Merge branch '5.0.15'

Signed-off-by: Tom Eastep <teastep@shorewall.net>

Shorewall-core/install.sh

@@ -365,6 +365,12 @@ fi
 # Note: ${VARDIR} is created at run-time since it has always been
 #       a relocatable directory on a per-product basis
 #
+# Install the CLI
+#
+install_file shorewall ${DESTDIR}${SBINDIR}/shorewall 0755
+[ $SHAREDIR = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SBINDIR}/shorewall
+echo "Shorewall CLI program installed in ${DESTDIR}${SBINDIR}/$PRODUCT"
+#
 # Install wait4ifup
 #
 install_file wait4ifup ${DESTDIR}${LIBEXECDIR}/shorewall/wait4ifup 0755
@@ -380,6 +386,31 @@ for f in lib.* ; do
     echo "Library ${f#*.} file installed as ${DESTDIR}${SHAREDIR}/shorewall/$f"
 done
 
+if [ $SHAREDIR != /usr/share ]; then
+    eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/${PRODUCT}/lib.base
+    eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/${PRODUCT}/lib.core
+    eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/${PRODUCT}/lib.cli
+fi
+
+#
+# Install the Man Pages
+#
+if [ -n "$MANDIR" ]; then
+    cd manpages
+
+    [ -n "$INSTALLD" ] || mkdir -p ${DESTDIR}${MANDIR}/man8/
+
+    for f in *.8; do
+	gzip -9c $f > $f.gz
+	install_file $f.gz ${DESTDIR}${MANDIR}/man8/$f.gz 644
+	echo "Man page $f.gz installed to ${DESTDIR}${MANDIR}/man8/$f.gz"
+    done
+
+    cd ..
+
+    echo "Man Pages Installed"
+fi
+
 #
 # Symbolically link 'functions' to lib.base
 #

Shorewall-core/lib.base

@@ -20,412 +20,22 @@
 #	You should have received a copy of the GNU General Public License
 #	along with this program; if not, see <http://www.gnu.org/licenses/>.
 #
-# This library contains the code common to all Shorewall components except the
-# generated scripts.
+# This library is a compatibility wrapper around lib.core.
 #
 
-SHOREWALL_LIBVERSION=40509
-
-[ -n "${g_program:=shorewall}" ]
-
-if [ -z "$g_readrc" ]; then
+if [ -z "$PRODUCT" ]; then
     #
     # This is modified by the installer when ${SHAREDIR} != /usr/share
     #
     . /usr/share/shorewall/shorewallrc
 
-    g_sharedir="$SHAREDIR"/$g_program
-    g_confdir="$CONFDIR"/$g_program
-    g_readrc=1
+    g_basedir=${SHAREDIR}/shorewall
+
+    if [ -z "$SHOREWALL_LIBVERSION" ]; then
+	. ${g_basedir}/lib.core
+    fi
+
+    set_default_product
+
+    setup_product_environment
 fi
-
-g_basedir=${SHAREDIR}/shorewall
-
-case $g_program in
-    shorewall)
-	g_product="Shorewall"
-	g_family=4
-	g_tool=iptables
-	g_lite=
-	;;
-    shorewall6)
-	g_product="Shorewall6"
-	g_family=6
-	g_tool=ip6tables
-	g_lite=
-	;;
-    shorewall-lite)
-	g_product="Shorewall Lite"
-	g_family=4
-	g_tool=iptables
-	g_lite=Yes
-	;;
-    shorewall6-lite)
-	g_product="Shorewall6 Lite"
-	g_family=6
-	g_tool=ip6tables
-	g_lite=Yes
-	;;
-esac
-
-if [ -z "${VARLIB}" ]; then
-    VARLIB=${VARDIR}
-    VARDIR=${VARLIB}/$g_program
-elif [ -z "${VARDIR}" ]; then
-    VARDIR="${VARLIB}/${PRODUCT}"
-fi
-
-#
-# Fatal Error
-#
-fatal_error() # $@ = Message
-{
-    echo "   ERROR: $@" >&2
-    exit 2
-}
-
-#
-# Not configured Error
-#
-not_configured_error() # $@ = Message
-{
-    echo "   ERROR: $@" >&2
-    exit 6
-}
-
-#
-# Conditionally produce message
-#
-progress_message() # $* = Message
-{
-    local timestamp
-    timestamp=
-
-    if [ $VERBOSITY -gt 1 ]; then
-	[ -n "$g_timestamp" ] && timestamp="$(date +%H:%M:%S) "
-	echo "${timestamp}$@"
-    fi
-}
-
-progress_message2() # $* = Message
-{
-    local timestamp
-    timestamp=
-
-    if [ $VERBOSITY -gt 0 ]; then
-	[ -n "$g_timestamp" ] && timestamp="$(date +%H:%M:%S) "
-	echo "${timestamp}$@"
-    fi
-}
-
-progress_message3() # $* = Message
-{
-    local timestamp
-    timestamp=
-
-    if [ $VERBOSITY -ge 0 ]; then
-	[ -n "$g_timestamp" ] && timestamp="$(date +%H:%M:%S) "
-	echo "${timestamp}$@"
-    fi
-}
-
-#
-# Undo the effect of 'separate_list()'
-#
-combine_list()
-{
-    local f
-    local o
-    o=
-
-    for f in $* ; do
-        o="${o:+$o,}$f"
-    done
-
-    echo $o
-}
-
-#
-# Validate an IP address
-#
-valid_address() {
-    local x
-    local y
-    local ifs
-    ifs=$IFS
-
-    IFS=.
-
-    for x in $1; do
-	case $x in
-	    [0-9]|[0-9][0-9]|[1-2][0-9][0-9])
-		[ $x -lt 256 ] || { IFS=$ifs; return 2; }
-                ;;
-	    *)
-	        IFS=$ifs
-		return 2
-		;;
-	esac
-    done
-
-    IFS=$ifs
-
-    return 0
-}
-
-#
-# Miserable Hack to work around broken BusyBox ash in OpenWRT
-#
-addr_comp() {
-    test $(bc <<EOF
-$1 > $2
-EOF
-) -eq 1
-
-}
-
-#
-# Enumerate the members of an IP range -- When using a shell supporting only
-# 32-bit signed arithmetic, the range cannot span 128.0.0.0.
-#
-# Comes in two flavors:
-#
-# ip_range() - produces a mimimal list of network/host addresses that spans
-#              the range.
-#
-# ip_range_explicit() - explicitly enumerates the range.
-#
-ip_range() {
-    local first
-    local last
-    local l
-    local x
-    local y
-    local z
-    local vlsm
-
-    case $1 in
-	!*)
-	    #
-	    # Let iptables complain if it's a range
-	    #
-	    echo $1
-	    return
-	    ;;
-	[0-9]*.*.*.*-*.*.*.*)
-            ;;
-	*)
-	    echo $1
-	    return
-	    ;;
-    esac
-
-    first=$(decodeaddr ${1%-*})
-    last=$(decodeaddr ${1#*-})
-
-    if addr_comp $first $last; then
-	fatal_error "Invalid IP address range: $1"
-    fi
-
-    l=$(( $last + 1 ))
-
-    while addr_comp $l $first; do
-	vlsm=
-	x=31
-	y=2
-	z=1
-
-	while [ $(( $first % $y )) -eq 0 ] && ! addr_comp $(( $first + $y )) $l; do
-	    vlsm=/$x
-	    x=$(( $x - 1 ))
-	    z=$y
-	    y=$(( $y * 2 ))
-	done
-
-	echo $(encodeaddr $first)$vlsm
-	first=$(($first + $z))
-    done
-}
-
-ip_range_explicit() {
-    local first
-    local last
-
-    case $1 in
-    [0-9]*.*.*.*-*.*.*.*)
-	;;
-    *)
-	echo $1
-	return
-	;;
-    esac
-
-    first=$(decodeaddr ${1%-*})
-    last=$(decodeaddr ${1#*-})
-
-    if addr_comp $first $last; then
-	fatal_error "Invalid IP address range: $1"
-    fi
-
-    while ! addr_comp $first $last; do
-	echo $(encodeaddr $first)
-	first=$(($first + 1))
-    done
-}
-
-[ -z "$LEFTSHIFT" ] && . ${g_basedir}/lib.common
-
-#
-# Netmask to VLSM
-#
-ip_vlsm() {
-    local mask
-    mask=$(decodeaddr $1)
-    local vlsm
-    vlsm=0
-    local x
-    x=$(( 128 << 24 )) # 0x80000000
-
-    while [ $(( $x & $mask )) -ne 0 ]; do
-	[ $mask -eq $x ] && mask=0 || mask=$(( $mask $LEFTSHIFT 1 )) # Not all shells shift 0x80000000 left properly.
-	vlsm=$(($vlsm + 1))
-    done
-
-    if [ $(( $mask & 2147483647 )) -ne 0 ]; then # 2147483647 = 0x7fffffff
-	echo "Invalid net mask: $1" >&2
-    else
-	echo $vlsm
-    fi
-}
-
-#
-# Set default config path
-#
-ensure_config_path() {
-    local F
-    F=${g_sharedir}/configpath
-    if [ -z "$CONFIG_PATH" ]; then
-	[ -f $F ] || { echo "   ERROR: $F does not exist"; exit 2; }
-	. $F
-    fi
-
-    if [ -n "$g_shorewalldir" ]; then
-	[ "${CONFIG_PATH%%:*}" = "$g_shorewalldir" ] || CONFIG_PATH=$g_shorewalldir:$CONFIG_PATH
-    fi
-}
-
-#
-# Get fully-qualified name of file
-#
-resolve_file() # $1 = file name
-{
-    local pwd
-    pwd=$PWD
-
-    case $1 in
-	/*)
-	    echo $1
-	    ;;
-	.)
-	    echo $pwd
-	    ;;
-	./*)
-	    echo ${pwd}${1#.}
-	    ;;
-	..)
-	    cd ..
-	    echo $PWD
-	    cd $pwd
-	    ;;
-	../*)
-	    cd ..
-	    resolve_file ${1#../}
-	    cd $pwd
-	    ;;
-	*)
-	    echo $pwd/$1
-	    ;;
-    esac
-}
-
-#
-# Determine how to do "echo -e"
-#
-
-find_echo() {
-    local result
-
-    result=$(echo "a\tb")
-    [ ${#result} -eq 3 ] && { echo echo; return; }
-
-    result=$(echo -e "a\tb")
-    [ ${#result} -eq 3 ] && { echo "echo -e"; return; }
-
-    result=$(which echo)
-    [ -n "$result" ] && { echo "$result -e"; return; }
-
-    echo echo
-}
-
-# Determine which version of mktemp is present (if any) and set MKTEMP accortingly:
-#
-#     None - No mktemp
-#     BSD  - BSD mktemp (Mandrake)
-#     STD  - mktemp.org mktemp
-#
-find_mktemp() {
-    local mktemp
-    mktemp=`mywhich mktemp 2> /dev/null`
-
-    if [ -n "$mktemp" ]; then
-	if qt mktemp -V ; then
-	    MKTEMP=STD
-	else
-	    MKTEMP=BSD
-	fi
-    else
-	MKTEMP=None
-    fi
-}
-
-#
-# create a temporary file. If a directory name is passed, the file will be created in
-# that directory. Otherwise, it will be created in a temporary directory.
-#
-mktempfile() {
-
-    [ -z "$MKTEMP" ] && find_mktemp
-
-    if [ $# -gt 0 ]; then
-	case "$MKTEMP" in
-	    BSD)
-		mktemp $1/shorewall.XXXXXX
-		;;
-	    STD)
-		mktemp -p $1 shorewall.XXXXXX
-		;;
-	    None)
-		> $1/shorewall-$$ && echo $1/shorewall-$$
-		;;
-	    *)
-		error_message "ERROR:Internal error in mktempfile"
-		;;
-	esac
-    else
-	case "$MKTEMP" in
-	    BSD)
-		mktemp ${TMPDIR:-/tmp}/shorewall.XXXXXX
-		;;
-	    STD)
-		mktemp -t shorewall.XXXXXX
-		;;
-	    None)
-		rm -f ${TMPDIR:-/tmp}/shorewall-$$
-		> ${TMPDIR:-}/shorewall-$$ && echo ${TMPDIR:-/tmp}/shorewall-$$
-		;;
-	    *)
-		error_message "ERROR:Internal error in mktempfile"
-		;;
-	esac
-    fi
-}

Shorewall-core/lib.cli

@@ -25,22 +25,18 @@
 # loaded after this one and replaces some of the functions declared here.
 #
 
-SHOREWALL_CAPVERSION=50004
+SHOREWALL_CAPVERSION=50100
 
-[ -n "${g_program:=shorewall}" ]
-
-if [ -z "$g_readrc" ]; then
+if [ -z "$g_basedir" ]; then
     #
     # This is modified by the installer when ${SHAREDIR} <> /usr/share
     #
     . /usr/share/shorewall/shorewallrc
 
-    g_sharedir="$SHAREDIR"/$g_program
-    g_confdir="$CONFDIR"/$g_program
-    g_readrc=1
+    g_basedir=${SHAREDIR}/shorewall
 fi
 
-. ${SHAREDIR}/shorewall/lib.base
+. ${g_basedir}/lib.core
 
 #
 # Issue an error message and die
@@ -949,7 +945,7 @@ show_events() {
 	for file in /proc/net/xt_recent/*; do
 	    base=$(basename $file)
 
-	    if [ $base != %CURRENTTIME ]; then
+	    if [ "$base" != %CURRENTTIME -a "$base" != "*" ]; then
 		echo $base
 		show_event $base
 		echo
@@ -1161,6 +1157,11 @@ show_macros() {
     done
 }
 
+show_a_macro() {
+    echo "Shorewall $SHOREWALL_VERSION Macro $1 at $g_hostname - $(date)"
+    cat ${directory}/macro.$1
+}
+
 #
 # Show Command Executor
 #
@@ -1356,14 +1357,14 @@ show_command() {
 		echo "LIBEXEC=${LIBEXECDIR}"
 		echo "SBINDIR=${SBINDIR}"
 		echo "CONFDIR=${CONFDIR}"
-		[ -n "$g_lite" ] && [ ${VARDIR} != /var/lib/$g_program ] && echo "LITEDIR=${VARDIR}"
+		[ -n "$g_lite" ] && [ ${VARDIR} != /var/lib/$PRODUCT ] && echo "LITEDIR=${VARDIR}"
 	    else
 		echo "Default CONFIG_PATH is $CONFIG_PATH"
-		echo "Default VARDIR is /var/lib/$g_program"
+		echo "Default VARDIR is /var/lib/$PRODUCT"
 		echo "LIBEXEC is ${LIBEXECDIR}"
 		echo "SBINDIR is ${SBINDIR}"
 		echo "CONFDIR is ${CONFDIR}"
-		[ -n "$g_lite" ] && [ ${VARDIR} != /var/lib/$g_program ] && echo "LITEDIR is ${VARDIR}"
+		[ -n "$g_lite" ] && [ ${VARDIR} != /var/lib/$PRODUCT ] && echo "LITEDIR is ${VARDIR}"
 	    fi
 	    ;;
 	chain)
@@ -1427,7 +1428,7 @@ show_command() {
 	    fi
 	    ;;
 	*)
-	    case "$g_program" in
+	    case "$PRODUCT" in
 		*-lite)
 		    ;;
 	    	*)
@@ -1441,8 +1442,7 @@ show_command() {
 			    [ $# -ne 2 ] && too_many_arguments $2
 			    for directory in $(split $CONFIG_PATH); do
 				if [ -f ${directory}/macro.$2 ]; then
-				    echo "Shorewall $SHOREWALL_VERSION Macro $2 at $g_hostname - $(date)"
-				    cat ${directory}/macro.$2
+				    eval show_a_macro $2 $g_pager
 				    return
 				fi
 			    done
@@ -1805,6 +1805,7 @@ dump_command() {
 restore_command() {
     local finished
     finished=0
+    local result
 
     while [ $finished -eq 0 -a $# -gt 0 ]; do
 	option=$1
@@ -1869,8 +1870,11 @@ restore_command() {
 	progress_message3 "Restoring $g_product..."
 
 	run_it $g_restorepath restore && progress_message3 "$g_product restored from ${VARDIR}/$RESTOREFILE"
+	result=$?
 
