="#4b017c">
|
||||
<tbody>
|
||||
<tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
|
||||
<td width="100%" height="90">
|
||||
<td width="100%" height="90">
|
||||
|
||||
|
||||
|
||||
<h1 align="center"> <font size="4"><i> <a
|
||||
href="http://www.cityofshoreline.com"> <img vspace="4" hspace="4"
|
||||
alt="Shorwall Logo" height="70" width="85" align="left"
|
||||
src="images/washington.jpg" border="0">
|
||||
</a></i></font><a
|
||||
</a></i></font><a
|
||||
href="http://www.shorewall.net" target="_top"><img border="1"
|
||||
src="images/shorewall.jpg" width="119" height="38" hspace="4"
|
||||
alt="(Shorewall Logo)" align="right" vspace="4">
|
||||
</a></h1>
|
||||
<small><small><small><small><a
|
||||
href="http://www.shorewall.net" target="_top"> </a></small></small></small></small>
|
||||
</a></h1>
|
||||
<small><small><small><small><a
|
||||
href="http://www.shorewall.net" target="_top"> </a></small></small></small></small>
|
||||
|
||||
|
||||
|
||||
<div align="center">
|
||||
|
||||
<div align="center">
|
||||
|
||||
|
||||
|
||||
<h1><font color="#ffffff"> Shorewall 1.4</font><i><font
|
||||
color="#ffffff"> <small><small><small>"iptables made easy"</small></small></small></font></i><a
|
||||
href="1.3" target="_top"><font color="#ffffff"><br>
|
||||
</font></a><br>
|
||||
</font></a><br>
|
||||
|
||||
|
||||
</h1>
|
||||
</div>
|
||||
</h1>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
<p><a href="http://www.shorewall.net" target="_top"> </a> </p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<div align="center">
|
||||
<center>
|
||||
|
||||
<div align="center">
|
||||
<center>
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
||||
<tbody>
|
||||
<tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
|
||||
<td width="90%">
|
||||
<td width="90%">
|
||||
|
||||
|
||||
|
||||
<h2 align="left">What is it?</h2>
|
||||
|
||||
|
||||
|
||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
||||
a <a href="http://www.netfilter.org">Netfilter</a> (iptables) based
|
||||
firewall that can be used on a dedicated firewall system, a multi-function
|
||||
gateway/router/server or on a standalone GNU/Linux system.</p>
|
||||
|
||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is a
|
||||
<a href="http://www.netfilter.org">Netfilter</a> (iptables) based firewall
|
||||
that can be used on a dedicated firewall system, a multi-function
|
||||
gateway/router/server or on a standalone GNU/Linux system.</p>
|
||||
|
||||
|
||||
|
||||
<p>This program is free software; you can redistribute it and/or modify
|
||||
it
|
||||
|
||||
<p>This program is free software; you can redistribute it and/or modify
|
||||
it
|
||||
under the terms of <a
|
||||
href="http://www.gnu.org/licenses/gpl.html">Version 2 of the
|
||||
GNU General Public License</a> as published by the Free Software
|
||||
Foundation.<br>
|
||||
<br>
|
||||
This
|
||||
program is distributed in the hope that
|
||||
it will be useful, but WITHOUT ANY WARRANTY;
|
||||
without even the implied warranty of MERCHANTABILITY
|
||||
or FITNESS FOR A PARTICULAR PURPOSE. See
|
||||
the GNU General Public License for more details.<br>
|
||||
<br>
|
||||
You
|
||||
should have received a copy of the GNU General
|
||||
Public License along with this program;
|
||||
if not, write to the Free Software Foundation,
|
||||
Inc., 675 Mass Ave, Cambridge, MA 02139,
|
||||
USA</p>
|
||||
href="http://www.gnu.org/licenses/gpl.html">Version 2 of the GNU
|
||||
General Public License</a> as published by the Free Software
|
||||
Foundation.<br>
|
||||
|
||||
<br>
|
||||
This
|
||||
program is distributed in the hope that
|
||||
it will be useful, but WITHOUT ANY WARRANTY;
|
||||
without even the implied warranty of MERCHANTABILITY
|
||||
or FITNESS FOR A PARTICULAR PURPOSE.
|
||||
See the GNU General Public License for more
|
||||
details.<br>
|
||||
|
||||
<br>
|
||||
You
|
||||
should have received a copy of the GNU
|
||||
General Public License along with
|
||||
this program; if not, write to the Free Software
|
||||
Foundation, Inc., 675 Mass Ave, Cambridge,
|
||||
MA 02139, USA</p>
|
||||
|
||||
|
||||
|
||||
|
||||
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M. Eastep</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2>Running Shorewall on Mandrake with a two-interface setup?</h2>
|
||||
If so, almost <b>NOTHING </b>on this site will apply directly to your setup.
|
||||
If you want to use the documentation that you find here, it is best if you
|
||||
uninstall what you have and install a setup that matches the documentation
|
||||
on this site. See the <a href="two-interface.htm">Two-interface QuickStart
|
||||
Guide</a> for details.<br>
|
||||
|
||||
<h2> Getting Started with Shorewall</h2>
|
||||
New to Shorewall? Start by selecting the <a
|
||||
href="shorewall_quickstart_guide.htm">QuickStart Guide</a> that most closely
|
||||
match your environment and follow the step by step instructions.<br>
|
||||
|
||||
|
||||
<h2><br>
|
||||
Getting Started with Shorewall</h2>
|
||||
New to Shorewall? Start by selecting the <a
|
||||
href="shorewall_quickstart_guide.htm">QuickStart Guide</a> that most closely
|
||||
match your environment and follow the step by step instructions.<br>
|
||||
<br>
|
||||
|
||||
<h2>News</h2>
|
||||
|
||||
|
||||
<p><b>5/10/2003 - Shorewall Mirror in Asia </b><b><img border="0"
|
||||
|
||||
|
||||
<p><b>5/18/2003 - Shorewall 1.4.3 </b><b><img border="0"
|
||||
src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b><br>
|
||||
</b><br>
|
||||
</p>
|
||||
Ed Greshko has established a mirror in Taiwan -- Thanks Ed!
|
||||
|
||||
<p><b>5/8/2003 - Shorewall Mirror in Chile </b><b><img border="0"
|
||||
src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b></p>
|
||||
|
||||
<b>Problems Corrected:<br>
|
||||
</b>
|
||||
<ol>
|
||||
<li>There were several cases where Shorewall would fail to remove
|
||||
a temporary directory from /tmp. These cases have been corrected.</li>
|
||||
<li>The rules for allowing all traffic via the loopback interface
|
||||
have been moved to before the rule that drops status=INVALID packets. This
|
||||
insures that all loopback traffic is allowed even if Netfilter connection
|
||||
tracking is confused.</li>
|
||||
|
||||
</ol>
|
||||
<b>New Features:<br>
|
||||
</b>
|
||||
<ol>
|
||||
<li> <a href="6to4.htm">IPV6-IPV4 (6to4) tunnels are</a> now supported
|
||||
in the /etc/shorewall/tunnels file.</li>
|
||||
<li>Shorewall can now be easily integrated with fireparse (http://www.fireparse.com)
|
||||
by setting LOGMARKER="fp=" in <a href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf.</a>
|
||||
Note: You may not use ULOG with fireparse unless you modify fireparse. </li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p><b>5/10/2003 - Shorewall Mirror in Asia</b><b> </b><br>
|
||||
</p>
|
||||
Ed Greshko has established a mirror in Taiwan -- Thanks Ed!
