holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity
2,192 Commits 104 Branches 736 Tags 54 MiB
d871e1f163
Commit Graph

415 Commits

Author SHA1 Message Date
teastep
d871e1f163 Set COMMAND=restore in restore-base 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2514 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-17 17:52:32 +00:00
teastep
af28486e63 Improve wording of OPENVPN server progress message 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2512 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-16 22:59:47 +00:00
teastep
80dd73b9e5 Add openvpnclient and openvpnserver tunnel types 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2511 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-16 21:57:43 +00:00
teastep
6a087fd50e Add support for exclusion lists in /etc/shorewall/tcrules 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2509 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-16 18:54:11 +00:00
teastep
85bf4377c5 Update release documentation for Shorewall 2.5.2 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2505 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-16 16:54:03 +00:00
teastep
b4067e7534 Restore ability to exclude a source sub-zone from DNAT, SAME and REDIRECT rules 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2504 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-16 16:31:55 +00:00
teastep
1beb8c15aa Generalize the notion of 'exclude list' in the rules file 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2503 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-16 00:11:08 +00:00
teastep
dee6d1ad0e Rework fix for bug in exclusion list processing 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2499 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-15 20:49:06 +00:00
teastep
a2dca45579 Fix bug in exclusion list processing 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2498 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-15 20:25:49 +00:00
teastep
fb9292eb71 Yet another improvement to rules generated for exclusion lists 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2497 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-15 20:21:52 +00:00
teastep
f6565e19a0 More improvements to rules generated for exclusion lists 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2496 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-15 20:16:34 +00:00
teastep
0f7def6c67 Improve rules generated for exclusion lists 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2495 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-15 18:33:51 +00:00
teastep
42ee8d0c19 Finally implement exclude lists in rules 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2493 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-15 17:35:45 +00:00
teastep
5df7bc0538 Remove sub-zone exclusion feature in preparation for implementing true exclude lists 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2492 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-15 16:04:39 +00:00
teastep
e075e8c3e2 Fix 'Packet type match' availability reporting with PKTTYPE=No 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2491 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-14 19:26:17 +00:00
teastep
999c74bf03 Generate an error when 'norfc1918' is specified for an interface with an RFC 1918 IP address 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2489 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-14 16:45:48 +00:00
teastep
ea1bf1a7c8 Make the calling sequence of 'build_exclusion_chain' more rational 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2488 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-13 21:39:34 +00:00
teastep
daef55a295 Back out ill-advised tcrules portlist patch 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2486 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-12 23:57:35 +00:00
teastep
1625a7c4f3 Allow port lists in tcrules 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2484 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-12 22:11:30 +00:00
teastep
370d61970a Add FASTACCEPT option to accept ESTABLISHED/RELATED packets early 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2474 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-11 19:53:07 +00:00
teastep
ed2076a0fc Fix problem with exclusion lists 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2469 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-11 01:40:50 +00:00
teastep
24dc05e6b7 Fix a couple of bugs 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2459 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-07 00:17:29 +00:00
teastep
e2253d6092 Install the Makefile -- Patch by Cristian Rodriquez 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2458 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-06 16:58:18 +00:00
teastep
39ca0828db Infrastructure for Unified Handling of Exclude Lists 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2457 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-05 15:52:03 +00:00
teastep
bba152b119 Don't generate redundant ACCEPT rules for DNAT/REDIRECT/SAME 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2456 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-05 14:13:45 +00:00
teastep
f56e907907 Correct typo in /etc/shorewall/policy; Allow "all+" in SOURCE/DEST in /etc/shorewall/rules to enable intra-zone traffic 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2454 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-04 20:24:23 +00:00
teastep
1b1af2fc65 Remove some dead code and reduce confusion amoung those who read the code (including me) 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2450 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-02 21:06:05 +00:00
teastep
ac1983a5da Large cleanup patch from Tuomo Soini 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2449 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-02 16:46:30 +00:00
teastep
3f748212d6 Globalize shorewall_is_started() 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2443 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-01 20:35:28 +00:00
teastep
c66159abee capitalize 'terminator' variable; duplicate PREROUTING connmark logic in OUTPUT 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2441 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-08-01 17:17:24 +00:00
teastep
9feb547b6e /sbin/shorewall status rework -- take 2 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2430 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-07-29 18:32:50 +00:00
teastep
48502e75bb Fix 'status' command in /usr/share/shorewall/firewall; try to make release notes clearer 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2429 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-07-28 20:22:25 +00:00
teastep
5f37ce46bf Fix typo which broke use of arping 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2426 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-07-27 22:41:52 +00:00
teastep
5f58eac0f7 Optimize use of 'arping' 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2423 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-07-27 22:13:25 +00:00
teastep
6c8b63bfe0 Remove dependence on 'which' 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2421 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-07-27 20:30:16 +00:00
teastep
9a42f57a6a Allow 'ipsec' in /etc/shorewall/hosts to work in the presence of dynamic zones 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2419 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-07-27 17:29:20 +00:00
teastep
b66929a65e Large merge of function from EXPERIMENTAL to HEAD. 
1) Elimination of the "shorewall monitor" command.

