diff --git a/Shorewall-docs2/Shorewall_and_Routing.xml b/Shorewall-docs2/Shorewall_and_Routing.xml
index 5a3b645cd..f04032da2 100644
--- a/Shorewall-docs2/Shorewall_and_Routing.xml
+++ b/Shorewall-docs2/Shorewall_and_Routing.xml
@@ -15,7 +15,7 @@
- 2005-03-03
+ 2005-05-15
2005
@@ -177,7 +177,8 @@
the Shorewall init script (/etc/init.d/shorewall) to
configure your alternate routing table at boot time and that other than as described in the previous section, there is no
- connection between Shorewall and routing.
+ connection between Shorewall and routing when using Shorewall versions
+ prior to 2.3.3.
@@ -203,4 +204,179 @@
ip route add 206.124.146.177 dev eth1
-
+
+
+ Routing with Shorewall 2.3.3 and Later
+
+ Beginning with Shorewall 2.2.3, Shorewall is integrated with the
+ ROUTE target extension available from Netfilter Patch-O-Matic-NG (http://www.netfilter.org).
+
+
+ As of this writing, I know of no distribution that is shipping a
+ kernel or iptables with the ROUTE target patch included. This means that
+ you must patch and build your own kernel and iptables.
+
+
+ See Shorewall FAQ 42 for
+ information about determining if your kernel and iptables have this
+ support enabled. You must be running Shorewall 2.3.3 or later to make this
+ determination.
+
+ Routing with Shorewall is specified through entries in
+ /etc/shorewall/routes. Columns in this file are as follows:
+
+
+
+ SOURCE
+
+
+ Source of the packet. May be any of the following:
+
+
+
+ A host or network address
+
+
+
+ A network interface name.
+
+
+
+ The name of an ipset prefaced with "+"
+
+
+
+ $FW (for packets originating on the firewall)
+
+
+
+ A MAC address in Shorewall format
+
+
+
+ A range of IP addresses (assuming that your kernel and
+ iptables support range match)
+
+
+
+ A network interface name followed by ":" and an address or
+ address range.
+
+
+
+
+
+
+ DEST
+
+
+ Destination of the packet. May be any of the following:
+
+
+
+ A host or network address
+
+
+
+ A network interface name (determined from routing
+ table(s))
+
+
+
+ The name of an ipset prefaced with "+"
+
+
+
+ A network interface name followed by ":" and an address or
+ address range.
+
+
+
+
+
+
+ PROTO
+
+
+ Protocol - Must be a protocol listed in /etc/protocols, a
+ number or "ipp2p", a number, or "all". "ipp2p" require ipp2p match
+ support in your kernel and iptables.
+
+
+
+
+ PORT(S)
+
+
+ Destination Ports. A comma-separated list of Port names (from
+ /etc/services), port numbers or port ranges; if the protocol is
+ "icmp", this column is interpreted as the destination
+ icmp-type(s).
+
+ If the protocol is ipp2p, this column is interpreted as an
+ ipp2p option without the leading "--" (example "bit" for
+ bit-torrent). If no PORT is given, "ipp2p" is assumed.
+
+ This column is ignored if PROTOCOL = all but must be entered
+ if any of the following field is supplied. In that case, it is
+ suggested that this field contain "-"
+
+
+
+
+ SOURCE PORT(S)
+
+
+ Optional) Source port(s). If omitted, any source port is
+ acceptable. Specified as a comma-separated list of port names, port
+ numbers or port ranges.
+
+
+
+
+ INTERFACE
+
+
+ The interface that the packet is to be routed out of. If you
+ do not specify this field then you must place "-" in this column and
+ enter an IP address in the GATEWAY column.
+
+
+
+
+ GATEWAY
+
+
+ The gateway that the packet is to be forewarded
+ through.
+
+
+
+
+ The idea here is that traffic that matches the SOURCE, DEST, PROTO,
+ PORT(S) and SOURCE PORT(S) columns is routed out of the INTERFACE through
+ the optional GATEWAY.
+
+
+ Example:
+
+ Your local interface is eth1 and your DMZ interface is eth2. You
+ want to run Squid as a transparent proxy for HTTP on 192.168.3.22 in
+ your DMZ. You would use the following entry in
+ /etc/shorewall/routes:
+
+ #SOURCE DEST PROTO PORT(S) SOURCE INTERFACE GATEWAY
+# PORT(S)
+eth1 0.0.0.0/0 tcp 80 - eth1 192.168.3.22
+
+ This entry specifies that "traffic coming in through eth1 to TCP
+ port 80 is to be routed out of eth1 to gateway 192.168.3.22".
+
+
+ Note that entries in the /etc/shorewall/routes file override the
+ routing specified in your routing tables. These rules generate Netfilter
+ rules in the mangle tables FORWARD chain or OUTPUT chain (see figure
+ above).
+
+
\ No newline at end of file