 	[ -n "$g_nolock" ] || mutex_off
+
+	exit $result
     else
 	echo "File $g_restorepath: file not found"
 	[ -n "$g_nolock" ] || mutex_off
@@ -2795,6 +2799,7 @@ determine_capabilities() {
     IFACE_MATCH=
     TCPMSS_TARGET=
     WAIT_OPTION=
+    CPU_FANOUT=
 
     AMANDA_HELPER=
     FTP_HELPER=
@@ -3092,7 +3097,12 @@ determine_capabilities() {
 	qt $g_tool -A $chain -m hashlimit --hashlimit 4 --hashlimit-burst 5 --hashlimit-name $chain --hashlimit-mode dstip -j ACCEPT && OLD_HL_MATCH=Yes
 	HASHLIMIT_MATCH=$OLD_HL_MATCH
     fi
-    qt $g_tool -A $chain -j NFQUEUE --queue-num 4 && NFQUEUE_TARGET=Yes
+
+    if qt $g_tool -A $chain -j NFQUEUE --queue-num 4; then
+	NFQUEUE_TARGET=Yes
+	qt $g_tool -A $chain -j NFQUEUE --queue-balance 0:3 --queue-cpu-fanout && CPU_FANOUT=Yes
+    fi
+
     qt $g_tool -A $chain -m realm --realm 4 && REALM_MATCH=Yes
 
     #
@@ -3290,6 +3300,7 @@ report_capabilities_unsorted() {
     report_capability "Basic Filter (BASIC_FILTER)" $BASIC_FILTER
     report_capability "Basic Ematch (BASIC_EMATCH)" $BASIC_EMATCH
     report_capability "CT Target (CT_TARGET)" $CT_TARGET
+    report_capability "NFQUEUE CPU Fanout (CPU_FANOUT)" $CPU_FANOUT
 
     echo "   Kernel Version (KERNELVERSION): $KERNELVERSION"
     echo "   Capabilities Version (CAPVERSION): $CAPVERSION"
@@ -3395,6 +3406,7 @@ report_capabilities_unsorted1() {
     report_capability1 IFACE_MATCH
     report_capability1 TCPMSS_TARGET
     report_capability1 WAIT_OPTION
+    report_capability1 CPU_FANOUT
 
     report_capability1 AMANDA_HELPER
     report_capability1 FTP_HELPER
@@ -3566,7 +3578,7 @@ blacklist_command() {
 		if [ $VERBOSITY -gt 1 ]; then
 		    echo "$message" | awk '/have been deleted/ { sub( /^.*: /, "" ); sub( / /,  " src " ); }; { print; }'
 		else
-		    echo "$message" | head -n1 | sed '/^.*: //; s/ / src /'
+		    echo "$message" | head -n1 | sed 's/^.*: //; s/ / src /'
 		fi
 	    fi
 
@@ -3576,7 +3588,7 @@ blacklist_command() {
 		    if [ $VERBOSITY -gt 1 ]; then
 			echo "$message" | awk '/have been deleted/ { sub( /^.*: /, "" ); sub( / /,  " dst " ); }; { print; }'
 		    else
-			echo "$message" | head -n1 | sed '/^.*: //; s/ / dst /'
+			echo "$message" | head -n1 | sed 's/^.*: //; s/ / dst /'
 		    fi
 		fi
 	    fi
@@ -3866,7 +3878,7 @@ get_config() {
 
     ensure_config_path
 
-    config=$(find_file ${g_program}.conf)
+    config=$(find_file ${PRODUCT}.conf)
 
     if [ -f $config ]; then
 	if [ -r $config ]; then
@@ -3992,6 +4004,7 @@ get_config() {
 
     g_loopback=$(find_loopback_interfaces)
 
+    if [ -z "$g_nopager" ]; then
 	[ -n "$PAGER" ] || PAGER=$DEFAULT_PAGER
 
 	if [ -n "$PAGER" -a -t 1 ]; then
@@ -4010,6 +4023,7 @@ get_config() {
 
 	    g_pager="| $g_pager"
 	fi
+    fi
 
     if [ -n "$DYNAMIC_BLACKLIST" ]; then
 	setup_dbl
@@ -4315,7 +4329,7 @@ usage() # $1 = exit status
 #
 # This is the main entry point into the CLI. It directly handles all commands supported
 # by both the full and lite versions. Note, however, that functions such as start_command()
-# appear in both this library and it lib.cli-std. The ones in cli-std overload the ones
+# appear in both this library and in lib.cli-std. The ones in cli-std overload the ones
 # here if that lib is loaded below.
 #
 shorewall_cli() {
@@ -4357,13 +4371,17 @@ shorewall_cli() {
     g_loopback=
     g_compiled=
     g_pager=
+    g_nopager=
     g_blacklistipset=
     g_disconnect=
+    g_options=
 
     VERBOSE=
     VERBOSITY=1
-
-    [ -n "$g_lite" ] || . ${g_basedir}/lib.cli-std
+    #
+    # Set the default product based on the Shorewall packages installed
+    #
+    set_default_product
 
     finished=0
 
@@ -4453,6 +4471,34 @@ shorewall_cli() {
 			    g_timestamp=Yes
 			    option=${option#t}
 			    ;;
+			p*)
+			    g_nopager=Yes
+			    option=${option#p}
+			    ;;
+			6*)
+			    if [ "$PRODUCT" = shorewall ]; then
+				PRODUCT=shorewall6
+			    elif [ "$PRODUCT" = shorewall-lite ]; then
+				PRODUCT=shorewall6-lite
+			    fi
+			    option=${option#6}
+			    ;;
+			4*)
+			    if [ "$PRODUCT" = shorewall6 ]; then
+				PRODUCT=shorewall
+			    elif [ "$PRODUCT" = shorewall6-lite ]; then
+				PRODUCT=shorewall-lite
+			    fi
+			    option=${option#4}
+			    ;;
+			l*)
+			    if [ "$PRODUCT" = shorewall ]; then
+				PRODUCT=shorewall-lite
+			    elif [ "$PRODUCT" = shorewall6 ]; then
+				PRODUCT=shorewall6-lite
+			    fi
+			    option=${option#l}
+			    ;;
 			-)
 			    finished=1
 			    option=
@@ -4474,12 +4520,16 @@ shorewall_cli() {
 	usage 1
     fi
 
+    setup_product_environment 1
+
+   [ -n "$g_lite" ] || . ${SHAREDIR}/shorewall/lib.cli-std
+
     PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
     MUTEX_TIMEOUT=
 
     [ -f ${g_confdir}/vardir ] && . ${g_confdir}/vardir
 
-    [ -n "${VARDIR:=/var/lib/$g_program}" ]
+    [ -n "${VARDIR:=/var/lib/$PRODUCT}" ]
 
     g_firewall=${VARDIR}/firewall
 

Shorewall-core/lib.core

@@ -0,0 +1,445 @@
+#
+# Shorewall 5.0 -- /usr/share/shorewall/lib.core
+#
+#     (c) 1999-2015 - Tom Eastep (teastep@shorewall.net)
+#
+#	Complete documentation is available at http://shorewall.net
+#
+#       This program is part of Shorewall.
+#
+#	This program is free software; you can redistribute it and/or modify
+#	it under the terms of the GNU General Public License as published by the
+#       Free Software Foundation, either version 2 of the license or, at your
+#       option, any later version.
+#
+#	This program is distributed in the hope that it will be useful,
+#	but WITHOUT ANY WARRANTY; without even the implied warranty of
+#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+#	GNU General Public License for more details.
+#
+#	You should have received a copy of the GNU General Public License
+#	along with this program; if not, see <http://www.gnu.org/licenses/>.
+#
+# This library contains the code common to all Shorewall components except the
+# generated scripts.
+#
+
+SHOREWALL_LIBVERSION=50100
+
+#
+# Fatal Error
+#
+fatal_error() # $@ = Message
+{
+    echo "   ERROR: $@" >&2
+    exit 2
+}
+
+setup_product_environment() { # $1 -- if non-empty, source shorewallrc 
+    g_basedir=${SHAREDIR}/shorewall
+
+    g_sharedir="$SHAREDIR"/$PRODUCT
+    g_confdir="$CONFDIR"/$PRODUCT
+
+    case $PRODUCT in
+	shorewall)
+	    g_product="Shorewall"
+	    g_family=4
+	    g_tool=iptables
+	    g_lite=
+	    g_options=-l
+	    ;;
+	shorewall6)
+	    g_product="Shorewall6"
+	    g_family=6
+	    g_tool=ip6tables
+	    g_lite=
+	    g_options=-6l
+	    ;;
+	shorewall-lite)
+	    g_product="Shorewall Lite"
+	    g_family=4
+	    g_tool=iptables
+	    g_lite=Yes
+	    ;;
+	shorewall6-lite)
+	    g_product="Shorewall6 Lite"
+	    g_family=6
+	    g_tool=ip6tables
+	    g_lite=Yes
+	    ;;
+	*)
+	    fatal_error "Unknown PRODUCT ($PRODUCT)"
+	    ;;
+    esac
+
+    [ -f ${SHAREDIR}/${PRODUCT}/version ] || fatal_error "$g_product does not appear to be installed on this system"
+    #
+    # We need to do this again, now that we have the correct product
+    #
+    [ -n "$1" ] && . ${g_basedir}/shorewallrc
+
+    if [ -z "${VARLIB}" ]; then
+	VARLIB=${VARDIR}
+	VARDIR=${VARLIB}/${PRODUCT}
+    elif [ -z "${VARDIR}" ]; then
+	VARDIR="${VARLIB}/${PRODUCT}"
+    fi
+}
+
+set_default_product() {
+    if [ -f ${g_basedir}/version ]; then
+	PRODUCT=shorewall
+    elif [ -f ${SHAREDIR}/shorewall-lite/version ]; then
+	PRODUCT=shorewall-lite
+    elif [ -f ${SHAREDIR}/shorewall6-lite/version ]; then
+	PRODUCT=shorewall6-lite
+    else
+	fatal_error "No Shorewall firewall product is installed"
+    fi
+}   
+
+# Not configured Error
+#
+not_configured_error() # $@ = Message
+{
+    echo "   ERROR: $@" >&2
+    exit 6
+}
+
+#
+# Conditionally produce message
+#
+progress_message() # $* = Message
+{
+    local timestamp
+    timestamp=
+
+    if [ $VERBOSITY -gt 1 ]; then
+	[ -n "$g_timestamp" ] && timestamp="$(date +%H:%M:%S) "
+	echo "${timestamp}$@"
+    fi
+}
+
+progress_message2() # $* = Message
+{
+    local timestamp
+    timestamp=
+
+    if [ $VERBOSITY -gt 0 ]; then
+	[ -n "$g_timestamp" ] && timestamp="$(date +%H:%M:%S) "
+	echo "${timestamp}$@"
+    fi
+}
+
+progress_message3() # $* = Message
+{
+    local timestamp
+    timestamp=
+
+    if [ $VERBOSITY -ge 0 ]; then
+	[ -n "$g_timestamp" ] && timestamp="$(date +%H:%M:%S) "
+	echo "${timestamp}$@"
+    fi
+}
+
+#
+# Undo the effect of 'separate_list()'
+#
+combine_list()
+{
+    local f
+    local o
+    o=
+
+    for f in $* ; do
+        o="${o:+$o,}$f"
+    done
+
+    echo $o
+}
+
+#
+# Validate an IP address
+#
+valid_address() {
+    local x
+    local y
+    local ifs
+    ifs=$IFS
+
+    IFS=.
+
+    for x in $1; do
+	case $x in
+	    [0-9]|[0-9][0-9]|[1-2][0-9][0-9])
+		[ $x -lt 256 ] || { IFS=$ifs; return 2; }
+                ;;
+	    *)
+	        IFS=$ifs
+		return 2
+		;;
+	esac
+    done
+
+    IFS=$ifs
+
+    return 0
+}
+
+#
+# Miserable Hack to work around broken BusyBox ash in OpenWRT
+#
+addr_comp() {
+    test $(bc <<EOF
+$1 > $2
+EOF
+) -eq 1
+
+}
+
+#
+# Enumerate the members of an IP range -- When using a shell supporting only
+# 32-bit signed arithmetic, the range cannot span 128.0.0.0.
+#
+# Comes in two flavors:
+#
+# ip_range() - produces a mimimal list of network/host addresses that spans
+#              the range.
+#
+# ip_range_explicit() - explicitly enumerates the range.
+#
+ip_range() {
+    local first
+    local last
+    local l
+    local x
+    local y
+    local z
+    local vlsm
+
+    case $1 in
+	!*)
+	    #
+	    # Let iptables complain if it's a range
+	    #
+	    echo $1
+	    return
+	    ;;
+	[0-9]*.*.*.*-*.*.*.*)
+            ;;
+	*)
+	    echo $1
+	    return
+	    ;;
+    esac
+
+    first=$(decodeaddr ${1%-*})
+    last=$(decodeaddr ${1#*-})
+
+    if addr_comp $first $last; then
+	fatal_error "Invalid IP address range: $1"
+    fi
+
+    l=$(( $last + 1 ))
+
+    while addr_comp $l $first; do
+	vlsm=
+	x=31
+	y=2
+	z=1
+
+	while [ $(( $first % $y )) -eq 0 ] && ! addr_comp $(( $first + $y )) $l; do
+	    vlsm=/$x
+	    x=$(( $x - 1 ))
+	    z=$y
+	    y=$(( $y * 2 ))
+	done
+
+	echo $(encodeaddr $first)$vlsm
+	first=$(($first + $z))
+    done
+}
+
+ip_range_explicit() {
+    local first
+    local last
+
+    case $1 in
+    [0-9]*.*.*.*-*.*.*.*)
+	;;
+    *)
+	echo $1
+	return
+	;;
+    esac
+
+    first=$(decodeaddr ${1%-*})
+    last=$(decodeaddr ${1#*-})
+
+    if addr_comp $first $last; then
+	fatal_error "Invalid IP address range: $1"
+    fi
+
+    while ! addr_comp $first $last; do
+	echo $(encodeaddr $first)
+	first=$(($first + 1))
+    done
+}
+
+[ -z "$LEFTSHIFT" ] && . ${g_basedir}/lib.common
+
+#
+# Netmask to VLSM
+#
+ip_vlsm() {
+    local mask
+    mask=$(decodeaddr $1)
+    local vlsm
+    vlsm=0
+    local x
+    x=$(( 128 << 24 )) # 0x80000000
+
+    while [ $(( $x & $mask )) -ne 0 ]; do
+	[ $mask -eq $x ] && mask=0 || mask=$(( $mask $LEFTSHIFT 1 )) # Not all shells shift 0x80000000 left properly.
+	vlsm=$(($vlsm + 1))
+    done
+
+    if [ $(( $mask & 2147483647 )) -ne 0 ]; then # 2147483647 = 0x7fffffff
+	echo "Invalid net mask: $1" >&2
+    else
+	echo $vlsm
+    fi
+}
+
+#
+# Set default config path
+#
+ensure_config_path() {
+    local F
+    F=${g_sharedir}/configpath
+    if [ -z "$CONFIG_PATH" ]; then
+	[ -f $F ] || { echo "   ERROR: $F does not exist"; exit 2; }
+	. $F
+    fi
+
+    if [ -n "$g_shorewalldir" ]; then
+	[ "${CONFIG_PATH%%:*}" = "$g_shorewalldir" ] || CONFIG_PATH=$g_shorewalldir:$CONFIG_PATH
+    fi
+}
+
+#
+# Get fully-qualified name of file
+#
+resolve_file() # $1 = file name
+{
+    local pwd
+    pwd=$PWD
+
+    case $1 in
+	/*)
+	    echo $1
+	    ;;
+	.)
+	    echo $pwd
+	    ;;
+	./*)
+	    echo ${pwd}${1#.}
+	    ;;
+	..)
+	    cd ..
+	    echo $PWD
+	    cd $pwd
+	    ;;
+	../*)
+	    cd ..
+	    resolve_file ${1#../}
+	    cd $pwd
+	    ;;
+	*)
+	    echo $pwd/$1
+	    ;;
+    esac
+}
+
+#
+# Determine how to do "echo -e"
+#
+
+find_echo() {
+    local result
+
+    result=$(echo "a\tb")
+    [ ${#result} -eq 3 ] && { echo echo; return; }
+
+    result=$(echo -e "a\tb")
+    [ ${#result} -eq 3 ] && { echo "echo -e"; return; }
+
+    result=$(which echo)
+    [ -n "$result" ] && { echo "$result -e"; return; }
+
+    echo echo
+}
+
+# Determine which version of mktemp is present (if any) and set MKTEMP accortingly:
+#
+#     None - No mktemp
+#     BSD  - BSD mktemp (Mandrake)
+#     STD  - mktemp.org mktemp
+#
+find_mktemp() {
+    local mktemp
+    mktemp=`mywhich mktemp 2> /dev/null`
+
+    if [ -n "$mktemp" ]; then
+	if qt mktemp -V ; then
+	    MKTEMP=STD
+	else
+	    MKTEMP=BSD
+	fi
+    else
+	MKTEMP=None
+    fi
+}
+
+#
+# create a temporary file. If a directory name is passed, the file will be created in
+# that directory. Otherwise, it will be created in a temporary directory.
+#
+mktempfile() {
+
+    [ -z "$MKTEMP" ] && find_mktemp
+
+    if [ $# -gt 0 ]; then
+	case "$MKTEMP" in
+	    BSD)
+		mktemp $1/shorewall.XXXXXX
+		;;
+	    STD)
+		mktemp -p $1 shorewall.XXXXXX
+		;;
+	    None)
+		> $1/shorewall-$$ && echo $1/shorewall-$$
+		;;
+	    *)
+		error_message "ERROR:Internal error in mktempfile"
+		;;
+	esac
+    else
+	case "$MKTEMP" in
+	    BSD)
+		mktemp ${TMPDIR:-/tmp}/shorewall.XXXXXX
+		;;
+	    STD)
+		mktemp -t shorewall.XXXXXX
+		;;
+	    None)
+		rm -f ${TMPDIR:-/tmp}/shorewall-$$
+		> ${TMPDIR:-}/shorewall-$$ && echo ${TMPDIR:-/tmp}/shorewall-$$
+		;;
+	    *)
+		error_message "ERROR:Internal error in mktempfile"
+		;;
+	esac
+    fi
+}

Shorewall-core/manpages/shorewall.xml

@@ -898,11 +898,55 @@
     include <command>shorewall</command> commands in
     <filename>/etc/shorewall/started</filename>.</para>
 