|
||||
|
||||
<p><b>5/8/2003 - Shorewall Mirror in Chile</b><b> </b></p>
|
||||
|
||||
<p>Thanks to Darcy Ganga, there is now an HTTP mirror in Santiago Chile.<br>
|
||||
</p>
|
||||
|
||||
<p><b>4/26/2003 - lists.shorewall.net Downtime </b><b><img
|
||||
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b></p>
|
||||
|
||||
</p>
|
||||
|
||||
<p><b>4/26/2003 - lists.shorewall.net Downtime</b><b> </b></p>
|
||||
|
||||
|
||||
<p>The list server will be down this morning for upgrade to RH9.0.<br>
|
||||
</p>
|
||||
|
||||
<p><b>4/21/2003 - Samples updated for Shorewall version 1.4.2</b><b>
|
||||
</b><b><img border="0" src="images/new10.gif" width="28"
|
||||
height="12" alt="(New)">
|
||||
</b></p>
|
||||
</p>
|
||||
|
||||
|
||||
<p><b>4/21/2003 - Samples updated for Shorewall version 1.4.2</b><b>
|
||||
</b></p>
|
||||
|
||||
|
||||
<p>Thanks to Francesca Smith, the sample configurations are now upgraded
|
||||
to Shorewall version 1.4.2.</p>
|
||||
|
||||
|
||||
<p><b>4/12/2002 - Greater Seattle Linux Users Group Presentation</b><b>
|
||||
</b></p>
|
||||
|
||||
|
||||
<blockquote>This morning, I gave <a href="GSLUG.htm" target="_top">a
|
||||
Shorewall presentation to GSLUG</a>. The presentation is in
|
||||
HTML format but was generated from Microsoft PowerPoint and is best viewed
|
||||
using Internet Explorer (although Konqueror also seems to work reasonably
|
||||
well as does Opera 7.1.0). Neither Opera 6 nor Netscape work well to
|
||||
view the presentation.<br>
|
||||
</blockquote>
|
||||
|
||||
|
||||
<p><b></b></p>
|
||||
|
||||
<p>Thanks to Francesca Smith, the sample configurations are now upgraded
|
||||
to Shorewall version 1.4.2.</p>
|
||||
<blockquote>
|
||||
<ol>
|
||||
|
||||
|
||||
<p><b>4/12/2002 - Greater Seattle Linux Users Group Presentation </b><b><img
|
||||
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b></p>
|
||||
|
||||
|
||||
<blockquote>This morning, I gave <a href="GSLUG.htm" target="_top">a
|
||||
Shorewall presentation to GSLUG</a>. The presentation is in
|
||||
HTML format but was generated from Microsoft PowerPoint and is best viewed
|
||||
using Internet Explorer (although Konqueror also seems to work reasonably
|
||||
well as does Opera 7.1.0). Neither Opera 6 nor Netscape work well to view
|
||||
the presentation.<br>
|
||||
|
||||
</ol>
|
||||
</blockquote>
|
||||
|
||||
|
||||
<p><b>4/9/2003 - Shorewall 1.4.2</b><b> </b><b> </b><b><img
|
||||
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b><br>
|
||||
</p>
|
||||
|
||||
|
||||
<p><b> Problems Corrected:</b></p>
|
||||
|
||||
|
||||
<blockquote>
|
||||
|
||||
|
||||
<ol>
|
||||
<li>TCP connection requests rejected out of the
|
||||
<b>common</b> chain are now properly rejected with TCP
|
||||
RST; previously, some of these requests were rejected with an ICMP
|
||||
port-unreachable response.</li>
|
||||
<li>'traceroute -I' from behind the firewall previously
|
||||
timed out on the first hop (e.g., to the firewall). This has been
|
||||
worked around.</li>
|
||||
|
||||
|
||||
|
||||
</ol>
|
||||
</blockquote>
|
||||
|
||||
|
||||
<p><b> New Features:</b></p>
|
||||
|
||||
|
||||
<blockquote>
|
||||
|
||||
|
||||
<ol>
|
||||
<li>Where an entry in the/etc/shorewall/hosts file
|
||||
specifies a particular host or network, Shorewall now creates an intermediate
|
||||
chain for handling input from the related zone. This can substantially
|
||||
reduce the number of rules traversed by connections requests from such
|
||||
zones.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Any file may include an INCLUDE directive. An
|
||||
INCLUDE directive consists of the word INCLUDE followed by a file
|
||||
name and causes the contents of the named file to be logically included
|
||||
into the file containing the INCLUDE. File names given in an INCLUDE
|
||||
directive are assumed to reside in /etc/shorewall or in an alternate
|
||||
configuration directory if one has been specified for the command. <br>
|
||||
<br>
|
||||
Examples:<br>
|
||||
shorewall/params.mgmt:<br>
|
||||
MGMT_SERVERS=1.1.1.1,2.2.2.2,3.3.3.3<br>
|
||||
TIME_SERVERS=4.4.4.4<br>
|
||||
BACKUP_SERVERS=5.5.5.5<br>
|
||||
----- end params.mgmt -----<br>
|
||||
<br>
|
||||
<br>
|
||||
shorewall/params:<br>
|
||||
# Shorewall 1.3 /etc/shorewall/params<br>
|
||||
[..]<br>
|
||||
#######################################<br>
|
||||
<br>
|
||||
INCLUDE params.mgmt <br>
|
||||
<br>
|
||||
# params unique to this host here<br>
|
||||
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT
|
||||
REMOVE<br>
|
||||
----- end params -----<br>
|
||||
<br>
|
||||
<br>
|
||||
shorewall/rules.mgmt:<br>
|
||||
ACCEPT net:$MGMT_SERVERS $FW tcp 22<br>
|
||||
ACCEPT $FW net:$TIME_SERVERS udp 123<br>
|
||||
ACCEPT $FW net:$BACKUP_SERVERS tcp 22<br>
|
||||
----- end rules.mgmt -----<br>
|
||||
<br>
|
||||
shorewall/rules:<br>
|
||||
# Shorewall version 1.3 - Rules File<br>
|
||||
[..]<br>
|
||||
#######################################<br>
|
||||
<br>
|
||||
INCLUDE rules.mgmt <br>
|
||||
<br>
|
||||
# rules unique to this host here<br>
|
||||
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT
|
||||
REMOVE<br>
|
||||
----- end rules -----<br>
|
||||
<br>
|
||||
INCLUDE's may be nested to a level of 3 -- further nested
|
||||
INCLUDE directives are ignored with a warning message.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Routing traffic from an interface back out that
|
||||
interface continues to be a problem. While I firmly believe that
|
||||
this should never happen, people continue to want to do it. To limit
|
||||
the damage that such nonsense produces, I have added a new 'routeback'
|
||||
option in /etc/shorewall/interfaces and /etc/shorewall/hosts. When
|
||||
used in /etc/shorewall/interfaces, the 'ZONE' column may not contain
|
||||
'-'; in other words, 'routeback' can't be used as an option for a multi-zone
|
||||
interface. The 'routeback' option CAN be specified however on individual
|
||||
group entries in /etc/shorewall/hosts.<br>
|
||||
<br>
|
||||
The 'routeback' option is similar to the old 'multi' option
|
||||
with two exceptions:<br>
|
||||
<br>
|
||||
a) The option pertains to a particular zone,interface,address
|
||||
tuple.<br>
|
||||
<br>
|
||||
b) The option only created infrastructure to pass traffic
|
||||
from (zone,interface,address) tuples back to themselves (the 'multi'
|
||||
option affected all (zone,interface,address) tuples associated with
|
||||
the given 'interface').<br>
|
||||
<br>
|
||||
See the '<a href="upgrade_issues.htm">Upgrade Issues</a>'
|
||||
for information about how this new option may affect your configuration.<br>
|
||||
</li>
|
||||
|
||||
|
||||
|
||||
</ol>
|
||||
</blockquote>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><a href="News.htm">More News</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
||||
border="0" src="images/leaflogo.gif" width="49" height="36"
|
||||
alt="(Leaf Logo)">
|
||||
</a>Jacques
|
||||
Nilo and Eric Wolzak have a LEAF (router/firewall/gateway
|
||||
on a floppy, CD or compact flash) distribution
|
||||
called <i>Bering</i> that
|
||||
</a>Jacques
|
||||
Nilo and Eric Wolzak have a LEAF (router/firewall/gateway
|
||||
on a floppy, CD or compact flash) distribution
|
||||
called <i>Bering</i> that
|
||||
features Shorewall-1.3.14 and Kernel-2.4.20.