2) The /etc/shorewall/ipsec and /etc/shorewall/zones file are combined into
a single /etc/shorewall/zones file. This is done in an upwardly-compatible
way so that current users can continue to use their existing files.

3) Support has been added for the arp_ignore interface option.

4) DROPINVALID has been removed from shorewall.conf. Behavior is as if
DROPINVALID=No was specified.

5) The 'nobogons' option and BOGON_LOG_LEVEL are removed.

6) Error and warning messages have been made easier to spot by using
capitalization (e.g., ERROR: and WARNING:).

7) The /etc/shorewall/policy file now contains a new connection policy and a
policy for ESTABLISHED packets. Useful for users of snort-inline who want to
pass all packets to the QUEUE target.

8) A new 'critical' option has been added to /etc/shorewall/routestopped.
Shorewall insures communication between the firewall and 'critical' hosts
throughout start, restart, stop and clear. Useful for diskless firewall's
with NFS-mounted file systems, LDAP servers, Crossbow, etc.

9) Macros. Macros are very similar to actions but are easier to use, allow
parameter substitution and are more efficient. Almost all of the standard
actions have been converted to macros in the EXPERIMENTAL branch.

10) The default value of ADD_IP_ALIASES in shorewall.conf is changed to No.

11) If you have 'make' installed on your firewall, then when you use
the '-f' option to 'shorewall start' (as happens when you reboot),
if your /etc/shorewall/ directory contains files that were modified
after Shorewall was last restarted then Shorewall is started using
the config files rather than using the saved configuration.


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2409 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-07-25 23:08:09 +00:00
teastep
89eaf99906 Pretty up the output of 'show actions' 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2403 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-07-24 16:49:02 +00:00
teastep
aaecd53a29 Add 'shorewall show actions command' 
Make it possible for the 'stopped' extension script to save commands in
the 'restore-tail' file by calling 'run_and_save_command' and
'save_command'


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2401 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-07-24 16:27:21 +00:00
teastep
f3ea3c7edb Avoid annoying 'ipset:not found' message 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2392 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-07-22 22:24:28 +00:00
teastep
fbabd7d6ef Obviate the need for 'loose' 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2389 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-07-21 19:48:33 +00:00
teastep
ca8e5631d3 Make \!<address> work in the SUBNET column of the masq file 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2374 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-07-20 01:10:28 +00:00
teastep
687704eff2 Add 'loose' provider option; add COPY column to providers file 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2370 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-07-18 22:40:26 +00:00
teastep
318e204358 Re-implement MACLIST_TTL 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2358 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-07-17 22:08:15 +00:00
teastep
c6e3e84352 Disable MACLIST_TTL 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2356 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-07-17 16:52:21 +00:00
teastep
1b5ac5c7d3 Make /sbin/shorewall issue a warning whenever startup is disabled 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2348 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-07-15 20:50:01 +00:00
teastep
379b58f628 A better patch to avoid blocking DHCP broadcasts during MAC verification 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2330 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-07-13 15:26:51 +00:00
teastep
ef9d22b647 Avoid blocking DHCP broadcasts during MAC verification 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2327 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-07-13 14:29:52 +00:00
teastep
d050552a36 Make TCPFLAGS_LOG_LEVEL=ULOG work with iptables-1.3.2. 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2322 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-07-12 00:42:08 +00:00
teastep
7d924c3b82 A couple of little buglets. 1) detect duplicate tracked interface in providers file; 2) don't permit destination interface in PREROUTING marking rule 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2315 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
 2005-07-09 23:23:45 +00:00