-    <para>The <emphasis>options</emphasis> control the amount of output that
-    the command produces. They consist of a sequence of the letters <emphasis
-    role="bold">v</emphasis> and <emphasis role="bold">q</emphasis>. If the
-    options are omitted, the amount of output is determined by the setting of
-    the VERBOSITY parameter in <ulink
+    <para>Beginning with Shorewall 5.1.0, the <command>shorewall</command>
+    command is also be used to control Shorewall6, Shorewall-lite and
+    Shorewall6-lite.</para>
+
+    <orderedlist>
+      <listitem>
+        <para>When the Shorewall package is installed, then
+        <command>shorewall</command> command defaults to that product.</para>
+      </listitem>
+
+      <listitem>
+        <para>When the Shorewall package is not installed but Shorewall-lite
+        is installed, the <command>shorewall</command> command defaults to
+        Shorewall-lite.</para>
+      </listitem>
+
+      <listitem>
+        <para>When neither the Shorewall nor Shorewall-lite package is
+        installed but Shorewall6-lite is installed, the
+        <command>shorewall</command> command defaults to
+        Shorewall6-lite.</para>
+      </listitem>
+    </orderedlist>
+
+    <para>When the Shorewall6 package is installed, the <option>6</option>
+    option is used to cause <command>shorewall</command> commands to operate
+    on the Shorewall6 configuration. In other words, "<command>shorewall -6
+    ...</command>" is equivalent to the 5.0 command "<command>shorewall6
+    ...</command>".</para>
+
+    <para>Similarly, when Shorewall is not installed but both Shorewall-lite
+    and Shorewall6-lite are installed, the <option>6</option> option causes
+    <command>shorewall</command> commands to operate on the Shorewall6-lite
+    configuration.</para>
+
+    <para>Finally, when both the standard product (Shorewall or Shorewall6)
+    and the corresponding -lite product(s) are installed, the
+    <option>l</option> option causes <command>shorewall</command> commands to
+    operate on the -lite configuration rather than the standard configuration.
+    In other words "<command>shorewall -l ...</command>" is equivalent to the
+    5.0 "<command>shorewall-lite -l ...</command>" command and
+    "<command>shorewall -6l ...</command>" is equivalent to
+    "<command>shorewall6-lite ...</command>".</para>
+
+    <para>The remaining <emphasis>options</emphasis> control the amount of
+    output that the command produces. They consist of a sequence of the
+    letters <emphasis role="bold">v</emphasis> and <emphasis
+    role="bold">q</emphasis>. If the options are omitted, the amount of output
+    is determined by the setting of the VERBOSITY parameter in <ulink
     url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5). Each
     <emphasis role="bold">v</emphasis> adds one to the effective verbosity and
     each <emphasis role="bold">q</emphasis> subtracts one from the effective
@@ -935,7 +979,9 @@
           <para>The <emphasis>interface</emphasis> argument names an interface
           defined in the <ulink
           url="/manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
-          file. A <emphasis>host-list</emphasis> is comma-separated list whose
+          (<ulink
+          url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5))file.
+          A <emphasis>host-list</emphasis> is comma-separated list whose
           elements are host or network addresses.<caution>
               <para>The <command>add</command> command is not very robust. If
               there are errors in the <replaceable>host-list</replaceable>,
@@ -948,12 +994,12 @@
 
           <para>Beginning with Shorewall 4.5.9, the <emphasis
           role="bold">dynamic_shared</emphasis> zone option (<ulink
-          url="/manpages/shorewall-zones.html">shorewall-zones</ulink>(5))
-          allows a single ipset to handle entries for multiple interfaces.
-          When that option is specified for a zone, the <command>add</command>
-          command has the alternative syntax in which the
-          <replaceable>zone</replaceable> name precedes the
-          <replaceable>host-list</replaceable>.</para>
+          url="/manpages/shorewall-zones.html">shorewall-zones</ulink>(5),<ulink
+          url="???">shorewall6-zones</ulink>(5)) allows a single ipset to
+          handle entries for multiple interfaces. When that option is
+          specified for a zone, the <command>add</command> command has the
+          alternative syntax in which the <replaceable>zone</replaceable> name
+          precedes the <replaceable>host-list</replaceable>.</para>
         </listitem>
       </varlistentry>
 
@@ -963,12 +1009,11 @@
 
         <listitem>
           <para>Re-enables receipt of packets from hosts previously
-          blacklisted by a <emphasis role="bold">drop</emphasis>, <emphasis
+          blacklisted by a <emphasis role="bold">blacklist</emphasis>,
+          <emphasis role="bold">drop</emphasis>, <emphasis
           role="bold">logdrop</emphasis>, <emphasis
           role="bold">reject</emphasis>, or <emphasis
-          role="bold">logreject</emphasis> command. Beginning with Shorewall
-          5.0.10, this command can also re-enable addresses blacklisted using
-          the <command>blacklist</command> command.</para>
+          role="bold">logreject</emphasis> command.</para>
         </listitem>
       </varlistentry>
 
@@ -1033,6 +1078,8 @@
         [<replaceable>directory</replaceable>]</term>
 
         <listitem>
+          <para>Not available with Shorewall[6]-lite.</para>
+
           <para>Compiles the configuration in the specified
           <emphasis>directory</emphasis> and discards the compiled output
           script. If no <emphasis>directory</emphasis> is given, then
@@ -1064,7 +1111,9 @@
           contains alternative input specifications following a semicolon
           (";"). Such lines will be handled incorrectly if INLINE_MATCHES is
           set to Yes in <ulink
-          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5).</para>
+          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5)
+          (<ulink
+          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5)).</para>
         </listitem>
       </varlistentry>
 
@@ -1104,6 +1153,11 @@
           <para>When the second form of the command is used, the parameters
           must match those given in the earlier <command>open</command>
           command.</para>
+
+          <para>This command requires that the firewall be in the started
+          state and that DYNAMIC_BLACKLIST=Yes in <ulink
+          url="/manpages/shorewall.conf.html">shorewall.conf
+          (5)</ulink>.</para>
         </listitem>
       </varlistentry>
 
@@ -1114,6 +1168,8 @@
         </replaceable>] [<replaceable> pathname</replaceable> ]</term>
 
         <listitem>
+          <para>Not available with shorewall[6]-lite.</para>
+
           <para>Compiles the current configuration into the executable file
           <emphasis>pathname</emphasis>. If a
           <replaceable>directory</replaceable> is supplied, Shorewall will
@@ -1163,7 +1219,9 @@
           contains alternative input specifications following a semicolon
           (";"). Such lines will be handled incorrectly if INLINE_MATCHES is
           set to Yes in <ulink
-          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5).</para>
+          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5)
+          (<ulink
+          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5)).</para>
         </listitem>
       </varlistentry>
 
@@ -1180,12 +1238,16 @@
           <para>The <emphasis>interface</emphasis> argument names an interface
           defined in the <ulink
           url="/manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
+          (<ulink
+          url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5)
           file. A <emphasis>host-list</emphasis> is comma-separated list whose
           elements are a host or network address.</para>
 
           <para>Beginning with Shorewall 4.5.9, the <emphasis
           role="bold">dynamic_shared</emphasis> zone option (<ulink
-          url="/manpages/shorewall-zones.html">shorewall-zones</ulink>(5))
+          url="/manpages/shorewall-zones.html">shorewall-zones</ulink>(5),
+          <ulink
+          url="/manpages6/shorewall6-zones.html">shorewall6-zones</ulink>(5))
           allows a single ipset to handle entries for multiple interfaces.
           When that option is specified for a zone, the
           <command>delete</command> command has the alternative syntax in
@@ -1211,7 +1273,9 @@
           may be either the logical or physical name of the interface. The
           command removes any routes added from <ulink
           url="/manpages/shorewall-routes.html">shorewall-routes</ulink>(5)
-          and any traffic shaping configuration for the interface.</para>
+          (<ulink
+          url="/manpages/shorewall6-routes.html">shorewall6-routes</ulink>(5))and
+          any traffic shaping configuration for the interface.</para>
         </listitem>
       </varlistentry>
 
@@ -1221,7 +1285,10 @@
 
         <listitem>
           <para>Causes traffic from the listed <emphasis>address</emphasis>es
-          to be silently dropped.</para>
+          to be silently dropped. This command requires that the firewall be
+          in the started state and that DYNAMIC_BLACKLIST=Yes in <ulink
+          url="/manpages/shorewall.conf.html">shorewall.conf
+          (5)</ulink>.</para>
         </listitem>
       </varlistentry>
 
@@ -1267,6 +1334,8 @@
           command sets <filename>/proc</filename> entries for the interface,
           adds any route specified in <ulink
           url="/manpages/shorewall-routes.html">shorewall-routes</ulink>(5)
+          (<ulink
+          url="/manpages/shorewall6-routes.html">shorewall6-routes</ulink>(5))
           and installs the interface's traffic shaping configuration, if
           any.</para>
         </listitem>
@@ -1279,6 +1348,8 @@
         ]</term>
 
         <listitem>
+          <para>Not available with Shorewall[6]-lite.</para>
+
           <para>If <emphasis>directory1</emphasis> is omitted, the current
           working directory is assumed.</para>
 
@@ -1307,7 +1378,9 @@
           <para>Deletes /var/lib/shorewall/<emphasis>filename</emphasis> and
           /var/lib/shorewall/save. If no <emphasis>filename</emphasis> is
           given then the file specified by RESTOREFILE in <ulink
-          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5) is
+          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5)
+          (<ulink
+          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5)) is
           assumed.</para>
         </listitem>
       </varlistentry>
@@ -1327,7 +1400,8 @@
         <listitem>
           <para>Generates several reports from Shorewall log messages in the
           current log file. If the <option>-t</option> option is included, the
-          reports are restricted to log messages generated today.</para>
+          reports are restricted to log messages generated today. Not
+          available with Shorewall6[-lite].</para>
         </listitem>
       </varlistentry>
 
@@ -1337,8 +1411,8 @@
 
         <listitem>
           <para>Ipcalc displays the network address, broadcast address,
-          network in CIDR notation and netmask corresponding to the
-          input[s].</para>
+          network in CIDR notation and netmask corresponding to the input[s].
+          Not available with Shorewall6[-lite].</para>
         </listitem>
       </varlistentry>
 
@@ -1348,7 +1422,8 @@
 
         <listitem>
           <para>Iprange decomposes the specified range of IP addresses into
-          the equivalent list of network/host addresses.</para>
+          the equivalent list of network/host addresses. Not available with
+          Shorewall6[-lite].</para>
         </listitem>
       </varlistentry>
 
@@ -1365,7 +1440,7 @@
           and raw table PREROUTING chains.</para>
 
           <para>The log message destination is determined by the
-          currently-selected IPv4 <ulink
+          currently-selected IPv4 or IPv6 <ulink
           url="/shorewall_logging.html#Backends">logging
           backend</ulink>.</para>
         </listitem>
@@ -1388,8 +1463,13 @@
           <para>Causes traffic from the listed <emphasis>address</emphasis>es
           to be logged then discarded. Logging occurs at the log level
           specified by the BLACKLIST_LOGLEVEL setting in <ulink
-          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>
-          (5).</para>
+          url="/manpages/shorewall.conf.html">shorewall.conf</ulink> (5)
+          (<ulink
+          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5)).
+          This command requires that the firewall be in the started state and
+          that DYNAMIC_BLACKLIST=Yes in <ulink
+          url="/manpages/shorewall.conf.html">shorewall.conf
+          (5)</ulink>.</para>
         </listitem>
       </varlistentry>
 
@@ -1400,6 +1480,8 @@
         <listitem>
           <para>Monitors the log file specified by the LOGFILE option in
           <ulink url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5)
+          (<ulink
+          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5))
           and produces an audible alarm when new Shorewall messages are
           logged. The <emphasis role="bold">-m</emphasis> option causes the
           MAC address of each packet source to be displayed if that
@@ -1420,8 +1502,13 @@
           <para>Causes traffic from the listed <emphasis>address</emphasis>es
           to be logged then rejected. Logging occurs at the log level
           specified by the BLACKLIST_LOGLEVEL setting in <ulink
-          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>
-          (5).</para>
+          url="/manpages/shorewall.conf.html">shorewall.conf</ulink> (5),
+          (<ulink
+          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5)).
+          This command requires that the firewall be in the started state and
+          that DYNAMIC_BLACKLIST=Yes in <ulink
+          url="/manpages/shorewall.conf.html">shorewall.conf
+          (5)</ulink>.</para>
         </listitem>
       </varlistentry>
 
@@ -1508,6 +1595,8 @@
         <replaceable>chain</replaceable>... ]</term>
 
         <listitem>
+          <para>Not available with Shorewall[6]-lite.</para>
+
           <para>All steps performed by <command>restart</command> are
           performed by <command>refresh</command> with the exception that
           <command>refresh</command> only recreates the chains specified in
@@ -1562,7 +1651,10 @@
 
         <listitem>
           <para>Causes traffic from the listed <emphasis>address</emphasis>es
-          to be silently rejected.</para>
+          to be silently rejected. This command requires that the firewall be
+          in the started state and that DYNAMIC_BLACKLIST=Yes in <ulink
+          url="/manpages/shorewall.conf.html">shorewall.conf
+          (5)</ulink>.</para>
         </listitem>
       </varlistentry>
 
@@ -1577,53 +1669,90 @@
           pre-5.0.0 <command>reload</command> command is now called
           <command>remote-restart</command> (see below).</para>
 
+          <variablelist>
+            <varlistentry>
+              <term>Shorewall and Shorewall6</term>
+
+              <listitem>
                 <para>Reload is similar to <emphasis role="bold">shorewall
-          start</emphasis> except that it assumes that the firewall is already
-          started. Existing connections are maintained. If a
-          <emphasis>directory</emphasis> is included in the command, Shorewall
-          will look in that <emphasis>directory</emphasis> first for
-          configuration files.</para>
+                start</emphasis> except that it assumes that the firewall is
+                already started. Existing connections are maintained. If a
+                <emphasis>directory</emphasis> is included in the command,
+                Shorewall will look in that <emphasis>directory</emphasis>
+                first for configuration files.</para>
 
                 <para>The <option>-n</option> option causes Shorewall to avoid
                 updating the routing table(s).</para>
 
-          <para>The <option>-p</option> option causes the connection tracking
-          table to be flushed; the <command>conntrack</command> utility must
-          be installed to use this option.</para>
+                <para>The <option>-p</option> option causes the connection
+                tracking table to be flushed; the <command>conntrack</command>
+                utility must be installed to use this option.</para>
 
-          <para>The <option>-d</option> option causes the compiler to run
-          under the Perl debugger.</para>
+                <para>The <option>-d</option> option causes the compiler to
+                run under the Perl debugger.</para>
 
-          <para>The <option>-f</option> option suppresses the compilation step
-          and simply reused the compiled script which last started/restarted
-          Shorewall, provided that /etc/shorewall and its contents have not
-          been modified since the last start/restart.</para>
+                <para>The <option>-f</option> option suppresses the
+                compilation step and simply reused the compiled script which
+                last started/restarted Shorewall, provided that /etc/shorewall
+                and its contents have not been modified since the last
+                start/restart.</para>
 
-          <para>The <option>-c</option> option was added in Shorewall 4.4.20
-          and performs the compilation step unconditionally, overriding the
-          AUTOMAKE setting in <ulink
-          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5). When
-          both <option>-f</option> and <option>-c</option> are present, the
-          result is determined by the option that appears last.</para>
+                <para>The <option>-c</option> option was added in Shorewall
+                4.4.20 and performs the compilation step unconditionally,
+                overriding the AUTOMAKE setting in <ulink
+                url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5)
+                (Shorewall and Shorewall6 only). When both <option>-f</option>
+                and <option>-c</option> are present, the result is determined
+                by the option that appears last.</para>
 
-          <para>The <option>-T</option> option was added in Shorewall 4.5.3
-          and causes a Perl stack trace to be included with each
+                <para>The <option>-T</option> option was added in Shorewall
+                4.5.3 and causes a Perl stack trace to be included with each
                 compiler-generated error and warning message.</para>
 
-          <para>The <option>-i</option> option was added in Shorewall 4.6.0
-          and causes a warning message to be issued if the current line
-          contains alternative input specifications following a semicolon
-          (";"). Such lines will be handled incorrectly if INLINE_MATCHES is
-          set to Yes in <ulink
-          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5).</para>
+                <para>The <option>-i</option> option was added in Shorewall
+                4.6.0 and causes a warning message to be issued if the current
+                line contains alternative input specifications following a
+                semicolon (";"). Such lines will be handled incorrectly if
+                INLINE_MATCHES is set to Yes in <ulink
+                url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5)
+                (<ulink
+                url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5))..</para>
 
-          <para>The <option>-C</option> option was added in Shorewall 4.6.5
-          and is only meaningful when AUTOMAKE=Yes in <ulink
-          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5). If an
-          existing firewall script is used and if that script was the one that
+                <para>The <option>-C</option> option was added in Shorewall
+                4.6.5 and is only meaningful when AUTOMAKE=Yes in <ulink
+                url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5)
+                (<ulink
+                url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5)).
+                If an existing firewall script is used and if that script was
+                the one that generated the current running configuration, then
+                the running netfilter configuration will be reloaded as is so
+                as to preserve the iptables packet and byte counters.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>Shorewall-lite and Shorewall6-lite</term>
+
+              <listitem>
+                <para>Reload is similar to <emphasis role="bold">shorewall
+                start</emphasis> except that it assumes that the firewall is
+                already started. Existing connections are maintained.</para>
+
+                <para>The <option>-n</option> option causes Shorewall to avoid
+                updating the routing table(s).</para>
+
+                <para>The <option>-p</option> option causes the connection
+                tracking table to be flushed; the <command>conntrack</command>
+                utility must be installed to use this option.</para>
+
+                <para>The <option>-C</option> option was added in Shorewall
+                4.6.5 If the existing firewall script is the one that
                 generated the current running configuration, then the running
-          netfilter configuration will be reloaded as is so as to preserve the
-          iptables packet and byte counters.</para>
+                netfilter configuration will be reloaded as is so as to
+                preserve the iptables packet and byte counters.</para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
         </listitem>
       </varlistentry>
 
@@ -1636,7 +1765,8 @@
 
         <listitem>
           <para>This command was renamed from <command>load</command> in
-          Shorewall 5.0.0.</para>
+          Shorewall 5.0.0 and is only available in Shorewall and
+          Shoreawall6.</para>
 
           <para>If <emphasis>directory</emphasis> is omitted, the current
           working directory is assumed. Allows a non-root user to compile a
@@ -1661,8 +1791,9 @@
           ssh. Beginning with Shorewall 5.0.13, if
           <replaceable>system</replaceable> is omitted, then the FIREWALL
           option setting in <ulink
-          url="shorewall6.conf.html">shorewall6.conf(5)</ulink> is assumed. In
-          that case, if you want to specify a
+          url="shorewall.conf.html">shorewall.conf</ulink>(5) (<ulink
+          url="/manpages6/shorewall6.conf.html">shorewall6.conf(5)</ulink>) is
+          assumed. In that case, if you want to specify a
           <replaceable>directory</replaceable>, then the <option>-D</option>
           option must be given.</para>
 