|
||||
You can find their work at: <a
|
||||
href="http://leaf.sourceforge.net/devel/jnilo"> http://leaf.sourceforge.net/devel/jnilo<br>
|
||||
|
||||
</a></p>
|
||||
</a></p>
|
||||
|
||||
|
||||
<b>Congratulations to Jacques and Eric on the recent release of Bering
|
||||
1.2!!! </b><br>
|
||||
<b>Congratulations to Jacques and Eric on the recent release of Bering
|
||||
1.2!!! </b><br>
|
||||
|
||||
<h2><a name="Donations"></a>Donations</h2>
|
||||
</td>
|
||||
</td>
|
||||
|
||||
<td width="88" bgcolor="#4b017c" valign="top" align="center">
|
||||
|
||||
<td width="88" bgcolor="#4b017c" valign="top" align="center">
|
||||
|
||||
<form method="post"
|
||||
action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||
<strong><br>
|
||||
<font color="#ffffff"><b>Note: </b></font></strong><font
|
||||
color="#ffffff">Search is unavailable Daily 0200-0330 GMT.</font><br>
|
||||
<strong></strong>
|
||||
|
||||
action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||
<strong><br>
|
||||
<font color="#ffffff"><b>Note:
|
||||
</b></font></strong><font color="#ffffff">Search is unavailable
|
||||
Daily 0200-0330 GMT.</font><br>
|
||||
<strong></strong>
|
||||
|
||||
<p><font color="#ffffff"><strong>Quick Search</strong></font><br>
|
||||
<font face="Arial"
|
||||
<font face="Arial"
|
||||
size="-1"> <input type="text" name="words" size="15"></font><font
|
||||
size="-1"> </font> <font face="Arial" size="-1"> <input
|
||||
type="hidden" name="format" value="long"> <input type="hidden"
|
||||
name="method" value="and"> <input type="hidden" name="config"
|
||||
value="htdig"> <input type="submit" value="Search"></font> </p>
|
||||
<font face="Arial"> <input
|
||||
<font face="Arial"> <input
|
||||
type="hidden" name="exclude"
|
||||
value="[http://lists.shorewall.net/pipermail/*]"> </font> </form>
|
||||
|
||||
|
||||
<p><font color="#ffffff"><b><a
|
||||
href="http://lists.shorewall.net/htdig/search.html"><font
|
||||
color="#ffffff">Extended Search</font></a></b></font></p>
|
||||
<br>
|
||||
</td>
|
||||
</tr>
|
||||
<br>
|
||||
</td>
|
||||
|
||||
|
||||
</tbody>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</center>
|
||||
</div>
|
||||
|
||||
</center>
|
||||
</div>
|
||||
|
||||
<table border="0" cellpadding="5" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber2"
|
||||
bgcolor="#4b017c">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td
|
||||
width="100%" style="margin-top: 1px;">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td
|
||||
width="100%" style="margin-top: 1px;">
|
||||
|
||||
|
||||
|
||||
<p align="center"><a href="http://www.starlight.org"> <img
|
||||
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
||||
hspace="10">
|
||||
</a></p>
|
||||
|
||||
</a></p>
|
||||
|
||||
|
||||
|
||||
<p align="center"><font size="4" color="#ffffff">Shorewall is free
|
||||
but if you try it and find it useful, please consider making a donation
|
||||
to
|
||||
<a href="http://www.starlight.org"><font color="#ffffff">Starlight
|
||||
Children's Foundation.</font></a> Thanks!</font></p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<p align="center"><font size="4" color="#ffffff">Shorewall is free but
|
||||
if you try it and find it useful, please consider making a donation
|
||||
to
|
||||
<a href="http://www.starlight.org"><font color="#ffffff">Starlight Children's
|
||||
Foundation.</font></a> Thanks!</font></p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<p><font size="2">Updated 5/12/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
<br>
|
||||
</p>
|
||||
|
||||
<p><font size="2">Updated 5/18/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
<br>
|
||||
<br>
|
||||
</p>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -1,295 +1,305 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shorewall QuickStart Guide</title>
|
||||
|
||||
|
||||
<meta name="Microsoft Theme" content="none">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Shorewall QuickStart Guides
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Shorewall QuickStart Guides
|
||||
(HOWTO's)<br>
|
||||
Version 4.0</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
Version 4.0</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<p align="center">With thanks to Richard who reminded me once again that
|
||||
we must all first walk before we can run.<br>
|
||||
The French Translations are courtesy of Patrice Vetsel<br>
|
||||
</p>
|
||||
|
||||
|
||||
<p align="center">With thanks to Richard who reminded me once again that we
|
||||
must all first walk before we can run.<br>
|
||||
The French Translations are courtesy of Patrice Vetsel<br>
|
||||
</p>
|
||||
|
||||
<h2>The Guides</h2>
|
||||
|
||||
<p>These guides provide step-by-step instructions for configuring Shorewall
|
||||
|
||||
<p>These guides provide step-by-step instructions for configuring Shorewall
|
||||
in common firewall setups.</p>
|
||||
|
||||
|
||||
<p>The following guides are for <b>users who have a single public IP address</b>:</p>
|
||||
|
||||
|
||||
<ul>
|
||||
<li><a href="standalone.htm">Standalone</a>
|
||||
<li><a href="standalone.htm">Standalone</a>
|
||||
Linux System (<a href="standalone_fr.html">Version Française</a>)</li>
|
||||
<li><a href="two-interface.htm">Two-interface</a>
|
||||
Linux System acting as a firewall/router for a small local
|
||||
<li><a href="two-interface.htm">Two-interface</a>
|
||||
Linux System acting as a firewall/router for a small local
|
||||
network (<a href="two-interface_fr.html">Version Française</a>)</li>
|
||||
<li><a href="three-interface.htm">Three-interface</a>
|
||||
Linux System acting as a firewall/router for a small local
|
||||
<li><a href="three-interface.htm">Three-interface</a>
|
||||
Linux System acting as a firewall/router for a small local
|
||||
network and a DMZ. (<a href="three-interface_fr.html">Version Française</a>)</li>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
<p>The above guides are designed to get your first firewall up and running
|
||||
|
||||
<p>The above guides are designed to get your first firewall up and running
|
||||
quickly in the three most common Shorewall configurations.</p>
|
||||
|
||||
<p>The <a href="shorewall_setup_guide.htm">Shorewall Setup Guide</a> (See
|
||||
Index Below) outlines the steps necessary to set up a firewall
|
||||
where <b>there are multiple public IP addresses involved or
|
||||
if you want to learn more about Shorewall than is explained in
|
||||
|
||||
<p>The <a href="shorewall_setup_guide.htm">Shorewall Setup Guide</a> (See
|
||||
Index Below) outlines the steps necessary to set up a firewall
|
||||
where <b>there are multiple public IP addresses involved or
|
||||
if you want to learn more about Shorewall than is explained in
|
||||
the single-address guides above.</b></p>
|
||||
|
||||
|
||||
<ul>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<h2><a name="Documentation"></a>Documentation Index</h2>
|
||||
|
||||
<p>The following documentation covers a variety of topics and <b>supplements
|
||||
the <a href="shorewall_quickstart_guide.htm">QuickStart Guides</a>
|
||||
described above</b>. Please review the appropriate guide before
