diff --git a/docs/MultiISP.xml b/docs/MultiISP.xml
index eb7d665be..940e24e68 100644
--- a/docs/MultiISP.xml
+++ b/docs/MultiISP.xml
@@ -774,7 +774,7 @@ fi
- ./etc/shorewall/masq and Multi-ISP
+ ./etc/shorewall/masq (/etc/shorewall/snat) and Multi-ISP
If you masquerade a local network, you will need to add masquerade
rules for both external interfaces. Referring to the diagram above, if
@@ -786,6 +786,13 @@ fi
eth0 0.0.0.0/0 206.124.146.176
eth1 0.0.0.0/0 130.252.99.27
+ When running Shorewall 5.0.14 or later, the equivalent
+ /etc/shorewall/snat is:
+
+ #ACTION SOURCE DEST PROTO PORT
+SNAT(206.124.146.176) 0.0.0.0/0 eth0
+SNAT(130252.99.27) 0.0.0.0/0 eth1
+
If you have a public subnet (for example 206.124.146.176/30)
behind your firewall, then use exclusion:
@@ -793,6 +800,12 @@ eth1 0.0.0.0/0 130.252.99.27
eth0 !206.124.146.176/29 206.124.146.176
eth1 0.0.0.0/0 130.252.99.27
+ The equivalent /etc/shorewall/snat is:
+
+ #ACTION SOURCE DEST PROTO PORT
+SNAT(206.124.146.176) !206.124.146.176/29 eth0
+SNAT(130.252.99.27) 0.0.0.0/0 eth1
+
Note that exclusion is only used on the interface corresponding to
internal subnetwork.
@@ -801,10 +814,10 @@ eth1 0.0.0.0/0 130.252.99.27
contains all of those addresses from being masqueraded.
- Entries in /etc/shorewall/masq have no
- effect on which ISP a particular connection will be sent through. That
- is rather the purpose of entries in
- /etc/shorewall/mangle and
+ Entries in /etc/shorewall/masq
+ (/etc/shorewall/snat) have no effect on which ISP
+ a particular connection will be sent through. That is rather the
+ purpose of entries in /etc/shorewall/mangle and
/etc/shorewall/rtrules.
@@ -830,7 +843,8 @@ Feb 9 17:23:45 gw.ilinx kernel: ll header: 00:a0:24:2a:1f:72:00:13:5f:07:97:05:
206.124.146.176. Another gotcha is that the incoming packet has already
had the destination IP address changed for DNAT or because the original
outgoing connection was altered by an entry in
- /etc/shorewall/masq (SNAT or Masquerade). So the
+ /etc/shorewall/masq or
+ /etc/shorewall/snat (SNAT or Masquerade). So the
destination IP address (206.124.146.176) may not have been the
destination IP address in the packet as it was initially
received.
@@ -960,6 +974,13 @@ net net DROP
#INTERFACE SOURCE ADDRESS
eth0 0.0.0.0/0 206.124.146.176
eth1 0.0.0.0/0 130.252.99.27
+
+ When running Shorewall 5.0.14 or later, the equivalent
+ /etc/shorewall/snat is:
+
+ #ACTION SOURCE DEST PROTO PORT
+SNAT(206.124.146.176) 0.0.0.0/0 eth0
+SNAT(130.252.99.27) 0.0.0.0/0 eth1
@@ -1050,7 +1071,8 @@ DNAT net loc:192.168.1.3 tcp 25 <
For each external interface, you need to add an entry to
- /etc/shorewall/masq.
+ /etc/shorewall/masq
+ (/etc/shorewall/snat).
@@ -1066,6 +1088,14 @@ ISP3 3 3 main eth3 16.105.78.254 track,ba
eth0 0.0.0.0/0 206.124.146.176
eth1 0.0.0.0/0 130.252.99.27
eth3 0.0.0.0/0 16.105.78.4
+
+ When running Shorewall 5.0.14 or later, the equivalent
+ /etc/shorewall/snat is:
+
+ #ACTION SOURCE DEST PROTO PORT
+SNAT(206.124.146.176) 0.0.0.0/0 eth0
+SNAT(130.252.99.27) 0.0.0.0/0 eth1
+SNAT(16.105.78.4) 0.0.0.0/0 eth2
@@ -2498,8 +2528,9 @@ exit 0
- Entries in /etc/shorewall/masq must be
- qualified by the provider name (or number).
+ Entries in /etc/shorewall/masq and
+ /etc/shorewall/snat must be qualified by the
+ provider name (or number).
diff --git a/docs/NAT.xml b/docs/NAT.xml
index 1dcf6a73b..f7f2d5490 100644
--- a/docs/NAT.xml
+++ b/docs/NAT.xml
@@ -79,7 +79,8 @@
Be sure that the internal system(s) (10.1.1.2 and 10.1.1.3 in the
above example) is (are) not included in any specification in
- /etc/shorewall/masq or
+ /etc/shorewall/masq
+ (/etc/shorewall/snat) or
/etc/shorewall/proxyarp.
diff --git a/docs/PacketHandling.xml b/docs/PacketHandling.xml
index e150783f7..5347946d6 100644
--- a/docs/PacketHandling.xml
+++ b/docs/PacketHandling.xml
@@ -311,9 +311,10 @@
The source IP address may be rewritten according to an entry in
- the /etc/shorewall/masq file. If this is a new
- connection request, then the rewriting occurs in a
- nat table chain called /etc/shorewall/masq or
+ /etc/shorewall/snat file (Shorewall 5.0.14 or
+ later). If this is a new connection request, then the rewriting occurs
+ in a nat table chain called interface_masq where
interface is the interface on which the packet
will be sent. For packets that are part of an already established
diff --git a/docs/ProxyARP.xml b/docs/ProxyARP.xml
index ec778a2fd..396ba47b1 100644
--- a/docs/ProxyARP.xml
+++ b/docs/ProxyARP.xml
@@ -98,7 +98,8 @@
Be sure that the internal systems
(130.242.100.18 and 130.252.100.19 in the above example) are not included
- in any specification in /etc/shorewall/masq or
+ in any specification in /etc/shorewall/masq
+ (/etc/shorewall/snat on Shorewall 5.0.14 or later) or
/etc/shorewall/nat.