@@ -1704,7 +1835,8 @@
         <replaceable>system</replaceable> ]</term>
 
         <listitem>
-          <para>This command was added in Shorewall 5.0.0.</para>
+          <para>This command was added in Shorewall 5.0.0 and is only
+          available in Shorewall and Shorewall6.</para>
 
           <para>If <emphasis>directory</emphasis> is omitted, the current
           working directory is assumed. Allows a non-root user to compile a
@@ -1729,8 +1861,9 @@
           Beginning with Shorewall 5.0.13, if
           <replaceable>system</replaceable> is omitted, then the FIREWALL
           option setting in <ulink
-          url="shorewall6.conf.html">shorewall6.conf(5)</ulink> is assumed. In
-          that case, if you want to specify a
+          url="shorewall6.conf.html">shorewall6.conf(5)</ulink> (<ulink
+          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5)) is
+          assumed. In that case, if you want to specify a
           <replaceable>directory</replaceable>, then the <option>-D</option>
           option must be given.</para>
 
@@ -1759,7 +1892,9 @@
           contains alternative input specifications following a semicolon
           (";"). Such lines will be handled incorrectly if INLINE_MATCHES is
           set to Yes in <ulink
-          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5).</para>
+          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5)
+          (<ulink
+          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5)).</para>
         </listitem>
       </varlistentry>
 
@@ -1773,7 +1908,8 @@
 
         <listitem>
           <para>This command was renamed from <command>reload</command> in
-          Shorewall 5.0.0.</para>
+          Shorewall 5.0.0 and is available in Shorewall and Shorewall6
+          only.</para>
 
           <para>If <emphasis>directory</emphasis> is omitted, the current
           working directory is assumed. Allows a non-root user to compile a
@@ -1798,8 +1934,9 @@
           Beginning with Shorewall 5.0.13, if
           <replaceable>system</replaceable> is omitted, then the FIREWALL
           option setting in <ulink
-          url="shorewall6.conf.html">shorewall6.conf(5)</ulink> is assumed. In
-          that case, if you want to specify a
+          url="shorewall6.conf.html">shorewall6.conf(5)</ulink> (<ulink
+          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5)) is
+          assumed. In that case, if you want to specify a
           <replaceable>directory</replaceable>, then the <option>-D</option>
           option must be given.</para>
 
@@ -1828,7 +1965,9 @@
           contains alternative input specifications following a semicolon
           (";"). Such lines will be handled incorrectly if INLINE_MATCHES is
           set to Yes in <ulink
-          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5).</para>
+          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5)
+          (<ulink
+          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
         </listitem>
       </varlistentry>
 
@@ -1863,50 +2002,80 @@
           <command>stop</command> command had been issued then it is started
           again.</para>
 
+          <variablelist>
+            <varlistentry>
+              <term>Shorewall and Shorewall6</term>
+
+              <listitem>
                 <para>If a <emphasis>directory</emphasis> is included in the
-          command, Shorewall will look in that <emphasis>directory</emphasis>
-          first for configuration files.</para>
+                command, Shorewall will look in that
+                <emphasis>directory</emphasis> first for configuration
+                files.</para>
 
                 <para>The <option>-n</option> option causes Shorewall to avoid
                 updating the routing table(s).</para>
 
-          <para>The <option>-p</option> option causes the connection tracking
-          table to be flushed; the <command>conntrack</command> utility must
-          be installed to use this option.</para>
+                <para>The <option>-p</option> option causes the connection
+                tracking table to be flushed; the <command>conntrack</command>
+                utility must be installed to use this option.</para>
 
-          <para>The <option>-d</option> option causes the compiler to run
-          under the Perl debugger.</para>
+                <para>The <option>-d</option> option causes the compiler to
+                run under the Perl debugger.</para>
 
-          <para>The <option>-f</option> option suppresses the compilation step
-          and simply reused the compiled script which last started/restarted
-          Shorewall, provided that /etc/shorewall and its contents have not
-          been modified since the last start/restart.</para>
+                <para>The <option>-f</option> option suppresses the
+                compilation step and simply reused the compiled script which
+                last started/restarted Shorewall, provided that /etc/shorewall
+                and its contents have not been modified since the last
+                start/restart.</para>
 
-          <para>The <option>-c</option> option was added in Shorewall 4.4.20
-          and performs the compilation step unconditionally, overriding the
-          AUTOMAKE setting in <ulink
-          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5). When
-          both <option>-f</option> and <option>-c</option> are present, the
-          result is determined by the option that appears last.</para>
+                <para>The <option>-c</option> option was added in Shorewall
+                4.4.20 and performs the compilation step unconditionally,
+                overriding the AUTOMAKE setting in <ulink
+                url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5).
+                When both <option>-f</option> and <option>-c</option> are
+                present, the result is determined by the option that appears
+                last.</para>
 
-          <para>The <option>-T</option> option was added in Shorewall 4.5.3
-          and causes a Perl stack trace to be included with each
+                <para>The <option>-T</option> option was added in Shorewall
+                4.5.3 and causes a Perl stack trace to be included with each
                 compiler-generated error and warning message.</para>
 
-          <para>The <option>-i</option> option was added in Shorewall 4.6.0
-          and causes a warning message to be issued if the current line
-          contains alternative input specifications following a semicolon
-          (";"). Such lines will be handled incorrectly if INLINE_MATCHES is
-          set to Yes in <ulink
+                <para>The <option>-i</option> option was added in Shorewall
+                4.6.0 and causes a warning message to be issued if the current
+                line contains alternative input specifications following a
+                semicolon (";"). Such lines will be handled incorrectly if
+                INLINE_MATCHES is set to Yes in <ulink
                 url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5).</para>
 
-          <para>The <option>-C</option> option was added in Shorewall 4.6.5
-          and is only meaningful when AUTOMAKE=Yes in <ulink
-          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5). If an
-          existing firewall script is used and if that script was the one that
+                <para>The <option>-C</option> option was added in Shorewall
+                4.6.5 and is only meaningful when AUTOMAKE=Yes in <ulink
+                url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5).
+                If an existing firewall script is used and if that script was
+                the one that generated the current running configuration, then
+                the running netfilter configuration will be reloaded as is so
+                as to preserve the iptables packet and byte counters.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>Shorewall-lite and Shorewall6-lite</term>
+
+              <listitem>
+                <para>The <option>-n</option> option causes Shorewall to avoid
+                updating the routing table(s).</para>
+
+                <para>The <option>-p</option> option causes the connection
+                tracking table to be flushed; the <command>conntrack</command>
+                utility must be installed to use this option.</para>
+
+                <para>The <option>-C</option> option was added in Shorewall
+                4.6.5 If the existing firewall script is the one that
                 generated the current running configuration, then the running
-          netfilter configuration will be reloaded as is so as to preserve the
-          iptables packet and byte counters.</para>
+                netfilter configuration will be reloaded as is so as to
+                preserve the iptables packet and byte counters.</para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
         </listitem>
       </varlistentry>
 
@@ -1923,7 +2092,9 @@
           role="bold">shorewall save</emphasis>; if no
           <emphasis>filename</emphasis> is given then Shorewall will be
           restored from the file specified by the RESTOREFILE option in <ulink
-          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5).</para>
+          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5)
+          (<ulink
+          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5)).</para>
 
           <caution>
             <para>If your iptables ruleset depends on variables that are
@@ -1984,8 +2155,8 @@
 
         <listitem>
           <para>Added in Shorewall 5.0.0, this command performs the same
-          function as did <command>safe_restart</command> in earlier
-          releases.</para>
+          function as did <command>safe_restart</command> in earlier releases.
+          The command is available in Shorewall and Shorewall6 only.</para>
 
           <para>Only allowed if Shorewall is running. The current
           configuration is saved in /var/lib/shorewall/safe-reload (see the
@@ -2015,16 +2186,17 @@
         <replaceable>directory</replaceable> ]</term>
 
         <listitem>
-          <para>Only allowed if Shorewall is running. The current
-          configuration is saved in /var/lib/shorewall/safe-restart (see the
-          save command below) then a <emphasis role="bold">shorewall
-          restart</emphasis> is done. You will then be prompted asking if you
-          want to accept the new configuration or not. If you answer "n" or if
-          you fail to answer within 60 seconds (such as when your new
-          configuration has disabled communication with your terminal), the
-          configuration is restored from the saved configuration. If a
-          directory is given, then Shorewall will look in that directory first
-          when opening configuration files.</para>
+          <para>Only allowed if Shorewall[6] is running and is not available
+          in Shorewall-lite and Shorewall6-lite. The current configuration is
+          saved in /var/lib/shorewall/safe-restart (see the save command
+          below) then a <emphasis role="bold">shorewall restart</emphasis> is
+          done. You will then be prompted asking if you want to accept the new
+          configuration or not. If you answer "n" or if you fail to answer
+          within 60 seconds (such as when your new configuration has disabled
+          communication with your terminal), the configuration is restored
+          from the saved configuration. If a directory is given, then
+          Shorewall will look in that directory first when opening
+          configuration files.</para>
 
           <para>Beginning with Shorewall 4.5.0, you may specify a different
           <replaceable>timeout</replaceable> value using the
@@ -2058,6 +2230,9 @@
           <option>s</option>, <option>m</option> or <option>h</option> suffix
           (e.g., 5m) to specify seconds, minutes or hours respectively. If the
           suffix is omitted, seconds is assumed.</para>
+
+          <para>This command is available in Shorewall and Shorewall6
+          only.</para>
         </listitem>
       </varlistentry>
 
@@ -2073,7 +2248,9 @@
           role="bold">shorewall -f start</emphasis> commands. If
           <emphasis>filename</emphasis> is not given then the state is saved
           in the file specified by the RESTOREFILE option in <ulink
-          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5).</para>
+          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5)
+          (<ulink
+          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5)).</para>
 
           <para>The <option>-C</option> option, added in Shorewall 4.6.5,
           causes the iptables packet and byte counters to be saved along with
@@ -2088,7 +2265,9 @@
           <para>Added in shorewall 4.6.8. Performs the same action as the
           <command>stop</command> command with respect to saving ipsets (see
           the SAVE_IPSETS option in <ulink
-          url="/manpages/shorewall.conf.html">shorewall.conf</ulink> (5)).
+          url="/manpages/shorewall.conf.html">shorewall.conf</ulink> (5)
+          (<ulink
+          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5)).
           This command may be used to proactively save your ipset contents in
           the event that a system failure occurs prior to issuing a
           <command>stop</command> command.</para>
@@ -2244,7 +2423,8 @@
                 <para>Added in Shorewall 4.4.17. Displays the per-IP
                 accounting counters (<ulink
                 url="/manpages/shorewall-accounting.html">shorewall-accounting</ulink>
-                (5)).</para>
+                (5), <ulink
+                url="/manpages6/shorewall6-accounting.html">shorewall6-accounting</ulink>(5)).</para>
               </listitem>
             </varlistentry>
 
@@ -2255,7 +2435,9 @@
               <listitem>
                 <para>Displays the last 20 Shorewall messages from the log
                 file specified by the LOGFILE option in <ulink
-                url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5).
+                url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5)
+                (<ulink
+                url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5)).
                 The <emphasis role="bold">-m</emphasis> option causes the MAC
                 address of each packet source to be displayed if that
                 information is available.</para>
@@ -2267,7 +2449,7 @@
 
               <listitem>
                 <para>Displays information about each macro defined on the
-                firewall system.</para>
+                firewall system (Shorewall and Shorewall6 only)</para>
               </listitem>
             </varlistentry>
 
@@ -2279,7 +2461,8 @@
                 <para>Added in Shorewall 4.4.6. Displays the file that
                 implements the specified <replaceable>macro</replaceable>
                 (usually
-                <filename>/usr/share/shorewall/macro</filename>.<replaceable>macro</replaceable>).</para>
+                <filename>/usr/share/shorewall/macro</filename>.<replaceable>macro</replaceable>).
+                Available only in Shorewall and Shorewall6.</para>
               </listitem>
             </varlistentry>
 
@@ -2397,59 +2580,114 @@
         <replaceable>directory</replaceable> ]</term>
 
         <listitem>
-          <para>Start shorewall. Existing connections through shorewall
-          managed interfaces are untouched. New connections will be allowed
-          only if they are allowed by the firewall rules or policies. If a
-          <replaceable>directory</replaceable> is included in the command,
-          Shorewall will look in that <emphasis>directory</emphasis> first for
-          configuration files. If <emphasis role="bold">-f</emphasis> is
-          specified, the saved configuration specified by the RESTOREFILE
-          option in <ulink
-          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5) will
-          be restored if that saved configuration exists and has been modified
-          more recently than the files in /etc/shorewall. When <emphasis
-          role="bold">-f</emphasis> is given, a
-          <replaceable>directory</replaceable> may not be specified.</para>
+          <para><variablelist>
+              <varlistentry>
+                <term>Shorewall and Shorewall6</term>
 
-          <para>Update: In Shorewall 4.4.20, a new LEGACY_FASTSTART option was
-          added to <ulink
-          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5). When
-          LEGACY_FASTSTART=No, the modification times of files in
-          /etc/shorewall are compared with that of /var/lib/shorewall/firewall
-          (the compiled script that last started/restarted the
-          firewall).</para>
+                <listitem>
+                  <para>Start shorewall[6]. Existing connections through
+                  shorewall managed interfaces are untouched. New connections
+                  will be allowed only if they are allowed by the firewall
+                  rules or policies. If a <replaceable>directory</replaceable>
+                  is included in the command, Shorewall will look in that
+                  <emphasis>directory</emphasis> first for configuration
+                  files. If <emphasis role="bold">-f</emphasis> is specified,
+                  the saved configuration specified by the RESTOREFILE option
+                  in <ulink
+                  url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5)
+                  (<ulink
+                  url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5))
+                  will be restored if that saved configuration exists and has
+                  been modified more recently than the files in
+                  /etc/shorewall. When <emphasis role="bold">-f</emphasis> is
+                  given, a <replaceable>directory</replaceable> may not be
+                  specified.</para>
 
-          <para>The <option>-n</option> option causes Shorewall to avoid
-          updating the routing table(s).</para>
+                  <para>Update: In Shorewall 4.4.20, a new LEGACY_FASTSTART
+                  option was added to <ulink
+                  url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5)
+                  (<ulink
+                  url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5)).
+                  When LEGACY_FASTSTART=No, the modification times of files in
+                  /etc/shorewall are compared with that of
+                  /var/lib/shorewall/firewall (the compiled script that last
+                  started/restarted the firewall).</para>
 
-          <para>The <option>-p</option> option causes the connection tracking
-          table to be flushed; the <command>conntrack</command> utility must
-          be installed to use this option.</para>
+                  <para>The <option>-n</option> option causes Shorewall to
+                  avoid updating the routing table(s).</para>
 
-          <para>The <option>-c</option> option was added in Shorewall 4.4.20
-          and performs the compilation step unconditionally, overriding the
-          AUTOMAKE setting in <ulink
-          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5). When
-          both <option>-f</option> and <option>-c</option>are present, the
-          result is determined by the option that appears last.</para>
+                  <para>The <option>-p</option> option causes the connection
+                  tracking table to be flushed; the
+                  <command>conntrack</command> utility must be installed to
+                  use this option.</para>
 
-          <para>The <option>-T</option> option was added in Shorewall 4.5.3
-          and causes a Perl stack trace to be included with each
+                  <para>The <option>-c</option> option was added in Shorewall
+                  4.4.20 and performs the compilation step unconditionally,
+                  overriding the AUTOMAKE setting in <ulink
+                  url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5)
+                  (<ulink
+                  url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5)).
+                  When both <option>-f</option> and <option>-c</option>are
+                  present, the result is determined by the option that appears
+                  last.</para>
+
+                  <para>The <option>-T</option> option was added in Shorewall
+                  4.5.3 and causes a Perl stack trace to be included with each
                   compiler-generated error and warning message.</para>
 
-          <para>The -i option was added in Shorewall 4.6.0 and causes a
-          warning message to be issued if the current line contains
-          alternative input specifications following a semicolon (";"). Such
-          lines will be handled incorrectly if INLINE_MATCHES is set to Yes in
-          <ulink
-          url="/manpages/shorewall.conf.html">shorewall.conf(5)</ulink>.</para>
+                  <para>The -i option was added in Shorewall 4.6.0 and causes
+                  a warning message to be issued if the current line contains
+                  alternative input specifications following a semicolon
+                  (";"). Such lines will be handled incorrectly if
+                  INLINE_MATCHES is set to Yes in <ulink
+                  url="/manpages/shorewall.conf.html">shorewall.conf(5)</ulink>
+                  (<ulink
+                  url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5)).</para>
 