|
||||
|
||||
<p>The following documentation covers a variety of topics and <b>supplements
|
||||
the <a href="shorewall_quickstart_guide.htm">QuickStart Guides</a>
|
||||
described above</b>. Please review the appropriate guide before
|
||||
trying to use this documentation directly.</p>
|
||||
|
||||
|
||||
<ul>
|
||||
<li><a
|
||||
href="Shorewall_and_Aliased_Interfaces.html">Aliased (virtual) Interfaces
|
||||
<li><a
|
||||
href="Shorewall_and_Aliased_Interfaces.html">Aliased (virtual) Interfaces
|
||||
(e.g., eth0:0)</a><br>
|
||||
</li>
|
||||
<li><a href="blacklisting_support.htm">Blacklisting</a>
|
||||
|
||||
</li>
|
||||
<li><a href="blacklisting_support.htm">Blacklisting</a>
|
||||
|
||||
<ul>
|
||||
<li>Static Blacklisting using /etc/shorewall/blacklist</li>
|
||||
<li>Dynamic Blacklisting using /sbin/shorewall</li>
|
||||
|
||||
<li>Static Blacklisting using /etc/shorewall/blacklist</li>
|
||||
<li>Dynamic Blacklisting using /sbin/shorewall</li>
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm">Common configuration file
|
||||
features</a>
|
||||
</li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm">Common configuration file
|
||||
features</a>
|
||||
<ul>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Comments">Comments in configuration
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Comments">Comments in configuration
|
||||
files</a></li>
|
||||
<li><a
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Continuation">Line Continuation</a></li>
|
||||
<li><a href="configuration_file_basics.htm#INCLUDE">INCLUDE Directive</a><br>
|
||||
</li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Ports">Port Numbers/Service Names</a></li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Ranges">Port Ranges</a></li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Variables">Using Shell Variables</a></li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#dnsnames">Using DNS Names</a><br>
|
||||
</li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Compliment">Complementing an IP address
|
||||
or Subnet</a></li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Configs">Shorewall Configurations (making
|
||||
a test configuration)</a></li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#MAC">Using MAC Addresses in Shorewall</a></li>
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="Documentation.htm">Configuration
|
||||
File Reference Manual</a>
|
||||
<ul>
|
||||
<li> <a
|
||||
href="Documentation.htm#Variables">params</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Zones">zones</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Interfaces">interfaces</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Hosts">hosts</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Policy">policy</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Rules">rules</a></font></li>
|
||||
<li><a href="Documentation.htm#Common">common</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Masq">masq</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#ProxyArp">proxyarp</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#NAT">nat</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Tunnels">tunnels</a></font></li>
|
||||
<li><a
|
||||
href="traffic_shaping.htm#tcrules">tcrules</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Conf">shorewall.conf</a></font></li>
|
||||
<li><a href="Documentation.htm#modules">modules</a></li>
|
||||
<li><a href="Documentation.htm#TOS">tos</a>
|
||||
<li><a href="configuration_file_basics.htm#INCLUDE">INCLUDE Directive</a><br>
|
||||
</li>
|
||||
<li><a
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Ports">Port Numbers/Service Names</a></li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Ranges">Port Ranges</a></li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Variables">Using Shell Variables</a></li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#dnsnames">Using DNS Names</a><br>
|
||||
</li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Compliment">Complementing an IP address
|
||||
or Subnet</a></li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Configs">Shorewall Configurations
|
||||
(making a test configuration)</a></li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#MAC">Using MAC Addresses in Shorewall</a></li>
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="Documentation.htm">Configuration
|
||||
File Reference Manual</a>
|
||||
<ul>
|
||||
<li> <a
|
||||
href="Documentation.htm#Variables">params</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Zones">zones</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Interfaces">interfaces</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Hosts">hosts</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Policy">policy</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Rules">rules</a></font></li>
|
||||
<li><a href="Documentation.htm#Common">common</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Masq">masq</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#ProxyArp">proxyarp</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#NAT">nat</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Tunnels">tunnels</a></font></li>
|
||||
<li><a
|
||||
href="traffic_shaping.htm#tcrules">tcrules</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Conf">shorewall.conf</a></font></li>
|
||||
<li><a
|
||||
href="Documentation.htm#modules">modules</a></li>
|
||||
<li><a href="Documentation.htm#TOS">tos</a>
|
||||
</li>
|
||||
<li><a
|
||||
href="Documentation.htm#Blacklist">blacklist</a></li>
|
||||
<li><a href="Documentation.htm#rfc1918">rfc1918</a></li>
|
||||
<li><a
|
||||
<li><a
|
||||
href="Documentation.htm#rfc1918">rfc1918</a></li>
|
||||
<li><a
|
||||
href="Documentation.htm#Routestopped">routestopped</a></li>
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="dhcp.htm">DHCP</a></li>
|
||||
<li><a href="ECN.html">ECN Disabling by host
|
||||
or subnet</a><br>
|
||||
</li>
|
||||
<li><font color="#000099"><a
|
||||
href="shorewall_extension_scripts.htm">Extension Scripts</a></font>
|
||||
(How to extend Shorewall without modifying Shorewall code through the
|
||||
use of files in /etc/shorewall -- /etc/shorewall/start, /etc/shorewall/stopped,
|
||||
etc.)</li>
|
||||
<li><a href="fallback.htm">Fallback/Uninstall</a></li>
|
||||
<li><a
|
||||
</li>
|
||||
<li><a href="dhcp.htm">DHCP</a></li>
|
||||
<li><a href="ECN.html">ECN Disabling by host
|
||||
or subnet</a><br>
|
||||
</li>
|
||||
<li><font color="#000099"><a
|
||||
href="shorewall_extension_scripts.htm">Extension Scripts</a></font>
|
||||
(How to extend Shorewall without modifying Shorewall code through the
|
||||
use of files in /etc/shorewall -- /etc/shorewall/start, /etc/shorewall/stopped,
|
||||
etc.)</li>
|
||||
<li><a href="fallback.htm">Fallback/Uninstall</a></li>
|
||||
<li><a
|
||||
href="shorewall_firewall_structure.htm">Firewall Structure</a></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="kernel.htm">Kernel Configuration</a></font></li>
|
||||
<li><a href="shorewall_logging.html">Logging</a><br>
|
||||
</li>
|
||||
<li><a href="MAC_Validation.html">MAC Verification</a><br>
|
||||
</li>
|
||||
<li><a href="myfiles.htm">My Shorewall
|
||||
Configuration (How I personally use Shorewall)</a><br>
|
||||
</li>
|
||||
<li><a href="ping.html">'Ping' Management</a><br>
|
||||
<li><a href="shorewall_logging.html">Logging</a><br>
|
||||
</li>
|
||||
<li><a href="ports.htm">Port Information</a>
|
||||
|
||||
<li><a href="MAC_Validation.html">MAC Verification</a><br>
|
||||
</li>
|
||||
<li><a href="myfiles.htm">My Shorewall
|
||||
Configuration (How I personally use Shorewall)</a><br>
|
||||
</li>
|
||||
<li><a href="ping.html">'Ping' Management</a><br>
|
||||
</li>
|
||||
<li><a href="ports.htm">Port Information</a>
|
||||
|
||||
<ul>
|
||||
<li>Which applications use which ports</li>
|
||||
<li>Ports used by Trojans</li>
|
||||
|
||||
<li>Which applications use which ports</li>
|
||||
<li>Ports used by Trojans</li>
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="ProxyARP.htm">Proxy ARP</a></li>
|
||||
<li><a href="samba.htm">Samba</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm">Shorewall Setup Guide</a><br>
|
||||
</li>
|
||||
|
||||
</li>
|
||||
<li><a href="ProxyARP.htm">Proxy ARP</a></li>
|
||||
<li><a href="samba.htm">Samba</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm">Shorewall Setup Guide</a><br>
|
||||
</li>
|
||||
|
||||
<ul>
|
||||
<li><a href="shorewall_setup_guide.htm#Introduction">1.0 Introduction</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Concepts">2.0 Shorewall
|
||||
<li><a href="shorewall_setup_guide.htm#Introduction">1.0 Introduction</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Concepts">2.0 Shorewall
|
||||
Concepts</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Interfaces">3.0 Network
|
||||
<li><a href="shorewall_setup_guide.htm#Interfaces">3.0 Network
|
||||
Interfaces</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Addressing">4.0 Addressing,
|
||||
Subnets and Routing</a>
|
||||
<li><a href="shorewall_setup_guide.htm#Addressing">4.0 Addressing,
|
||||
Subnets and Routing</a>
|
||||
|
||||
<ul>
|
||||
<li><a href="shorewall_setup_guide.htm#Addresses">4.1 IP Addresses</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Subnets">4.2 Subnets</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Routing">4.3 Routing</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#ARP">4.4 Address
|
||||
Resolution Protocol (ARP)</a></li>
|
||||
|
||||
<li><a href="shorewall_setup_guide.htm#Addresses">4.1 IP
|
||||
Addresses</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Subnets">4.2 Subnets</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Routing">4.3 Routing</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#ARP">4.4 Address
|
||||
Resolution Protocol (ARP)</a></li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<ul>
|
||||
<li><a href="shorewall_setup_guide.htm#RFC1918">4.5 RFC 1918</a></li>
|
||||
|
||||
<li><a href="shorewall_setup_guide.htm#RFC1918">4.5 RFC
|
||||
1918</a></li>
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="shorewall_setup_guide.htm#Options">5.0 Setting
|
||||
up your Network</a>
|
||||
</li>
|
||||
<li><a href="shorewall_setup_guide.htm#Options">5.0 Setting
|
||||
up your Network</a>
|
||||
<ul>
|
||||
<li><a href="shorewall_setup_guide.htm#Routed">5.1 Routed</a></li>
|
||||
|
||||
<li><a href="shorewall_setup_guide.htm#Routed">5.1 Routed</a></li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<ul>
|
||||
<li><a href="shorewall_setup_guide.htm#NonRouted">5.2 Non-routed</a>
|
||||
|
||||
<li><a href="shorewall_setup_guide.htm#NonRouted">5.2 Non-routed</a>
|
||||
|
||||
|
||||
<ul>
|
||||
<li><a href="shorewall_setup_guide.htm#SNAT">5.2.1 SNAT</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#DNAT">5.2.2 DNAT</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#ProxyARP">5.2.3
|
||||
Proxy ARP</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#NAT">5.2.4 Static
|
||||
NAT</a></li>
|
||||
|
||||
<li><a href="shorewall_setup_guide.htm#SNAT">5.2.1 SNAT</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#DNAT">5.2.2 DNAT</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#ProxyARP">5.2.3
|
||||
Proxy ARP</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#NAT">5.2.4 Static
|
||||
NAT</a></li>
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="shorewall_setup_guide.htm#Rules">5.3 Rules</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#OddsAndEnds">5.4 Odds
|
||||
</li>
|
||||
<li><a href="shorewall_setup_guide.htm#Rules">5.3 Rules</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#OddsAndEnds">5.4 Odds
|
||||
and Ends</a></li>
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="shorewall_setup_guide.htm#DNS">6.0 DNS</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#StartingAndStopping">7.0
|
||||
Starting and Stopping the Firewall</a></li>
|
||||
|
||||
</li>
|
||||
<li><a href="shorewall_setup_guide.htm#DNS">6.0 DNS</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#StartingAndStopping">7.0
|
||||
Starting and Stopping the Firewall</a></li>
|
||||
|
||||
</ul>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="starting_and_stopping_shorewall.htm">Starting/stopping the Firewall</a></font></li>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>Description of all /sbin/shorewall commands</li>
|
||||
<li>How to safely test a Shorewall configuration
|
||||
change<br>
|
||||
</li>
|
||||
|
||||
<li>Description of all /sbin/shorewall commands</li>
|
||||
<li>How to safely test a Shorewall configuration
|
||||
change<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="NAT.htm">Static NAT</a></font></li>
|
||||
<li><a href="Shorewall_Squid_Usage.html">Squid as a Transparent
|
||||
<li><a href="Shorewall_Squid_Usage.html">Squid as a Transparent
|
||||
Proxy with Shorewall</a><br>
|
||||
</li>
|
||||
<li><a href="traffic_shaping.htm">Traffic
|
||||
</li>
|
||||
<li><a href="traffic_shaping.htm">Traffic
|
||||
Shaping/QOS</a></li>
|
||||
<li>VPN
|
||||
<li>VPN
|
||||
|
||||
<ul>
|
||||
<li><a href="IPSEC.htm">IPSEC</a></li>
|
||||
<li><a href="IPIP.htm">GRE and IPIP</a></li>
|
||||
<li><a href="OPENVPN.html">OpenVPN</a><br>
|
||||
</li>
|
||||
<li><a href="PPTP.htm">PPTP</a></li>
|
||||
<li><a href="VPN.htm">IPSEC/PPTP</a> from
|
||||
<li><a href="IPSEC.htm">IPSEC</a></li>
|
||||
<li><a href="IPIP.htm">GRE and IPIP</a></li>
|
||||
<li><a href="OPENVPN.html">OpenVPN</a><br>
|
||||
</li>
|
||||
<li><a href="PPTP.htm">PPTP</a></li>
|
||||
<li><a href="6to4.htm">6t04</a><br>
|
||||
</li>
|
||||
<li><a href="VPN.htm">IPSEC/PPTP</a> from
|
||||
a system behind your firewall to a remote network.</li>
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a
|
||||
</li>
|
||||
<li><a
|
||||
href="whitelisting_under_shorewall.htm">White List Creation</a></li>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<p>If you use one of these guides and have a suggestion for improvement <a
|
||||
href="mailto:webmaster@shorewall.net">please let me know</a>.</p>
|
||||
|
||||
<p><font size="2">Last modified 5/03/2003 - <a href="support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright 2002, 2003 Thomas M.