-          <para>The <option>-C</option> option was added in Shorewall 4.6.5
-          and is only meaningful when the <option>-f</option> option is also
-          specified. If the previously-saved configuration is restored, and if
-          the <option>-C</option> option was also specified in the <emphasis
-          role="bold">save</emphasis> command, then the packet and byte
-          counters will be restored.</para>
+                  <para>The <option>-C</option> option was added in Shorewall
+                  4.6.5 and is only meaningful when the <option>-f</option>
+                  option is also specified. If the previously-saved
+                  configuration is restored, and if the <option>-C</option>
+                  option was also specified in the <emphasis
+                  role="bold">save</emphasis> command, then the packet and
+                  byte counters will be restored.</para>
+                </listitem>
+              </varlistentry>
+
+              <varlistentry>
+                <term>Shorewall-lite and Shorewall6-lite</term>
+
+                <listitem>
+                  <para>Start Shorewall[6] Lite. Existing connections through
+                  shorewall[6]-lite managed interfaces are untouched. New
+                  connections will be allowed only if they are allowed by the
+                  firewall rules or policies.</para>
+
+                  <para>The <option>-p</option> option causes the connection
+                  tracking table to be flushed; the
+                  <command>conntrack</command> utility must be installed to
+                  use this option.</para>
+
+                  <para>The <option>-n</option> option prevents the firewall
+                  script from modifying the current routing
+                  configuration.</para>
+
+                  <para>The <option>-f</option> option was added in Shorewall
+                  4.6.5. If the RESTOREFILE named in <ulink
+                  url="shorewall.conf.html">shorewall.conf</ulink>(5) exists,
+                  is executable and is not older than the current filewall
+                  script, then that saved configuration is restored.</para>
+
+                  <para>The <option>-C</option> option was added in Shorewall
+                  4.6.5 and is only meaningful when the <option>-f</option>
+                  option is also specified. If the previously-saved
+                  configuration is restored, and if the <option>-C</option>
+                  option was also specified in the <emphasis
+                  role="bold">save</emphasis> command, then the packet and
+                  byte counters will be restored.</para>
+                </listitem>
+              </varlistentry>
+            </variablelist></para>
         </listitem>
       </varlistentry>
 
@@ -2496,18 +2734,21 @@
         <replaceable>timeout</replaceable> ]</term>
 
         <listitem>
-          <para>If Shorewall is started then the firewall state is saved to a
-          temporary saved configuration
-          (<filename>/var/lib/shorewall/.try</filename>). Next, if Shorewall
-          is currently started then a <emphasis role="bold">restart</emphasis>
-          command is issued using the specified configuration
-          <replaceable>directory</replaceable>; otherwise, a <emphasis
-          role="bold">start</emphasis> command is performed using the
-          specified configuration <replaceable>directory</replaceable>. if an
-          error occurs during the compilation phase of the <emphasis
+          <para>This command is available in Shorewall and Shorewall6
+          only.</para>
+
+          <para>If Shorewall[6] is started then the firewall state is saved to
+          a temporary saved configuration
+          (<filename>/var/lib/shorewall/.try</filename>). Next, if
+          Shorewall[6] is currently started then a <emphasis
+          role="bold">restart</emphasis> command is issued using the specified
+          configuration <replaceable>directory</replaceable>; otherwise, a
+          <emphasis role="bold">start</emphasis> command is performed using
+          the specified configuration <replaceable>directory</replaceable>. if
+          an error occurs during the compilation phase of the <emphasis
           role="bold">restart</emphasis> or <emphasis
           role="bold">start</emphasis>, the command terminates without
-          changing the Shorewall state. If an error occurs during the
+          changing the Shorewall[6] state. If an error occurs during the
           <emphasis role="bold">restart</emphasis> phase, then a <emphasis
           role="bold">shorewall restore</emphasis> is performed using the
           saved configuration. If an error occurs during the <emphasis
@@ -2534,6 +2775,9 @@
         <replaceable>directory</replaceable> ]</term>
 
         <listitem>
+          <para>This command is available only in Shorewall and
+          Shorewall6.</para>
+
           <para>Added in Shorewall 4.4.21 and causes the compiler to update
           <filename>/etc/shorewall/shorewall.conf then validate the
           configuration</filename>. The update will add options not present in
@@ -2602,8 +2846,10 @@
               </listitem>
 
               <listitem>
-                <para>INCLUDEd files will be expanded inline in the output
-                file.</para>
+                <para>With the exception of the
+                <filename>notrack</filename>-&gt;<filename>conntrack</filename>
+                conversion, INCLUDEd files will be expanded inline in the
+                output file.</para>
               </listitem>
 
               <listitem>
@@ -2611,6 +2857,26 @@
                 tab character; there is no attempt made to otherwise align the
                 columns.</para>
               </listitem>
+
+              <listitem>
+                <para>Prior to Shorewall 5.0.15, shell variables will be
+                expanded in the output file.</para>
+              </listitem>
+
+              <listitem>
+                <para>Prior to Shorewall 5.0.15, lines omitted by compiler
+                directives (?if ...., etc.) will not appear in the output
+                file.</para>
+
+                <important>
+                  <para>Because the translation of the 'blacklist' and
+                  'routestopped' files is not 1:1, omitted lines and compiler
+                  directives are not transferred to the converted files. If
+                  either are present, the compiler issues a warning:</para>
+
+                  <programlisting> WARNING: "Omitted rules and compiler directives were not translated</programlisting>
+                </important>
+              </listitem>
             </orderedlist>
           </important>
 

Shorewall-core/shorewall

@@ -32,11 +32,8 @@ PRODUCT=shorewall
 #
 . /usr/share/shorewall/shorewallrc
 
-g_program=$PRODUCT
-g_sharedir="$SHAREDIR"/shorewall
-g_confdir="$CONFDIR"/shorewall
-g_readrc=1
+g_basedir=${SHAREDIR}/shorewall
 
-. $g_sharedir/lib.cli
+. ${g_basedir}/lib.cli
 
 shorewall_cli $@

Shorewall-init/ifupdown.debian.sh

@@ -31,8 +31,10 @@ setstatedir() {
     [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT}
 
     if [ ! -x $STATEDIR/firewall ]; then
-	if [ $PRODUCT = shorewall -o $PRODUCT = shorewall6 ]; then
-	    ${SBINDIR}/$PRODUCT compile
+	if [ $PRODUCT = shorewall ]; then
+	    ${SBINDIR}/shorewall compile
+	elif [ $PRODUCT = shorewall6 ]; then
+	    ${SBINDIR}/shorewall -6 compile
 	fi
     fi
 }

Shorewall-init/ifupdown.fedora.sh

@@ -33,9 +33,11 @@ setstatedir() {
 
     [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT}
 
-    if [ ! -x "$STATEDIR/firewall" ]; then
-	if [ $PRODUCT == shorewall -o $PRODUCT == shorewall6 ]; then
-	    ${SBINDIR}/$PRODUCT $OPTIONS compile
+    if [ ! -x $STATEDIR/firewall ]; then
+	if [ $PRODUCT = shorewall ]; then
+	    ${SBINDIR}/shorewall compile
+	elif [ $PRODUCT = shorewall6 ]; then
+	    ${SBINDIR}/shorewall -6 compile
 	fi
     fi
 }

Shorewall-init/ifupdown.suse.sh

@@ -31,8 +31,10 @@ setstatedir() {
     [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT}
 
     if [ ! -x $STATEDIR/firewall ]; then
-	if [ $PRODUCT = shorewall -o $PRODUCT = shorewall6 ]; then
-	    ${SBINDIR}/$PRODUCT compile
+	if [ $PRODUCT = shorewall ]; then
+	    ${SBINDIR}/shorewall compile
+	elif [ $PRODUCT = shorewall6 ]; then
+	    ${SBINDIR}/shorewall -6 compile
 	fi
     fi
 }

Shorewall-init/init.debian.sh

@@ -73,8 +73,10 @@ setstatedir() {
 
     [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT}
 
-    if [ $PRODUCT = shorewall -o $PRODUCT = shorewall6 ]; then
-	${SBINDIR}/$PRODUCT ${OPTIONS} compile -c
+    if [ $PRODUCT = shorewall ]; then
+	${SBINDIR}/shorewall compile
+    elif [ $PRODUCT = shorewall6 ]; then
+	${SBINDIR}/shorewall -6 compile
     else
 	return 0
     fi

Shorewall-init/init.fedora.sh

@@ -44,8 +44,10 @@ setstatedir() {
 
     [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT}
 
-    if [ $PRODUCT == shorewall -o $PRODUCT == shorewall6 ]; then
-	${SBINDIR}/$PRODUCT $OPTIONS compile -c
+    if [ $PRODUCT = shorewall ]; then
+	${SBINDIR}/shorewall compile
+    elif [ $PRODUCT = shorewall6 ]; then
+	${SBINDIR}/shorewall -6 compile
     else
 	return 0
     fi

Shorewall-init/init.openwrt.sh

@@ -75,8 +75,10 @@ setstatedir() {
 
     [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT}
 
-    if [ $PRODUCT = shorewall -o $PRODUCT = shorewall6 ]; then
-	${SBINDIR}/$PRODUCT ${OPTIONS} compile $STATEDIR/firewall
+    if [ $PRODUCT = shorewall ]; then
+	${SBINDIR}/shorewall compile
+    elif [ $PRODUCT = shorewall6 ]; then
+	${SBINDIR}/shorewall -6 compile
     else
 	return 0
     fi

Shorewall-init/init.suse.sh

@@ -79,8 +79,10 @@ setstatedir() {
 
     [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT}
 
-    if [ $PRODUCT = shorewall -o $PRODUCT = shorewall6 ]; then
-	${SBINDIR}/$PRODUCT ${OPTIONS} compile -c
+    if [ $PRODUCT = shorewall ]; then
+	${SBINDIR}/shorewall compile
+    elif [ $PRODUCT = shorewall6 ]; then
+	${SBINDIR}/shorewall -6 compile
     else
 	return 0
     fi

Shorewall-init/shorewall-init

@@ -33,8 +33,10 @@ setstatedir() {
 
     [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT}
 
-    if [ $PRODUCT = shorewall -o $PRODUCT = shorewall6 ]; then
-	${SBINDIR}/$PRODUCT ${OPTIONS} compile -c
+    if [ $PRODUCT = shorewall ]; then
+	${SBINDIR}/shorewall compile
+    elif [ $PRODUCT = shorewall6 ]; then
+	${SBINDIR}/shorewall -6 compile
     else
 	return 0
     fi

Shorewall-lite/init.debian.sh

@@ -13,7 +13,7 @@
 
 . /lib/lsb/init-functions
 
-SRWL=/sbin/shorewall-lite
+SRWL='/sbin/shorewall -l'
 SRWL_OPTS="-tvv"
 test -n ${INITLOG:=/var/log/shorewall-lite-init.log}
 

Shorewall-lite/init.fedora.sh

@@ -25,7 +25,7 @@
 #
 . /usr/share/shorewall/shorewallrc
 
-prog="shorewall-lite"
+prog="shorewall -l"
 shorewall="${SBINDIR}/$prog"
 logger="logger -i -t $prog"
 lockfile="/var/lock/subsys/$prog"

Shorewall-lite/init.openwrt.sh

@@ -69,7 +69,7 @@ SHOREWALL_INIT_SCRIPT=1
 command="$action"
 
 start() {
-	exec ${SBINDIR}/shorewall-lite $OPTIONS $command $STARTOPTIONS
+	exec ${SBINDIR}/shorewall -l $OPTIONS $command $STARTOPTIONS
 }
 
 boot() {
@@ -78,17 +78,17 @@ boot() {
 }
 
 restart() {
-	exec ${SBINDIR}/shorewall-lite $OPTIONS $command $RESTARTOPTIONS
+	exec ${SBINDIR}/shorewall -l $OPTIONS $command $RESTARTOPTIONS
 }
 
 reload() {
-	exec ${SBINDIR}/shorewall-lite $OPTIONS $command $RELOADOPTION
+	exec ${SBINDIR}/shorewall -l $OPTIONS $command $RELOADOPTION
 }
 
 stop() {
-	exec ${SBINDIR}/shorewall-lite $OPTIONS $command $STOPOPTIONS
+	exec ${SBINDIR}/shorewall -l $OPTIONS $command $STOPOPTIONS
 }
 
 status() {
-	exec ${SBINDIR}/shorewall-lite $OPTIONS $command $@
+	exec ${SBINDIR}/shorewall -l $OPTIONS $command $@
 }

Shorewall-lite/install.sh

@@ -114,7 +114,7 @@ require()
 #
 cd "$(dirname $0)"
 
-if [ -f shorewall-lite ]; then
+if [ -f shorewall-lite.service ]; then
     PRODUCT=shorewall-lite
     Product="Shorewall Lite"
 else
@@ -331,7 +331,6 @@ if [ -n "$DESTDIR" ]; then
 	OWNERSHIP=""
     fi
 
-    make_directory ${DESTDIR}${SBINDIR} 755
     make_directory ${DESTDIR}${INITDIR} 755
 
 else
@@ -362,9 +361,9 @@ else
 fi
 
 #
-# Check for ${SBINDIR}/$PRODUCT
+# Check for ${SHAREDIR}/$PRODUCT/version
 #
-if [ -f ${DESTDIR}${SBINDIR}/$PRODUCT ]; then
+if [ -f ${DESTDIR}${SHAREDIR}/$PRODUCT/version ]; then
     first_install=""
 else
     first_install="Yes"
@@ -372,11 +371,8 @@ fi
 
 delete_file ${DESTDIR}/usr/share/$PRODUCT/xmodules
 
-install_file $PRODUCT ${DESTDIR}${SBINDIR}/$PRODUCT 0544
 [ -n "${INITFILE}" ] && make_directory ${DESTDIR}${INITDIR} 755
 
-echo "$Product control program installed in ${DESTDIR}${SBINDIR}/$PRODUCT"
-
 #
 # Create ${CONFDIR}/$PRODUCT, /usr/share/$PRODUCT and /var/lib/$PRODUCT if needed
 #
@@ -498,7 +494,7 @@ done
 if [ -d manpages -a -n "$MANDIR" ]; then
     cd manpages
 
-    mkdir -p ${DESTDIR}${MANDIR}/man5/ ${DESTDIR}${MANDIR}/man8/
+    mkdir -p ${DESTDIR}${MANDIR}/man5/
 
     for f in *.5; do
 	gzip -c $f > $f.gz
@@ -506,12 +502,6 @@ if [ -d manpages -a -n "$MANDIR" ]; then
 	echo "Man page $f.gz installed to ${DESTDIR}${MANDIR}/man5/$f.gz"
     done
 
-    for f in *.8; do
-	gzip -c $f > $f.gz
-	install_file $f.gz ${DESTDIR}${MANDIR}/man8/$f.gz 644
-	echo "Man page $f.gz installed to ${DESTDIR}${MANDIR}/man8/$f.gz"
-    done
-
     cd ..
 
     echo "Man Pages Installed"
@@ -539,6 +529,7 @@ fi
 delete_file ${DESTDIR}${SHAREDIR}/$PRODUCT/lib.common
 delete_file ${DESTDIR}${SHAREDIR}/$PRODUCT/lib.cli
 delete_file ${DESTDIR}${SHAREDIR}/$PRODUCT/wait4ifup
+delete_file ${DESTDIR}${SBINDIR}/$PRODUCT
 
 #
 # Note -- not all packages will have the SYSCONFFILE so we need to check for its existance here
@@ -555,7 +546,6 @@ fi
 
 if [ ${SHAREDIR} != /usr/share ]; then
     eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/${PRODUCT}/lib.base
-    eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SBINDIR}/$PRODUCT
 fi
 
 if [ $configure -eq 1 -a -z "$DESTDIR" -a -n "$first_install" -a -z "${cygwin}${mac}" ]; then

Shorewall-lite/shorecap

@@ -45,19 +45,20 @@
 #    require Shorewall to be installed.
 
 
-g_program=shorewall-lite
+PRODUCT=shorewall-lite
 
 #
 # This is modified by the installer when ${SHAREDIR} != /usr/share
 #
 . /usr/share/shorewall/shorewallrc
 
-g_sharedir="$SHAREDIR"/shorewall-lite
-g_confdir="$CONFDIR"/shorewall-lite
-g_readrc=1
+g_basedir=${SHAREDIR}/shorewall
 
 . ${SHAREDIR}/shorewall/lib.cli
-. /usr/share/shorewall-lite/configpath
+
+setup_product_environment
+
+. ${SHAREDIR}/shorewall-lite/configpath
 
 [ -n "$PATH" ] || PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
 

Shorewall-lite/shorewall-lite

@@ -1,42 +0,0 @@
-#!/bin/sh
-#
-#     Shorewall Lite Packet Filtering Firewall Control Program - V4.5
-#
-#     (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2014 -
-#         Tom Eastep (teastep@shorewall.net)
-#
-#	Shorewall documentation is available at http://www.shorewall.net
-#
-#       This program is part of Shorewall.
-#
-#	This program is free software; you can redistribute it and/or modify
-#	it under the terms of the GNU General Public License as published by the
-#       Free Software Foundation, either version 2 of the license or, at your
-#       option, any later version.
-#
-#	This program is distributed in the hope that it will be useful,
-#	but WITHOUT ANY WARRANTY; without even the implied warranty of
-#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-#	GNU General Public License for more details.
-#
-#	You should have received a copy of the GNU General Public License
-#	along with this program; if not, see <http://www.gnu.org/licenses/>.
-#
-#       For a list of supported commands, type 'shorewall help' or 'shorewall6 help'
-#
-################################################################################################
-PRODUCT=shorewall-lite
-
-#
-# This is modified by the installer when ${SHAREDIR} != /usr/share
-#
-. /usr/share/shorewall/shorewallrc
-
-g_program=$PRODUCT
-g_sharedir="$SHAREDIR"/shorewall-lite
-g_confdir="$CONFDIR"/shorewall-lite
-g_readrc=1
-
-. ${SHAREDIR}/shorewall/lib.cli
-
-shorewall_cli $@

Shorewall/Perl/Shorewall/Chains.pm

@@ -266,10 +266,12 @@ our %EXPORT_TAGS = (
 				       set_chain_variables
 				       mark_firewall_not_started
 				       mark_firewall6_not_started
+				       interface_address
 				       get_interface_address
 				       get_interface_addresses
 				       get_interface_bcasts
 				       get_interface_acasts
+				       interface_gateway
 				       get_interface_gateway
 				       get_interface_mac
 				       have_global_variables
@@ -808,7 +810,6 @@ sub initialize( $$$ ) {
 		     DNAT         => 1,
 		     MASQUERADE   => 1,
 		     NETMAP       => 1,
-		     NFQUEUE      => 1,
 		     NOTRACK      => 1,
 		     RAWDNAT      => 1,
 		     REDIRECT     => 1,
@@ -1216,6 +1217,7 @@ sub merge_rules( $$$ ) {
 	if ( exists $fromref->{$option} ) {
 	    push( @{$toref->{matches}}, $option ) unless exists $toref->{$option};
 	    $toref->{$option} = $fromref->{$option};
+	    $toref->{simple} = 0;
 	}
     }
 