|
||||
|
||||
<p><font size="2">Last modified 5/18/2003 - <a href="support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright 2002, 2003 Thomas M.
|
||||
Eastep</font></a><br>
|
||||
</p>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
@ -2,374 +2,304 @@
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shoreline Firewall (Shorewall) 1.3</title>
|
||||
|
||||
<base target="_self">
|
||||
<base target="_self">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="4"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber3"
|
||||
bgcolor="#4b017c">
|
||||
<tbody>
|
||||
<tr>
|
||||
<tbody>
|
||||
<tr>
|
||||
|
||||
<td width="100%" height="90">
|
||||
<td width="100%" height="90">
|
||||
|
||||
|
||||
|
||||
<h1 align="center"> <font size="4"><i> <a
|
||||
href="http://www.cityofshoreline.com"> <img vspace="4" hspace="4"
|
||||
alt="Shorwall Logo" height="70" width="85" align="left"
|
||||
src="images/washington.jpg" border="0">
|
||||
</a></i></font><font
|
||||
color="#ffffff">Shorewall 1.4 - <font
|
||||
size="4">"<i>iptables made easy"</i></font></font><br>
|
||||
<a target="_top" href="1.3/index.html"><font
|
||||
|
||||
</a></i></font><font color="#ffffff">Shorewall 1.4 -
|
||||
<font size="4">"<i>iptables made easy"</i></font></font><br>
|
||||
<a target="_top" href="1.3/index.html"><font
|
||||
color="#ffffff"> </font></a><a target="_top"
|
||||
href="http://www1.shorewall.net/1.2/index.htm"><font color="#ffffff"><small><small><small><br>
|
||||
</small></small></small></font></a>
|
||||
</small></small></small></font></a>
|
||||
|
||||
</h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<div align="center">
|
||||
<center>
|
||||
|
||||
<div align="center">
|
||||
<center>
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
||||
<tbody>
|
||||
<tr>
|
||||
|
||||
<td width="90%">
|
||||
<tbody>
|
||||
<tr>
|
||||
|
||||
|
||||
<td width="90%">
|
||||
|
||||
|
||||
<h2 align="left">What is it?</h2>
|
||||
|
||||
|
||||
|
||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
||||
a <a href="http://www.netfilter.org">Netfilter</a>
|
||||
(iptables) based firewall that can be used on
|
||||
a dedicated firewall system, a multi-function gateway/router/server
|
||||
or on a standalone GNU/Linux system.</p>
|
||||
|
||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
||||
a <a href="http://www.netfilter.org">Netfilter</a>
|
||||
(iptables) based firewall that can be used on
|
||||
a dedicated firewall system, a multi-function gateway/router/server
|
||||
or on a standalone GNU/Linux system.</p>
|
||||
|
||||
|
||||
|
||||
<p>This program is free software; you can redistribute it and/or modify
|
||||
it
|
||||
|
||||
<p>This program is free software; you can redistribute it and/or modify
|
||||
it
|
||||
under the terms of <a
|
||||
href="http://www.gnu.org/licenses/gpl.html">Version 2 of the
|
||||
GNU General Public License</a> as published by the Free Software
|
||||
Foundation.<br>
|
||||
href="http://www.gnu.org/licenses/gpl.html">Version 2 of the GNU
|
||||
General Public License</a> as published by the Free Software
|
||||
Foundation.<br>
|
||||
|
||||
<br>
|
||||
This
|
||||
program is distributed in the hope that
|
||||
it will be useful, but WITHOUT ANY WARRANTY;
|
||||
without even the implied warranty of MERCHANTABILITY
|
||||
or FITNESS FOR A PARTICULAR PURPOSE.
|
||||
See the GNU General Public License for more details.<br>
|
||||
<br>
|
||||
This
|
||||
program is distributed in the hope that
|
||||
it will be useful, but WITHOUT ANY WARRANTY;
|
||||
without even the implied warranty of MERCHANTABILITY
|
||||
or FITNESS FOR A PARTICULAR PURPOSE.
|
||||
See the GNU General Public License for more
|
||||
details.<br>
|
||||
|
||||
<br>
|
||||
You
|
||||
should have received a copy of the GNU
|
||||
<br>
|
||||
You
|
||||
should have received a copy of the GNU
|
||||
General Public License along with
|
||||
this program; if not, write to the Free Software
|
||||
Foundation, Inc., 675 Mass Ave, Cambridge,
|
||||
MA 02139, USA</p>
|
||||
this program; if not, write to the Free Software
|
||||
Foundation, Inc., 675 Mass Ave, Cambridge,
|
||||
MA 02139, USA</p>
|
||||
|
||||
|
||||
|
||||
|
||||
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M. Eastep</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2>Running Shorewall on Mandrake with a two-interface setup?</h2>
|
||||
If so, almost <b>NOTHING </b>on this site will apply directly to your setup.
|
||||
If you want to use the documentation that you find here, it is best if you
|
||||
uninstall what you have and install a setup that matches the documentation
|
||||
on this site. See the <a href="two-interface.htm">Two-interface QuickStart
|
||||
Guide</a> for details.<br>
|
||||
|
||||
<h2>Getting Started with Shorewall</h2>
|
||||
New to Shorewall? Start by selecting the <a
|
||||
href="shorewall_quickstart_guide.htm">QuickStart Guide</a> that most closely
|
||||
match your environment and follow the step by step instructions.<br>
|
||||
|
||||
<h2><b>News</b></h2>
|
||||
<b> </b>
|
||||
|
||||
|
||||
<p><b>5/10/2003 - Shorewall Mirror in Asia </b><b><img border="0"
|
||||
src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b><br>
|
||||
</p>
|
||||
Ed Greshko has established a mirror in Taiwan -- Thanks Ed!