@@ -2717,24 +2719,6 @@ sub ensure_accounting_chain( $$$ )
 	$chainref->{restricted}  = NO_RESTRICT;
 	$chainref->{ipsec}       = $ipsec;
 	$chainref->{optflags}   |= ( DONT_OPTIMIZE | DONT_MOVE | DONT_DELETE ) unless $config{OPTIMIZE_ACCOUNTING};
-
-	if ( $config{CHAIN_SCRIPTS} ) {
-	    unless ( $chain eq 'accounting' ) {
-		my $file = find_file $chain;
-
-		if ( -f $file ) {
-		    progress_message "Running $file...";
-
-		    my ( $level, $tag ) = ( '', '' );
-
-		    unless ( my $return = eval `cat $file` ) {
-			fatal_error "Couldn't parse $file: $@" if $@;
-			fatal_error "Couldn't do $file: $!"    unless defined $return;
-			fatal_error "Couldn't run $file"       unless $return;
-		    }
-		}
-	    }
-	}
     }
 
     $chainref;
@@ -2747,11 +2731,13 @@ sub accounting_chainrefs() {
     grep $_->{accounting} , values %$filter_table;
 }
 
-sub ensure_mangle_chain($) {
-    my $chain = $_[0];
+sub ensure_mangle_chain($;$$) {
+    my ( $chain, $number, $restriction ) = @_;
 
     my $chainref = ensure_chain 'mangle', $chain;
     $chainref->{referenced}  = 1;
+    $chainref->{chainnumber} = $number if $number;
+    $chainref->{restriction} = $restriction if $restriction;
     $chainref;
 }
 
@@ -3596,7 +3582,7 @@ sub optimize_level4( $$ ) {
     if ( my $chains  = @chains ) {
 	$passes++;
 
-	progress_message "\n Table $table pass $passes, $chains short chains, level 4b...";
+	progress_message "\n Table $table pass $passes, $chains short chains, level 4c...";
 
 	for my $chainref ( @chains ) {
 	    my $name = $chainref->{name};
@@ -5773,12 +5759,12 @@ sub have_ipset_rules() {
     $ipset_rules;
 }
 
-sub get_interface_address( $ );
+sub get_interface_address( $;$ );
 
-sub get_interface_gateway ( $;$ );
+sub get_interface_gateway ( $;$$ );
 
-sub record_runtime_address( $$;$ ) {
-    my ( $addrtype, $interface, $protect ) = @_;
+sub record_runtime_address( $$;$$ ) {
+    my ( $addrtype, $interface, $protect, $provider ) = @_;
 
     if ( $interface =~ /^{([a-zA-Z_]\w*)}$/ ) {
 	fatal_error "Mixed required/optional usage of address variable $1" if ( $address_variables{$1} || $addrtype ) ne $addrtype;
@@ -5792,9 +5778,9 @@ sub record_runtime_address( $$;$ ) {
     my $addr;
 
     if ( $addrtype eq '&' ) {
-	$addr = get_interface_address( $interface );
+	$addr = get_interface_address( $interface, $provider );
     } else {
-	$addr = get_interface_gateway( $interface, $protect );
+	$addr = get_interface_gateway( $interface, $protect, $provider );
     }
 
     $addr . ' ';
@@ -5819,12 +5805,18 @@ sub conditional_rule( $$ ) {
 		if ( $type eq '&' ) {
 		    $variable = get_interface_address( $interface );
 		    add_commands( $chainref , "if [ $variable != " . NILIP . ' ]; then' );
+		    incr_cmd_level $chainref;
 		} else {
 		    $variable = get_interface_gateway( $interface );
+
+		    if ( $variable =~ /^\$/ ) {
 			add_commands( $chainref , qq(if [ -n "$variable" ]; then) );
+			incr_cmd_level $chainref;
+		    } else {
+			return 0;
+		    }
 		}
 
-		incr_cmd_level $chainref;
 		return 1;
 	    }
 	} elsif ( $type eq '%' && $interface =~ /^{([a-zA-Z_]\w*)}$/ ) {
@@ -6785,8 +6777,8 @@ sub interface_address( $ ) {
 #
 # Record that the ruleset requires the first IP address on the passed interface
 #
-sub get_interface_address ( $ ) {
-    my ( $logical ) = $_[0];
+sub get_interface_address ( $;$ ) {
+    my ( $logical, $provider ) = @_;
 
     my $interface = get_physical( $logical );
     my $variable = interface_address( $interface );
@@ -6796,6 +6788,8 @@ sub get_interface_address ( $ ) {
 
     $interfaceaddr{$interface} = "$variable=\$($function $interface)\n";
 
+    set_interface_option( $logical, 'used_address_variable', 1 ) unless $provider;
+
     "\$$variable";
 }
 
@@ -6856,14 +6850,21 @@ sub interface_gateway( $ ) {
 #
 # Record that the ruleset requires the gateway address on the passed interface
 #
-sub get_interface_gateway ( $;$ ) {
-    my ( $logical, $protect ) = @_;
+sub get_interface_gateway ( $;$$ ) {
+    my ( $logical, $protect, $provider ) = @_;
 
     my $interface = get_physical $logical;
     my $variable = interface_gateway( $interface );
+    my $gateway  = get_interface_option( $interface, 'gateway' );
 
     $global_variables |= ALL_COMMANDS;
 
+    if ( $gateway ) {
+	fatal_error q(A gateway variable cannot be used for a provider interface with GATEWAY set to 'none' in the providers file)   if $gateway eq 'none';
+	fatal_error q(A gateway variable cannot be used for a provider interface with an empty GATEWAY column in the providers file) if $gateway eq 'omitted';
+	return $gateway if $gateway ne 'detect';
+    }
+
     if ( interface_is_optional $logical ) {
 	$interfacegateways{$interface} = qq([ -n "\$$variable" ] || $variable=\$(detect_gateway $interface));
     } else {
@@ -6871,6 +6872,8 @@ sub get_interface_gateway ( $;$ ) {
 [ -n "\$$variable" ] || startup_error "Unable to detect the gateway through interface $interface");
     }
 
+    set_interface_option($interface, 'used_gateway_variable', 1) unless $provider;
+
     $protect ? "\${$variable:-" . NILIP . '}' : "\$$variable";
 }
 
@@ -7273,6 +7276,7 @@ sub isolate_dest_interface( $$$$ ) {
     my ( $diface, $dnets );
 
     if ( ( $restriction & PREROUTE_RESTRICT ) && $dest =~ /^detect:(.*)$/ ) {
+	my $niladdr = NILIP;
 	#
 	# DETECT_DNAT_IPADDRS=Yes and we're generating the nat rule
 	#
@@ -7289,14 +7293,14 @@ sub isolate_dest_interface( $$$$ ) {
 
 	    push_command( $chainref , "for address in $list; do" , 'done' );
 
-	    push_command( $chainref , 'if [ $address != 0.0.0.0 ]; then' , 'fi' ) if $optional;
+	    push_command( $chainref , "if [ \$address != $niladdr ]; then" , 'fi' ) if $optional;
 
 	    $rule .= '-d $address ';
 	} else {
 	    my $interface = $interfaces[0];
 	    my $variable  = get_interface_address( $interface );
 
-	    push_command( $chainref , "if [ $variable != 0.0.0.0 ]; then" , 'fi') if interface_is_optional( $interface );
+	    push_command( $chainref , "if [ $variable != $niladdr ]; then" , 'fi') if interface_is_optional( $interface );
 
 	    $rule .= "-d $variable ";
 	}
@@ -7597,7 +7601,7 @@ sub handle_exclusion( $$$$$$$$$$$$$$$$$$$$$ ) {
 #
 # Returns the destination interface specified in the rule, if any.
 #
-sub expand_rule( $$$$$$$$$$$$;$ )
+sub expand_rule1( $$$$$$$$$$$$;$ )
 {
     my ($chainref ,    # Chain
 	$restriction,  # Determines what to do with interface names in the SOURCE or DEST
@@ -7614,8 +7618,6 @@ sub expand_rule( $$$$$$$$$$$$;$ )
 	$logname,      # Name of chain to name in log messages
        ) = @_;
 
-    return if $chainref->{complete};
-
     my ( $iiface, $diface, $inets, $dnets, $iexcl, $dexcl, $onets , $oexcl, $trivialiexcl, $trivialdexcl ) = 
        ( '',      '',      '',     '',     '',     '',     '',      '',     '',            '' );
     my  $chain = $actparams{chain} || $chainref->{name};
@@ -7850,6 +7852,78 @@ sub expand_rule( $$$$$$$$$$$$;$ )
     $diface;
 }
 
+sub expand_rule( $$$$$$$$$$$$;$$$ )
+{
+    my ($chainref ,    # Chain
+	$restriction,  # Determines what to do with interface names in the SOURCE or DEST
+	$prerule,      # Matches that go at the front of the rule
+	$rule,         # Caller's matches that don't depend on the SOURCE, DEST and ORIGINAL DEST
+	$source,       # SOURCE
+	$dest,         # DEST
+	$origdest,     # ORIGINAL DEST
+	$target,       # Target ('-j' part of the rule - may be empty)
+	$loglevel ,    # Log level (and tag)
+	$disposition,  # Primtive part of the target (RETURN, ACCEPT, ...)
+	$exceptionrule,# Caller's matches used in exclusion case
+	$usergenerated,# Rule came from the IP[6]TABLES target
+	$logname,      # Name of chain to name in log messages
+	$device,       # TC Device Name
+	$classid,      # TC Class Id
+       ) = @_;
+
+    return if $chainref->{complete};
+
+    my ( @source, @dest );
+
+    $source = '' unless defined $source;
+    $dest   = '' unless defined $dest;
+
+    if ( $source =~ /\(.+\)/ ) {
+	@source = split_list3( $source, 'SOURCE' );
+    } else {
+	@source = ( $source );
+    }
+
+    if ( $dest =~ /\(.+\)/ ) {
+	@dest = split_list3( $dest, 'DEST' );
+    } else {
+	@dest = ( $dest );
+    }
+
+    for $source ( @source ) {
+	if ( $source =~ /^(.+?):\((.+)\)$/ ) {
+	    $source = join( ':', $1, $2 );
+	} elsif ( $source =~ /^\((.+)\)$/ ) {
+	    $source = $1;
+	}
+
+	for $dest ( @dest ) {
+	    if ( $dest =~ /^(.+?):\((.+)\)$/ ) {
+		$dest = join( ':', $1, $2 );
+	    } elsif ( $dest =~ /^\((.+)\)$/ ) {
+		$dest = $1;
+	    }
+
+	    if ( ( my $result = expand_rule1( $chainref ,
+					      $restriction ,
+					      $prerule ,
+					      $rule ,
+					      $source ,
+					      $dest ,
+					      $origdest ,
+					      $target ,
+					      $loglevel ,
+					      $disposition ,
+					      $exceptionrule ,
+					      $usergenerated ,
+					      $logname ,
+		   ) ) && $device ) {
+		fatal_error "Class Id $classid is not associated with device $result" if $device ne $result &&( $config{TC_ENABLED} eq 'Internal' || $config{TC_ENABLED} eq 'Shared' );
+	    }
+	}
+    }
+}
+
 #
 # Returns true if the passed interface is associated with exactly one zone
 #
@@ -8265,6 +8339,7 @@ EOF
 
 sub ensure_ipsets( @ ) {
     my $set;
+    my $counters = have_capability( 'IPSET_MATCH_COUNTERS' ) ? ' counters' : '';
 
     if ( $globals{DBL_TIMEOUT} ne '' && $_[0] eq $globals{DBL_IPSET} ) {
 	shift;
@@ -8277,12 +8352,12 @@ sub ensure_ipsets( @ ) {
 	    emit(  q(    #),
 		   q(    # Set the timeout for the dynamic blacklisting ipset),
 		   q(    #),
-		  qq(    \$IPSET -exist create $globals{DBL_IPSET}  hash:net family inet timeout $globals{DBL_TIMEOUT} counters) );
+		  qq(    \$IPSET -exist create $globals{DBL_IPSET}  hash:net family inet timeout $globals{DBL_TIMEOUT}${counters}) );
 	} else {
 	    emit(  q(    #),
 		   q(    # Set the timeout for the dynamic blacklisting ipset),
 		   q(    #),
-		  qq(    \$IPSET -exist create $globals{DBL_IPSET} hash:net family inet6 timeout $globals{DBL_TIMEOUT} counters) );
+		  qq(    \$IPSET -exist create $globals{DBL_IPSET} hash:net family inet6 timeout $globals{DBL_TIMEOUT}${counters}) );
 	}
 
 	pop_indent;
@@ -8303,8 +8378,8 @@ sub ensure_ipsets( @ ) {
 	if ( $family == F_IPV4 ) {
 	    if ( have_capability 'IPSET_V5' ) {
 		emit ( qq(    if ! qt \$IPSET list $set -n; then) ,
-		       qq(        error_message "WARNING: ipset $set does not exist; creating it as an hash:net set") ,
-		       qq(        \$IPSET create $set hash:net family inet timeout 0 counters) ,
+		       qq(        error_message "WARNING: ipset $set does not exist; creating it as a hash:net set") ,
+		       qq(        \$IPSET create $set hash:net family inet timeout 0${counters}) ,
 		       qq(    fi) );
 	    } else {
 		emit ( qq(    if ! qt \$IPSET -L $set -n; then) ,
@@ -8314,8 +8389,8 @@ sub ensure_ipsets( @ ) {
 	    }
 	} else {
 	    emit ( qq(    if ! qt \$IPSET list $set -n; then) ,
-		   qq(        error_message "WARNING: ipset $set does not exist; creating it as an hash:net set") ,
-		   qq(        \$IPSET create $set hash:net family inet6 timeout 0 counters) ,
+		   qq(        error_message "WARNING: ipset $set does not exist; creating it as a hash:net set") ,
+		   qq(        \$IPSET create $set hash:net family inet6 timeout 0${counters}) ,
 		   qq(    fi) );
 	}
 

Shorewall/Perl/Shorewall/Compiler.pm

@@ -701,7 +701,7 @@ sub compiler {
     #
     # Allow user to load Perl modules
     #
-    run_user_exit1 'compile';
+    run_user_exit 'compile';
     #
     # Create a temp file to hold the script
     #
@@ -804,33 +804,8 @@ sub compiler {
     # Validate the TC files so that the providers will know what interfaces have TC
     #
     my $tcinterfaces = process_tc;
-    #
-    # Generate a function to bring up each provider
-    #
+
     process_providers( $tcinterfaces );
-    #
-    # [Re-]establish Routing
-    #
-    if ( $scriptfilename || $debug ) {
-	emit(  "\n#",
-	       '# Setup routing and traffic shaping',
-	       '#',
-	       'setup_routing_and_traffic_shaping() {'
-	    );
-
-	push_indent;
-    }
-
-    setup_providers;
-    #
-    # TCRules and Traffic Shaping
-    #
-    setup_tc( $update );
-
-    if ( $scriptfilename || $debug ) {
-	pop_indent;
-	emit "}\n"; # End of setup_routing_and_traffic_shaping()
-    }
 
     $have_arptables = process_arprules if $family == F_IPV4;
 
@@ -841,13 +816,9 @@ sub compiler {
     #
     process_tos;
     #
-    # ECN
+    # Setup Masquerade/SNAT
     #
-    setup_ecn if $family == F_IPV4 && have_capability( 'MANGLE_ENABLED' ) && $config{MANGLE_ENABLED};
-    #
-    # Setup Masquerading/SNAT
-    #
-    setup_masq;
+    setup_snat( $update );
     #
     # Setup Nat
     #
@@ -889,6 +860,37 @@ sub compiler {
     #
     setup_accounting if $config{ACCOUNTING};
 
+    enable_script;
+    #
+    # Generate a function to bring up each provider
+    #
+    if ( $scriptfilename || $debug ) {
+	emit(  "\n#",
+	       '# Setup routing and traffic shaping',
+	       '#',
+	       'setup_routing_and_traffic_shaping() {'
+	    );
+
+	push_indent;
+    }
+
+    setup_providers;
+    #
+    # TCRules and Traffic Shaping
+    #
+    setup_tc( $update );
+
+    if ( $scriptfilename || $debug ) {
+	pop_indent;
+	emit "}\n"; # End of setup_routing_and_traffic_shaping()
+    }
+    #
+    # ECN
+    #
+    setup_ecn if $family == F_IPV4 && have_capability( 'MANGLE_ENABLED' ) && $config{MANGLE_ENABLED};
+
+    disable_script;
+
     if ( $scriptfilename ) {
 	#
 	# Compiling a script - generate the zone by zone matrix

Shorewall/Perl/Shorewall/Config.pm

@@ -130,9 +130,11 @@ our %EXPORT_TAGS = ( internal => [ qw( create_temp_script
 				       split_list
 				       split_list1
 				       split_list2
+				       split_list3
 				       split_line
 				       split_line1
 				       split_line2
+				       split_rawline2
 				       first_entry
 				       open_file
 				       close_file
@@ -153,8 +155,6 @@ our %EXPORT_TAGS = ( internal => [ qw( create_temp_script
 				       propagateconfig
 				       append_file
 				       run_user_exit
-				       run_user_exit1
-				       run_user_exit2
 				       generate_aux_config
 				       format_warning
 				       no_comment
@@ -174,6 +174,7 @@ our %EXPORT_TAGS = ( internal => [ qw( create_temp_script
 				       $doing
 				       $done
 				       $currentline
+				       $rawcurrentline
 				       $currentfilename
 				       $debug
 				       $file_format
@@ -411,6 +412,7 @@ our %capdesc = ( NAT_ENABLED     => 'NAT',
 		 IFACE_MATCH     => 'Iface Match',
                  TCPMSS_TARGET   => 'TCPMSS Target',
                  WAIT_OPTION     => 'iptables --wait option',
+                 CPU_FANOUT      => 'NFQUEUE CPU Fanout',
 
 		 AMANDA_HELPER   => 'Amanda Helper',
 		 FTP_HELPER      => 'FTP Helper',
@@ -564,6 +566,7 @@ our $usedcaller;
 our $inline_matches;
 
 our $currentline;            # Current config file line image
+our $rawcurrentline;         # Current config file line with no variable expansion
 our $currentfile;            # File handle reference
 our $currentfilename;        # File NAME
 our $currentlinenumber;      # Line number
@@ -640,6 +643,7 @@ our %eliminated = ( LOGRATE          => 1,
 		    WIDE_TC_MARKS    => 1,
 		    HIGH_ROUTE_MARKS => 1,
 		    BLACKLISTNEWONLY => 1,
+		    CHAIN_SCRIPTS    => 1,
 		  );
 #
 # Variables involved in ?IF, ?ELSE ?ENDIF processing
@@ -745,7 +749,7 @@ sub initialize( $;$$) {
 		    EXPORT                  => 0,
 		    KLUDGEFREE              => '',
 		    VERSION                 => "5.0.9-Beta2",
-		    CAPVERSION              => 50004 ,
+		    CAPVERSION              => 50100 ,
 		    BLACKLIST_LOG_TAG       => '',
 		    RELATED_LOG_TAG         => '',
 		    MACLIST_LOG_TAG         => '',
@@ -887,7 +891,6 @@ sub initialize( $;$$) {
 	  WARNOLDCAPVERSION => undef,
 	  DEFER_DNS_RESOLUTION => undef,
 	  USE_RT_NAMES => undef,
-	  CHAIN_SCRIPTS => undef,
 	  TRACK_RULES => undef,
 	  REJECT_ACTION => undef,
 	  INLINE_MATCHES => undef,
@@ -1033,6 +1036,7 @@ sub initialize( $;$$) {
 	       IFACE_MATCH => undef,
 	       TCPMSS_TARGET => undef,
 	       WAIT_OPTION => undef,
+	       CPU_FANOUT => undef,
 
 	       AMANDA_HELPER => undef,
 	       FTP_HELPER => undef,
@@ -2442,6 +2446,25 @@ sub split_line2( $$;$$$ ) {
     @line;
 }
 
+#
+# Same as above, only it splits the raw current line
+#
+sub split_rawline2( $$;$$$ ) {
+    my $savecurrentline = $currentline;
+
+    $currentline = $rawcurrentline;
+    #
+    # Delete trailing comment
+    #
+    $currentline =~ s/\s*#.*//;
+
+    my @result = &split_line2( @_ );
+
+    $currentline = $savecurrentline;
+
+    @result;
+}
+
 sub split_line1( $$;$$ ) {
     &split_line2( @_, undef );
 }
@@ -3026,9 +3049,9 @@ sub process_compiler_directive( $$$$ ) {
 
     if ( $directive_callback ) {
         $directive_callback->( $keyword, $line ) 
-    } else {
-        $omitting;
     }
+
+    $omitting;
 }
 
 #
@@ -3736,6 +3759,7 @@ sub read_a_line($) {
 
 	    if ( $omitting ) {
 		print "OMIT=> $_\n" if $debug;
+		$directive_callback->( 'OMITTED', $_ ) if ( $directive_callback );
 		next;
 	    }
 
@@ -3790,6 +3814,10 @@ sub read_a_line($) {
 	    #
 	    handle_first_entry if $first_entry;
 	    #
+	    # Save Raw Image
+	    #
+	    $rawcurrentline = $currentline;
+	    #
 	    # Expand Shell Variables using %params and %actparams
 	    #
 	    expand_variables( $currentline ) if $options & EXPAND_VARIABLES;
@@ -3818,7 +3846,7 @@ sub read_a_line($) {
 		fatal_error "Invalid SECTION name ($sectionname)" unless $sectionname =~ /^[-_\da-zA-Z]+$/;
 		fatal_error "This file does not allow ?SECTION" unless $section_function;
 		$section_function->($sectionname);
-		$directive_callback->( 'SECTION', $currentline ) if $directive_callback;
+		$directive_callback->( 'SECTION', $rawcurrentline ) if $directive_callback;
 		next LINE;
 	    } else {
 		fatal_error "Non-ASCII gunk in file" if ( $options && CHECK_GUNK ) && $currentline =~ /[^\s[:print:]]/;
@@ -4544,11 +4572,11 @@ sub IPSet_Match() {
 }
 
 sub IPSet_Match_Nomatch() {
-    have_capability 'IPSET_MATCH' && $capabilities{IPSET_MATCH_NOMATCH};
+    have_capability( 'IPSET_MATCH' ) && $capabilities{IPSET_MATCH_NOMATCH};
 }
 
 sub IPSet_Match_Counters() {
-    have_capability 'IPSET_MATCH' && $capabilities{IPSET_MATCH_COUNTERS};
+    have_capability( 'IPSET_MATCH' ) && $capabilities{IPSET_MATCH_COUNTERS};
 }
 
 sub IPSET_V5() {
@@ -4819,6 +4847,10 @@ sub Tcpmss_Target() {
     qt1( "$iptables $iptablesw -A $sillyname -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu" );
 }
 
+sub Cpu_Fanout() {
+    have_capability( 'NFQUEUE_TARGET' ) && qt1( "$iptables -A $sillyname -j NFQUEUE --queue-balance 0:3 --queue-cpu-fanout" );
+}
+
 our %detect_capability =
     ( ACCOUNT_TARGET =>\&Account_Target,
       AMANDA_HELPER => \&Amanda_Helper,
@@ -4835,6 +4867,7 @@ our %detect_capability =
       CONNMARK => \&Connmark,
       CONNMARK_MATCH => \&Connmark_Match,
       CONNTRACK_MATCH => \&Conntrack_Match,
+      CPU_FANOUT => \&Cpu_Fanout,
       CT_TARGET => \&Ct_Target,
       DSCP_MATCH => \&Dscp_Match,
       DSCP_TARGET => \&Dscp_Target,
@@ -5062,6 +5095,7 @@ sub determine_capabilities() {
 	$capabilities{TARPIT_TARGET}   = detect_capability( 'TARPIT_TARGET' );
 	$capabilities{IFACE_MATCH}     = detect_capability( 'IFACE_MATCH' );
 	$capabilities{TCPMSS_TARGET}   = detect_capability( 'TCPMSS_TARGET' );
+	$capabilities{CPU_FANOUT}      = detect_capability( 'CPU_FANOUT' );
 
 	unless ( have_capability 'CT_TARGET' ) {
 	    $capabilities{HELPER_MATCH} = detect_capability 'HELPER_MATCH';
@@ -5235,6 +5269,8 @@ sub update_config_file( $ ) {
     update_default( 'EXPORTMODULES',  'No' );
     update_default( 'RESTART',        'reload' );
     update_default( 'PAGER',          $shorewallrc1{DEFAULT_PAGER} );
+    update_default( 'LOGFORMAT',      'Shorewall:%s:%s:' );
+    update_default( 'LOGLIMIT',       '' );
 
     my $fn;
 
@@ -6183,7 +6219,6 @@ sub get_configuration( $$$$ ) {
     default_yes_no 'AUTOCOMMENT'                , 'Yes';
     default_yes_no 'MULTICAST'                  , '';
     default_yes_no 'MARK_IN_FORWARD_CHAIN'      , '';
-    default_yes_no 'CHAIN_SCRIPTS'              , 'Yes';
 
     if ( supplied ( $val = $config{TRACK_RULES} ) ) {
 	if ( lc( $val ) eq 'file' ) {
@@ -6700,32 +6735,7 @@ sub append_file( $;$$ ) {
     $result;
 }
 
-#
-# Run a Perl extension script
-#
 sub run_user_exit( $ ) {
-    my $chainref = $_[0];
-    my $file = find_file $chainref->{name};
-
-    if ( $config{CHAIN_SCRIPTS} && -f $file ) {
-	progress_message2 "Running $file...";
-
-	my $command = qq(package Shorewall::User;\nno strict;\n# line 1 "$file"\n) . `cat $file`;
-
-	unless (my $return = eval $command ) {
-	    fatal_error "Couldn't parse $file: $@" if $@;
-
-	    unless ( defined $return ) {
-		fatal_error "Couldn't do $file: $!" if $!;
-		fatal_error "Couldn't do $file";
-	    }
-
-	    fatal_error "$file returned a false value";
-	}
-    }
-}
-
-sub run_user_exit1( $ ) {
     my $file = find_file $_[0];
 
     if ( -f $file ) {
@@ -6757,37 +6767,6 @@ sub run_user_exit1( $ ) {
     }
 }
 
-sub run_user_exit2( $$ ) {
-    my ($file, $chainref) = ( find_file $_[0], $_[1] );
-
-    if ( $config{CHAIN_SCRIPTS} && -f $file ) {
-	progress_message2 "Running $file...";
-	#
-	# File may be empty -- in which case eval would fail
-	#
-	push_open $file;
-
-	if ( read_a_line( STRIP_COMMENTS | SUPPRESS_WHITESPACE  | CHECK_GUNK ) ) {
-	    close_file;
-	    pop_open;
-
-	    unless (my $return = eval `cat $file` ) {
-		fatal_error "Couldn't parse $file: $@" if $@;
-
-		unless ( defined $return ) {
-		    fatal_error "Couldn't do $file: $!" if $!;
-		    fatal_error "Couldn't do $file";
-		}
-
-		fatal_error "$file returned a false value";
-	    }
-	}
-
-	pop_open;
-
-    }
-}
-
 #
 # Generate the aux config file for Shorewall Lite
 #

Shorewall/Perl/Shorewall/IPAddrs.pm

@@ -436,7 +436,7 @@ sub validate_portpair( $$ ) {
     #
     # Accept '-' as a port-range separator
     #
-    $pair =~ tr/-/:/;
+    $pair =~ tr/-/:/ if $pair =~ /^[-0-9]+$/;
 
     fatal_error "Invalid port range ($portpair)" if $pair =~ tr/:/:/ > 1;
 
@@ -472,7 +472,7 @@ sub validate_portpair1( $$ ) {
 
     fatal_error "Invalid port range ($portpair)" if $portpair =~ tr/-/-/ > 1;
 
-    $portpair = "0$portpair"       if substr( $portpair,  0, 1 ) eq ':';
+    $portpair = "1$portpair"       if substr( $portpair,  0, 1 ) eq ':';
     $portpair = "${portpair}65535" if substr( $portpair, -1, 1 ) eq ':';
 
     my @ports = split /-/, $portpair, 2;
@@ -483,9 +483,10 @@ sub validate_portpair1( $$ ) {
 
     if ( @ports == 2 ) {
 	$what = 'port range';
-	fatal_error "Invalid port range ($portpair)" unless $ports[0] < $ports[1];
+	fatal_error "Invalid port range ($portpair)" unless $ports[0] && $ports[0] < $ports[1];
     } else {
 	$what = 'port';
+	fatal_error 'Invalid port number (0)' unless $portpair;
     }
 
     fatal_error "Using a $what ( $portpair ) requires PROTO TCP, UDP, SCTP or DCCP" unless

Shorewall/Perl/Shorewall/Misc.pm

@@ -134,12 +134,12 @@ sub setup_ecn()
 	    for my $interface ( @interfaces ) {
 		my $chainref = ensure_chain 'mangle', ecn_chain( $interface );
 
-		add_ijump $mangle_table->{POSTROUTING} , j => $chainref, $interfaces{$interface}, p => 'tcp', imatch_dest_dev( $interface ) if have_capability 'MANGLE_FORWARD';
-		add_ijump $mangle_table->{OUTPUT},       j => $chainref, $interfaces{$interface}, p => 'tcp', imatch_dest_dev( $interface );
+		add_ijump_extended $mangle_table->{POSTROUTING} , j => $chainref, $interfaces{$interface}, p => 'tcp', imatch_dest_dev( $interface ) if have_capability 'MANGLE_FORWARD';
+		add_ijump_extended $mangle_table->{OUTPUT},       j => $chainref, $interfaces{$interface}, p => 'tcp', imatch_dest_dev( $interface );
 	    }
 
 	    for my $host ( @hosts ) {
-		add_ijump( $mangle_table->{ecn_chain $host->[0]}, j => 'ECN', $host->[1], targetopts => '--ecn-tcp-remove', p => 'tcp',  imatch_dest_net( $host->[2] ) );
+		add_ijump_extended( $mangle_table->{ecn_chain $host->[0]}, j => 'ECN', $host->[1], targetopts => '--ecn-tcp-remove', p => 'tcp',  imatch_dest_net( $host->[2] ) );
 	    }
 	}
     }
@@ -216,6 +216,7 @@ sub convert_blacklist() {
     my $audit       = $disposition =~ /^A_/;
     my $target      = $disposition;
     my $orig_target = $target;
+    my $warnings    = 0;
     my @rules;
 
     if ( @$zones || @$zones1 ) {
@@ -237,12 +238,22 @@ sub convert_blacklist() {
 	    return 0;
 	}
 
+	directive_callback(
+	    sub ()
+	    {
+		warning_message "Omitted rules and compiler directives were not translated" unless $warnings++;
+	    }
+	    );
+
 	first_entry "Converting $fn...";
 
 	while ( read_a_line( NORMAL_READ ) ) {
 	    my ( $networks, $protocol, $ports, $options ) =
-		split_line( 'blacklist file',
-			    { networks => 0, proto => 1, port => 2, options => 3 } );
+		split_rawline2( 'blacklist file',
+				{ networks => 0, proto => 1, port => 2, options => 3 },
+				{},
+				4,
+		);
 
 	    if ( $options eq '-' ) {
 		$options = 'src';
@@ -300,6 +311,8 @@ sub convert_blacklist() {
 	    }
 	}
 
+	directive_callback(0);
+
 	if ( @rules ) {
 	    my $fn1 = find_writable_file( 'blrules' );
 	    my $blrules;
@@ -312,7 +325,7 @@ sub convert_blacklist() {
 		transfer_permissions( $fn, $fn1 );
 		print $blrules <<'EOF';
 #
-# Shorewall version 5.0 - Blacklist Rules File
+# Shorewall - Blacklist Rules File
 #
 # For information about entries in this file, type "man shorewall-blrules"
 #
@@ -395,6 +408,7 @@ sub convert_routestopped() {
 	my ( @allhosts, %source, %dest , %notrack, @rule );
 
 	my $seq      = 0;
+	my $warnings = 0;
 	my $date = compiletime;
 
 	my ( $stoppedrules, $fn1 );
@@ -406,7 +420,7 @@ sub convert_routestopped() {
 	    transfer_permissions( $fn, $fn1 );
 	    print $stoppedrules <<'EOF';
 #
-# Shorewall version 5 - Stopped Rules File
+# Shorewall - Stopped Rules File
 #
 # For information about entries in this file, type "man shorewall-stoppedrules"
 #
@@ -422,6 +436,13 @@ sub convert_routestopped() {
 EOF
 	}
 
+	directive_callback(
+	    sub ()
+	    {
+		warning_message "Omitted rules and compiler directives were not translated" unless $warnings++;
+	    }
+	    );
+
 	first_entry(
 		    sub {
 			my $date = compiletime;
@@ -436,13 +457,16 @@ EOF
 	while ( read_a_line ( NORMAL_READ ) ) {
 
 	    my ($interface, $hosts, $options , $proto, $ports, $sports ) =
-		split_line( 'routestopped file',
-			    { interface => 0, hosts => 1, options => 2, proto => 3, dport => 4, sport => 5 } );
+		split_rawline2( 'routestopped file',
+				{ interface => 0, hosts => 1, options => 2, proto => 3, dport => 4, sport => 5 },
+				{},
+				6,
+				0,
+		);
 
 	    my $interfaceref;
 
 	    fatal_error 'INTERFACE must be specified' if $interface eq '-';
-	    fatal_error "Unknown interface ($interface)" unless $interfaceref = known_interface $interface;
 	    $hosts = ALLIP unless $hosts && $hosts ne '-';
 
 	    my $routeback = 0;
@@ -456,8 +480,6 @@ EOF
 	    $hosts = ALLIP if $hosts eq '-';
 
 	    for my $host ( split /,/, $hosts ) {
-		fatal_error "Ipsets not allowed with SAVE_IPSETS=Yes" if $host =~ /^!?\+/ && $config{SAVE_IPSETS};
-		validate_host $host, 1;
 		push @hosts, "$interface|$host|$seq";
 		push @rule, $rule;
 	    }
@@ -501,6 +523,8 @@ EOF
 	    push @allhosts, @hosts;
 	}
 
+	directive_callback(0);
+
 	for my $host ( @allhosts ) {
 	    my ( $interface, $h, $seq ) = split /\|/, $host;
 	    my $rule = shift @rule;
@@ -1004,7 +1028,7 @@ sub add_common_rules ( $ ) {
 	    );
     }
 	    
-    run_user_exit1 'initdone';
+    run_user_exit 'initdone';
 
     if ( $upgrade ) {
 	convert_blacklist;
@@ -1430,8 +1454,6 @@ sub setup_mac_lists( $ ) {
 		}
 	    }
 
-	    run_user_exit2( 'maclog', $chainref );
-
 	    log_irule_limit $level, $chainref , $chain , $disposition, [], $tag, 'add', '' if $level ne '';
 	    add_ijump $chainref, j => $target;
 	}
@@ -2740,6 +2762,9 @@ EOF
     pop_indent;
 
     emit '
+    rm -f ${VARDIR}/*.address
+    rm -f ${VARDIR}/*.gateway
+
     run_stopped_exit';
 
     my @ipsets = all_ipsets;