|
||||
|
||||
<p><b>5/8/2003 - Shorewall Mirror in Chile </b><b><img border="0"
|
||||
src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b></p>
|
||||
|
||||
<p>Thanks to Darcy Ganga, there is now an HTTP mirror in Santiago Chile.<br>
|
||||
</p>
|
||||
|
||||
<p><b>4/26/2003 - lists.shorewall.net Downtime </b><b><img
|
||||
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b></p>
|
||||
|
||||
<p>The list server will be down this morning for upgrade to RH9.0.<br>
|
||||
</p>
|
||||
|
||||
<p><b>4/21/2003 - Samples updated for Shorewall version 1.4.2</b><b> </b><b><img
|
||||
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b></p>
|
||||
|
||||
<p>Thanks to Francesca Smith, the sample configurations are now upgraded
|
||||
to Shorewall version 1.4.2.</p>
|
||||
New to Shorewall? Start by selecting the <a
|
||||
href="shorewall_quickstart_guide.htm">QuickStart Guide</a> that most closely
|
||||
match your environment and follow the step by step instructions.<br>
|
||||
|
||||
<p><b>4/12/2002 - Greater Seattle Linux Users Group Presentation </b><b><img
|
||||
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b></p>
|
||||
<h2><b>News</b></h2>
|
||||
<b> </b>
|
||||
|
||||
|
||||
<blockquote> This morning, I gave <a href="GSLUG.htm"
|
||||
target="_top">a Shorewall presentation to GSLUG</a>. The presentation
|
||||
is in HTML format but was generated from Microsoft PowerPoint and is
|
||||
best viewed using Internet Explorer (although Konqueror also seems to
|
||||
work reasonably well as does Opera 7.1.0). Neither Opera 6 nor Netscape
|
||||
work well to view the presentation.</blockquote>
|
||||
|
||||
|
||||
<p><b>4/9/2003 - Shorewall 1.4.2</b><b> </b><b> </b><b><img
|
||||
border="0" src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b><br>
|
||||
|
||||
<p><b>5/18/2003 - Shorewall 1.4.3 </b><b><img border="0"
|
||||
src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b><br>
|
||||
</p>
|
||||
<b>Problems Corrected:<br>
|
||||
</b>
|
||||
<ol>
|
||||
<li>There were several cases where Shorewall would fail to remove
|
||||
a temporary directory from /tmp. These cases have been corrected.</li>
|
||||
<li>The rules for allowing all traffic via the loopback interface
|
||||
have been moved to before the rule that drops status=INVALID packets. This
|
||||
insures that all loopback traffic is allowed even if Netfilter connection
|
||||
tracking is confused.</li>
|
||||
|
||||
</ol>
|
||||
<b>New Features:<br>
|
||||
</b>
|
||||
<ol>
|
||||
<li><a href="6to4.htm"> </a><a href="6to4.htm">IPV6-IPV4 (6to4)
|
||||
tunnels </a>are now supported in the /etc/shorewall/tunnels file.</li>
|
||||
<li>Shorewall can now be easily integrated with fireparse (http://www.fireparse.com)
|
||||
by setting LOGMARKER="fp=" in <a href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf.</a>
|
||||
Note: You may not use ULOG with fireparse unless you modify fireparse. </li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p><b>5/10/2003 - Shorewall Mirror in Asia</b><b> </b><br>
|
||||
</p>
|
||||
Ed Greshko has established a mirror in Taiwan -- Thanks Ed!
|
||||
|
||||
<p><b>5/8/2003 - Shorewall Mirror in Chile</b><b> </b></p>
|
||||
|
||||
<p>Thanks to Darcy Ganga, there is now an HTTP mirror in Santiago Chile.<br>
|
||||
</p>
|
||||
|
||||
<p><b>4/26/2003 - lists.shorewall.net Downtime</b><b> </b></p>
|
||||
|
||||
<p>The list server will be down this morning for upgrade to RH9.0.<br>
|
||||
</p>
|
||||
|
||||
<p><b>4/21/2003 - Samples updated for Shorewall version 1.4.2</b><b>
|
||||
</b></p>
|
||||
|
||||
|
||||
<p><b> Problems Corrected:</b></p>
|
||||
|
||||
<p>Thanks to Francesca Smith, the sample configurations are now upgraded
|
||||
to Shorewall version 1.4.2.</p>
|
||||
|
||||
|
||||
<blockquote>
|
||||
|
||||
<p><b>4/12/2002 - Greater Seattle Linux Users Group Presentation</b><b>
|
||||
</b></p>
|
||||
|
||||
|
||||
|
||||
<blockquote> This morning, I gave <a href="GSLUG.htm"
|
||||
target="_top">a Shorewall presentation to GSLUG</a>. The presentation
|
||||
is in HTML format but was generated from Microsoft PowerPoint and is
|
||||
best viewed using Internet Explorer (although Konqueror also seems to
|
||||
work reasonably well as does Opera 7.1.0). Neither Opera 6 nor Netscape
|
||||
work well to view the presentation.</blockquote>
|
||||
|
||||
|
||||
<p><b></b></p>
|
||||
|
||||
<blockquote>
|
||||
<ol>
|
||||
<li>TCP connection requests rejected out of the <b>common</b>
|
||||
chain are now properly rejected with TCP RST; previously, some of these
|
||||
requests were rejected with an ICMP port-unreachable response.</li>
|
||||
<li>'traceroute -I' from behind the firewall previously
|
||||
timed out on the first hop (e.g., to the firewall). This has been worked
|
||||
around.</li>
|
||||
|
||||
|
||||
|
||||
|
||||
</ol>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
|
||||
<p><b> New Features:</b></p>
|
||||
|
||||
|
||||
<blockquote>
|
||||
|
||||
|
||||
<ol>
|
||||
<li>Where an entry in the/etc/shorewall/hosts file
|
||||
specifies a particular host or network, Shorewall now creates an intermediate
|
||||
chain for handling input from the related zone. This can substantially
|
||||
reduce the number of rules traversed by connections requests from such
|
||||
zones.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Any file may include an INCLUDE directive. An
|
||||
INCLUDE directive consists of the word INCLUDE followed by a file name
|
||||
and causes the contents of the named file to be logically included into
|
||||
the file containing the INCLUDE. File names given in an INCLUDE directive
|
||||
are assumed to reside in /etc/shorewall or in an alternate configuration
|
||||
directory if one has been specified for the command. <br>
|
||||
<br>
|
||||
Examples:<br>
|
||||
shorewall/params.mgmt:<br>
|
||||
MGMT_SERVERS=1.1.1.1,2.2.2.2,3.3.3.3<br>
|
||||
TIME_SERVERS=4.4.4.4<br>
|
||||
BACKUP_SERVERS=5.5.5.5<br>
|
||||
----- end params.mgmt -----<br>
|
||||
<br>
|
||||
<br>
|
||||
shorewall/params:<br>
|
||||
# Shorewall 1.3 /etc/shorewall/params<br>
|
||||
[..]<br>
|
||||
#######################################<br>
|
||||
<br>
|
||||
INCLUDE params.mgmt <br>
|
||||
<br>
|
||||
# params unique to this host here<br>
|
||||
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE<br>
|
||||
----- end params -----<br>
|
||||
<br>
|
||||
<br>
|
||||
shorewall/rules.mgmt:<br>
|
||||
ACCEPT net:$MGMT_SERVERS $FW tcp 22<br>
|
||||
ACCEPT $FW net:$TIME_SERVERS udp 123<br>
|
||||
ACCEPT $FW net:$BACKUP_SERVERS tcp 22<br>
|
||||
----- end rules.mgmt -----<br>
|
||||
<br>
|
||||
shorewall/rules:<br>
|
||||
# Shorewall version 1.3 - Rules File<br>
|
||||
[..]<br>
|
||||
#######################################<br>
|
||||
<br>
|
||||
INCLUDE rules.mgmt <br>
|
||||
<br>
|
||||
# rules unique to this host here<br>
|
||||
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT
|
||||
REMOVE<br>
|
||||
----- end rules -----<br>
|
||||
<br>
|
||||
INCLUDE's may be nested to a level of 3 -- further nested
|
||||
INCLUDE directives are ignored with a warning message.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Routing traffic from an interface back out that
|
||||
interface continues to be a problem. While I firmly believe that this
|
||||
should never happen, people continue to want to do it. To limit the
|
||||
damage that such nonsense produces, I have added a new 'routeback' option
|
||||
in /etc/shorewall/interfaces and /etc/shorewall/hosts. When used in
|
||||
/etc/shorewall/interfaces, the 'ZONE' column may not contain '-'; in
|
||||
other words, 'routeback' can't be used as an option for a multi-zone
|
||||
interface. The 'routeback' option CAN be specified however on individual
|
||||
group entries in /etc/shorewall/hosts.<br>
|
||||
<br>
|
||||
The 'routeback' option is similar to the old 'multi' option
|
||||
with two exceptions:<br>
|
||||
<br>
|
||||
a) The option pertains to a particular zone,interface,address
|
||||
tuple.<br>
|
||||
<br>
|
||||
b) The option only created infrastructure to pass traffic
|
||||
from (zone,interface,address) tuples back to themselves (the 'multi'
|
||||
option affected all (zone,interface,address) tuples associated with
|
||||
the given 'interface').<br>
|
||||
<br>
|
||||
See the '<a href="upgrade_issues.htm">Upgrade Issues</a>'
|
||||
for information about how this new option may affect your configuration.<br>
|
||||
</li>
|
||||
|
||||
|
||||
</ol>
|
||||
</blockquote>
|
||||
|
||||
|
||||
|
||||
<p><a href="file:///Z:/Shorewall-docs/News.htm"></a></p>
|
||||
<b> </b>
|
||||
<b> </b>
|
||||
|
||||
|
||||
|
||||
<p><b><a href="News.htm">More News</a></b></p>
|
||||
<b> </b>
|
||||
<b> </b>
|
||||
|
||||
|
||||
|
||||
<h2><b> </b></h2>
|
||||
<b> </b>
|
||||
<b> </b>
|
||||
|
||||
|
||||
|
||||
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
||||
border="0" src="images/leaflogo.gif" width="49" height="36"
|
||||
alt="(Leaf Logo)">
|
||||
</a>Jacques
|
||||
Nilo and Eric Wolzak have a LEAF (router/firewall/gateway
|
||||
on a floppy, CD or compact flash) distribution
|
||||
called <i>Bering</i> that
|
||||
features Shorewall-1.3.14 and Kernel-2.4.20.
|
||||
You can find their work at: <a
|
||||
|
||||
</a>Jacques Nilo and Eric Wolzak have
|
||||
a LEAF (router/firewall/gateway on a floppy,
|
||||
CD or compact flash) distribution called
|
||||
<i>Bering</i> that features Shorewall-1.3.14
|
||||
and Kernel-2.4.20. You can find their
|
||||
work at: <a
|
||||
href="http://leaf.sourceforge.net/devel/jnilo"> http://leaf.sourceforge.net/devel/jnilo</a></p>
|
||||
|
||||
<b>Congratulations to Jacques and Eric on the
|
||||
recent release of Bering 1.2!!! </b><br>
|
||||
<b>Congratulations to Jacques and Eric on
|
||||
the recent release of Bering 1.2!!! </b><br>
|
||||
|
||||
<h1 align="center"><b><a href="http://www.sf.net"><img
|
||||
align="left" alt="SourceForge Logo"
|
||||
src="http://sourceforge.net/sflogo.php?group_id=22587&type=3">
|
||||
|
||||
</a></b></h1>
|
||||
<b> </b>
|
||||
</a></b></h1>
|
||||
<b> </b>
|
||||
|
||||
|
||||
|
||||
<h4><b> </b></h4>
|
||||
<b> </b>
|
||||
<b> </b>
|
||||
|
||||
|
||||
|
||||
<h2><b>This site is hosted by the generous folks at <a
|
||||
href="http://www.sf.net">SourceForge.net</a> </b></h2>
|
||||
<b> </b>
|
||||
<b> </b>
|
||||
|
||||
|
||||
|
||||
<h2><b><a name="Donations"></a>Donations</b></h2>
|
||||
<b> </b></td>
|
||||
<b> </b></td>
|
||||
|
||||
<td width="88" bgcolor="#4b017c" valign="top" align="center">
|
||||
|
||||
<td width="88" bgcolor="#4b017c" valign="top"
|
||||
align="center">
|
||||
<form method="post"
|
||||
action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||
|
||||
action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||
|
||||
<p><strong><br>
|
||||
<font color="#ffffff"><b>Note: </b></font></strong>
|
||||
<font color="#ffffff">Search is unavailable Daily 0200-0330 GMT.</font><br>
|
||||
</p>
|
||||
|
||||
<font color="#ffffff"><b>Note: </b></font></strong>
|
||||
<font color="#ffffff">Search is unavailable Daily 0200-0330
|
||||
GMT.</font><br>
|
||||
</p>
|
||||
|
||||
<p><font color="#ffffff"><strong>Quick Search</strong></font><br>
|
||||
<font face="Arial" size="-1"> <input type="text"
|
||||
name="words" size="15"></font><font size="-1"> </font><font
|
||||
<font face="Arial" size="-1"> <input
|
||||
type="text" name="words" size="15"></font><font size="-1"> </font><font
|
||||
face="Arial" size="-1"> <input type="hidden" name="format"
|
||||
value="long"> <input type="hidden" name="method" value="and">
|
||||
<input type="hidden" name="config" value="htdig"> <input
|
||||
value="long"> <input type="hidden" name="method" value="and">
|
||||
<input type="hidden" name="config" value="htdig"> <input
|
||||
type="submit" value="Search"></font> </p>
|
||||
<font face="Arial"> <input type="hidden"
|
||||
name="exclude" value="[http://lists.shorewall.net/pipermail/*]">
|
||||
</font> </form>
|
||||
|
||||
<font face="Arial"> <input type="hidden"
|
||||
name="exclude" value="[http://lists.shorewall.net/pipermail/*]">
|
||||
</font> </form>
|
||||
|
||||
<p><font color="#ffffff"><b> <a
|
||||
href="http://lists.shorewall.net/htdig/search.html"> <font
|
||||
color="#ffffff">Extended Search</font></a></b></font></p>
|
||||
<a target="_top"
|
||||
href="file:///vfat/Shorewall-docs/1.3/index.html"><font color="#ffffff">
|
||||
</font></a><a target="_top"
|
||||
<a target="_top"
|
||||
href="file:///vfat/Shorewall-docs/1.3/index.html"><font color="#ffffff">
|
||||
</font></a><a target="_top"
|
||||
href="http://www1.shorewall.net/1.2/index.htm"><font color="#ffffff"><small><small><small></small></small></small></font></a><br>
|
||||
</td>
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</center>
|
||||
</div>
|
||||
|
||||
</center>
|
||||
</div>
|
||||
|
||||
<table border="0" cellpadding="5" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber2"
|
||||
bgcolor="#4b017c">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td
|
||||
width="100%" style="margin-top: 1px;">
|
||||
<tbody>
|
||||
<tr>
|
||||
|
||||
<td width="100%" style="margin-top: 1px;">
|
||||
|
||||
|
||||
|
||||
<p align="center"><a href="http://www.starlight.org"> <img
|
||||
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
||||
hspace="10">
|
||||
</a></p>
|
||||
|
||||
</a></p>
|
||||
|
||||
|
||||
|
||||
<p align="center"><font size="4" color="#ffffff">Shorewall is free
|
||||
but if you try it and find it useful, please consider making a donation
|
||||
to
|
||||
<a href="http://www.starlight.org"><font color="#ffffff">Starlight
|
||||
|
||||
<p align="center"><font size="4" color="#ffffff">Shorewall is free but
|
||||
if you try it and find it useful, please consider making a donation
|
||||
to
|
||||
<a href="http://www.starlight.org"><font color="#ffffff">Starlight
|
||||
Children's Foundation.</font></a> Thanks!</font></p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<p><font size="2">Updated 5/10/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
<br>
|
||||
|
||||
<p><font size="2">Updated 5/18/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
<br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
Loading…
Reference in New Issue
Block a user