Shorewall/Perl/Shorewall/Nat.pm

@@ -36,8 +36,8 @@ use Shorewall::Providers qw( provider_realm );
 use strict;
 
 our @ISA = qw(Exporter);
-our @EXPORT = qw( setup_masq setup_nat setup_netmap add_addresses );
-our %EXPORT_TAGS = ( rules => [ qw ( handle_nat_rule handle_nonat_rule ) ] );
+our @EXPORT = qw( setup_nat setup_netmap add_addresses );
+our %EXPORT_TAGS = ( rules => [ qw ( handle_nat_rule handle_nonat_rule process_one_masq convert_masq @addresses_to_add %addresses_to_add ) ] );
 our @EXPORT_OK = ();
 
 Exporter::export_ok_tags('rules');
@@ -62,7 +62,7 @@ sub initialize($) {
 #
 sub process_one_masq1( $$$$$$$$$$$ )
 {
-    my ($interfacelist, $networks, $addresses, $proto, $ports, $ipsec, $mark, $user, $condition, $origdest, $probability ) = @_;
+    my ( $interfacelist, $networks, $addresses, $proto, $ports, $ipsec, $mark, $user, $condition, $origdest, $probability ) = @_;
 
     my $pre_nat;
     my $add_snat_aliases = $family == F_IPV4 && $config{ADD_SNAT_ALIASES};
@@ -70,10 +70,12 @@ sub process_one_masq1( $$$$$$$$$$$ )
     my $baserule = '';
     my $inlinematches = '';
     my $prerule       = '';
+    my $savelist;
     #
     # Leading '+'
     #
     $pre_nat = 1 if $interfacelist =~ s/^\+//;
+
     #
     # Check for INLINE
     #
@@ -83,6 +85,8 @@ sub process_one_masq1( $$$$$$$$$$$ )
     } else {
 	$inlinematches = get_inline_matches(0);
     }
+
+    $savelist = $interfacelist;
     #
     # Handle early matches
     #
@@ -149,9 +153,12 @@ sub process_one_masq1( $$$$$$$$$$$ )
     $baserule .= do_user( $user )                    if $user ne '-';
     $baserule .= do_probability( $probability )      if $probability ne '-';
 
+    my $target;
+
     for my $fullinterface (split_list $interfacelist, 'interface' ) {
 	my $rule = '';
-	my $target = 'MASQUERADE ';
+
+	$target = 'MASQUERADE ';
 	#
 	# Isolate and verify the interface part
 	#
@@ -193,6 +200,7 @@ sub process_one_masq1( $$$$$$$$$$$ )
 	# Parse the ADDRESSES column
 	#
 	if ( $addresses ne '-' ) {
+	    my $saveaddresses = $addresses;
 	    if ( $addresses eq 'random' ) {
 		require_capability( 'MASQUERADE_TGT', 'Masquerade rules', '') if $family == F_IPV6;
 		$randomize = '--random ';
@@ -224,7 +232,7 @@ sub process_one_masq1( $$$$$$$$$$$ )
 		    my $addrlist = '';
 		    my @addrs = split_list $addresses, 'address';
 
-		    fatal_error "Only one IPv6 ADDRESS may be specified" if $family == F_IPV6 && @addrs > 1;
+		    fatal_error "Only one ADDRESS may be specified" if @addrs > 1;
 
 		    for my $addr ( @addrs ) {
 			if ( $addr =~ /^([&%])(.+)$/ ) {
@@ -240,6 +248,7 @@ sub process_one_masq1( $$$$$$$$$$$ )
 			    # Address Variable
 			    #
 			    $target = 'SNAT ';
+
 			    if ( $interface =~ /^{([a-zA-Z_]\w*)}$/ ) {
 				#
 				# User-defined address variable
@@ -269,14 +278,20 @@ sub process_one_masq1( $$$$$$$$$$$ )
 			} elsif ( $family == F_IPV4 ) {
 			    if ( $addr =~ /^.*\..*\..*\./ ) {
 				$target = 'SNAT ';
-				my ($ipaddr, $rest) = split ':', $addr;
+				my ($ipaddr, $rest) = split ':', $addr, 2;
 				if ( $ipaddr =~ /^(.+)-(.+)$/ ) {
 				    validate_range( $1, $2 );
 				} else {
 				    validate_address $ipaddr, 0;
 				}
-				validate_portpair1( $proto, $rest ) if supplied $rest;
+
+				if ( supplied $rest ) {
+				    validate_portpair1( $proto, $rest );
 				    $addrlist .= "--to-source $addr ";
+				} else {
+				    $addrlist .= "--to-source $ipaddr";
+				}
+
 				$exceptionrule = do_proto( $proto, '', '' ) if $addr =~ /:/;
 			    } else {
 				my $ports = $addr;
@@ -337,6 +352,7 @@ sub process_one_masq1( $$$$$$$$$$$ )
 
 	    $target .= $randomize;
 	    $target .= $persistent;
+	    $addresses = $saveaddresses;
 	} else {
 	    require_capability( 'MASQUERADE_TGT', 'Masquerade rules', '' )  if $family == F_IPV6;
 	    $add_snat_aliases = 0;
@@ -386,8 +402,130 @@ sub process_one_masq1( $$$$$$$$$$$ )
 
 }
 
-sub process_one_masq( )
+sub convert_one_masq1( $$$$$$$$$$$$ )
 {
+    my ( $snat, $interfacelist, $networks, $addresses, $proto, $ports, $ipsec, $mark, $user, $condition, $origdest, $probability ) = @_;
+
+    my $pre_nat;
+    my $destnets = '';
+    my $savelist;
+    #
+    # Leading '+'
+    #
+    $pre_nat = ( $interfacelist =~ s/^\+// );
+    #
+    # Check for INLINE
+    #
+    if ( $interfacelist =~ /^INLINE\((.+)\)$/ ) {
+	$interfacelist = $1;
+    }
+
+    $savelist = $interfacelist;
+    #
+    # Parse the remaining part of the INTERFACE column
+    #
+    if ( $family == F_IPV4 ) {
+	if ( $interfacelist =~ /^([^:]+)::([^:]*)$/ ) {
+	    $destnets = $2;
+	    $interfacelist = $1;
+	} elsif ( $interfacelist =~ /^([^:]+:[^:]+):([^:]+)$/ ) {
+	    $destnets = $2;
+	    $interfacelist = $1;
+	} elsif ( $interfacelist =~ /^([^:]+):$/ ) {
+	    $interfacelist = $1;
+	} elsif ( $interfacelist =~ /^([^:]+):([^:]*)$/ ) {
+	    my ( $one, $two ) = ( $1, $2 );
+	    if ( $2 =~ /\./ || $2 =~ /^%/ ) {
+		$interfacelist = $one;
+		$destnets = $two;
+	    }
+	}
+    } elsif ( $interfacelist =~ /^(.+?):(.+)$/ ) {
+	$interfacelist = $1;
+	$destnets      = $2;
+    }
+    #
+    # If there is no source or destination then allow all addresses
+    #
+    $networks = ALLIP if $networks eq '-';
+    $destnets = ALLIP if $destnets eq '-';
+
+    my $target;
+    #
+    # Parse the ADDRESSES column
+    #
+    if ( $addresses ne '-' ) {
+	my $saveaddresses = $addresses;
+	if ( $addresses ne 'random' ) {
+	    $addresses =~ s/:persistent$//;
+	    $addresses =~ s/:random$//;
+
+	    if ( $addresses eq 'detect' ) {
+		$target = 'SNAT';
+	    } elsif ( $addresses eq 'NONAT' ) {
+		$target = 'CONTINUE';
+	    } elsif ( $addresses ) {
+		if ( $addresses =~ /^:/ ) {
+		    $target = 'MASQUERADE';
+		} else {
+		    $target = 'SNAT';
+		}
+	    }
+	}
+
+	$addresses = $saveaddresses;
+    } else {
+	$target = 'MASQUERADE';
+    }
+
+    if ( $snat ) {
+	$target .= '+' if $pre_nat;
+
+	if ( $addresses ne '-' && $addresses ne 'NONAT' ) {
+	    $addresses =~ s/^://;
+	    $target .= '(' . $addresses . ')';
+	}
+
+	my $line = "$target\t$networks\t$savelist\t$proto\t$ports\t$ipsec\t$mark\t$user\t$condition\t$origdest\t$probability";
+	#
+	# Supress superfluous trailing dashes
+	#
+	$line =~ s/(?:\t-)+$//;
+
+	my $raw_matches = fetch_inline_matches;
+
+	$line .= join( '', ' ;;', $raw_matches ) if $raw_matches ne ' ';
+
+	print $snat "$line\n";
+    }
+
+    progress_message "   Masq record \"$rawcurrentline\" Converted";
+
+}
+
+sub process_one_masq( $ )
+{
+    my ( $snat ) = @_;
+
+    if ( $snat ) {
+	unless ( $rawcurrentline =~ /^\s*(?:#.*)?$/ ) {
+	    #
+	    # Line was not blank or all comment
+	    #
+	    my ($interfacelist, $networks, $addresses, $protos, $ports, $ipsec, $mark, $user, $condition, $origdest, $probability ) =
+		split_rawline2( 'masq file',
+				{ interface => 0, source => 1, address => 2, proto => 3, port => 4, ipsec => 5, mark => 6, user => 7, switch => 8, origdest => 9, probability => 10 },
+				{},    #Nopad
+				undef, #Columns
+				1 );   #Allow inline matches
+
+	    if ( $interfacelist ne '-' ) { 
+		for my $proto ( split_list $protos, 'Protocol' ) {
+		    convert_one_masq1( $snat, $interfacelist, $networks, $addresses, $proto, $ports, $ipsec, $mark, $user, $condition, $origdest, $probability );
+		}
+	    }
+	}
+    } else {
 	my ($interfacelist, $networks, $addresses, $protos, $ports, $ipsec, $mark, $user, $condition, $origdest, $probability ) =
 	    split_line2( 'masq file',
 			 { interface => 0, source => 1, address => 2, proto => 3, port => 4, ipsec => 5, mark => 6, user => 7, switch => 8, origdest => 9, probability => 10 },
@@ -400,18 +538,114 @@ sub process_one_masq( )
 	for my $proto ( split_list $protos, 'Protocol' ) {
 	    process_one_masq1( $interfacelist, $networks, $addresses, $proto, $ports, $ipsec, $mark, $user, $condition, $origdest, $probability );
 	}
+    }
+}
+
+sub open_snat_for_output( $ ) {
+    my ($fn ) = @_;
+    my ( $snat, $fn1 );
+
+    if ( -f ( $fn1 = find_writable_file( 'snat' ) ) ) {
+	open( $snat , '>>', $fn1 ) || fatal_error "Unable to open $fn1:$!";
+    } else {
+	open( $snat , '>', $fn1 ) || fatal_error "Unable to open $fn1:$!";
+	#
+	# Transfer permissions from the existing masq file to the new snat file
+	#
+	transfer_permissions( $fn, $fn1 );
+
+	if ( $family == F_IPV4 ) {
+	    print $snat <<'EOF';
+#
+# Shorewall - SNAT/Masquerade File
+#
+# For information about entries in this file, type "man shorewall-snat"
+#
+# See http://shorewall.net/manpages/shorewall-snat.html for additional information
+EOF
+	} else {
+	    print $snat <<'EOF';
+#
+# Shorewall6 - SNAT/Masquerade File
+#
+# For information about entries in this file, type "man shorewall6-snat"
+#
+# See http://shorewall.net/manpages6/shorewall6-snat.html for additional information
+EOF
+	}
+
+	print $snat <<'EOF';
+###################################################################################################################
+#ACTION         SOURCE          DEST            PROTO   PORT   IPSEC  MARK   USER    SWITCH  ORIGDEST   PROBABILITY
+EOF
+    }
+
+    return ( $snat, $fn1 );
 }
 
 #
-# Process the masq file
+# Convert a masq file into the equivalent snat file
 #
-sub setup_masq()
-{
+sub convert_masq() {
     if ( my $fn = open_file( 'masq', 1, 1 ) ) {
+	my ( $snat, $fn1 ) = open_snat_for_output( $fn );
 
-	first_entry( sub { progress_message2 "$doing $fn..."; require_capability 'NAT_ENABLED' , "a non-empty masq file" , 's'; } );
+	my $have_masq_rules;
 
-	process_one_masq while read_a_line( NORMAL_READ );
+	directive_callback(
+	    sub ()
+	    {
+		if ( $_[0] eq 'OMITTED' ) {
+		    #
+		    # Convert the raw rule
+		    #
+		    process_one_masq( $snat) if $snat;
+		} else {
+		    print $snat "$_[1]\n"; 0;
+		}
+	    }
+	    );
+
+	first_entry(
+	    sub {
+		my $date = compiletime;
+		progress_message2 "Converting $fn...";
+		print( $snat
+		       "#\n" ,
+		       "# Rules generated from masq file $fn by Shorewall $globals{VERSION} - $date\n" ,
+		       "#\n" );
+	    }
+	    );
+
+	while ( read_a_line( NORMAL_READ ) ) {
+	    #
+	    # Process the file normally
+	    #
+	    process_one_masq(0);
+	    #
+	    # Now Convert it
+	    #
+	    process_one_masq($snat);
+
+	    $have_masq_rules++;
+	}
+
+	if ( $have_masq_rules ) {
+	    progress_message2 "Converted $fn to $fn1";
+	    if ( rename $fn, "$fn.bak" ) {
+		progress_message2 "$fn renamed $fn.bak";
+	    } else {
+		fatal_error "Cannot Rename $fn to $fn.bak: $!";
+	    }
+	} else {
+	    if ( unlink $fn ) {
+		warning_message "Empty masq file ($fn) removed";
+	    } else {
+		warning_message "Unable to remove empty masq file $fn: $!";
+	    }
+	}
+
+	close $snat, directive_callback( 0 );
     }
 }
 

Shorewall/Perl/Shorewall/Providers.pm

@@ -220,7 +220,14 @@ sub copy_table( $$$ ) {
 	       '            esac',
 	     );
     } else {
-	emit ( "            run_ip route add table $number \$net \$route $realm" );
+	emit ( '            case $net in',
+	       '                fe80:*)',
+	       '                    ;;',
+	       '                *)',
+	       "                    run_ip route add table $number \$net \$route $realm",
+	       '                    ;;',
+	       '            esac',
+	     );
     }
 
     emit ( '            ;;',
@@ -291,7 +298,14 @@ sub copy_and_edit_table( $$$$$ ) {
 		'                    esac',
 	     );
     } else {
-	emit (  "                    run_ip route add table $id \$net \$route $realm" );
+	emit (  '                    case $net in',
+		'                        fe80:*)',
+		'                            ;;',
+		'                        *)',
+		"                            run_ip route add table $id \$net \$route $realm",
+		'                            ;;',
+		'                    esac',
+	     );
     }
 
     emit (  '                    ;;',
@@ -472,12 +486,14 @@ sub process_a_provider( $ ) {
 
     if ( ( $gw = lc $gateway ) eq 'detect' ) {
 	fatal_error "Configuring multiple providers through one interface requires an explicit gateway" if $shared;
-	$gateway = get_interface_gateway $interface;
+	$gateway = get_interface_gateway( $interface, undef, 1 );
 	$gatewaycase = 'detect';
+	set_interface_option( $interface, 'gateway', 'detect' );
     } elsif ( $gw eq 'none' ) {
 	fatal_error "Configuring multiple providers through one interface requires a gateway" if $shared;
 	$gatewaycase = 'none';
 	$gateway = '';
+	set_interface_option( $interface, 'gateway', 'none' );
     } elsif ( $gateway && $gateway ne '-' ) {
 	( $gateway, $mac ) = split_host_list( $gateway, 0 );
 	validate_address $gateway, 0;
@@ -491,12 +507,15 @@ sub process_a_provider( $ ) {
 	}
 
 	$gatewaycase = 'specified';
+	set_interface_option( $interface, 'gateway', $gateway );
     } else {
 	$gatewaycase = 'omitted';
 	fatal_error "Configuring multiple providers through one interface requires a gateway" if $shared;
 	$gateway = '';
+	set_interface_option( $interface, 'gateway', $pseudo ? 'detect' : 'omitted' );
     }
 
+
     my ( $loose, $track, $balance, $default, $default_balance, $optional, $mtu, $tproxy, $local, $load, $what, $hostroute, $persistent );
 
     if ( $pseudo ) {	
@@ -725,9 +744,9 @@ sub emit_started_message( $$$$$ ) {
     my ( $spaces, $level, $pseudo, $name, $number ) = @_;
 
     if ( $pseudo ) {
-	emit qq(${spaces}progress_message${level} "   Optional interface $name Started");
+	emit qq(${spaces}progress_message${level} "Optional interface $name Started");
     } else {
-	emit qq(${spaces}progress_message${level} "   Provider $name ($number) Started");
+	emit qq(${spaces}progress_message${level} "Provider $name ($number) Started");
     }
 }
 
@@ -794,7 +813,7 @@ sub add_a_provider( $$ ) {
 	}
 
 	if ( $gateway ) {
-	    $address = get_interface_address $interface unless $address;
+	    $address = get_interface_address( $interface, 1 ) unless $address;
 
 	    emit( qq([ -z "$address" ] && return\n) );
 
@@ -920,7 +939,7 @@ CEOF
     }
 
     if ( $gateway ) {
-	$address = get_interface_address $interface unless $address;
+	$address = get_interface_address( $interface, 1 ) unless $address;
 
 	if ( $hostroute ) {
 	    emit qq(run_ip route replace $gateway src $address dev $physical ${mtu});
@@ -1033,6 +1052,16 @@ CEOF
 	emit( qq(rm -f \${VARDIR}/${physical}_disabled) );
 	emit_started_message( '', 2, $pseudo, $table, $number );
 
+	if ( get_interface_option( $interface, 'used_address_variable' ) || get_interface_option( $interface, 'used_gateway_variable' ) ) {
+	    emit( '',
+		  'if [ -n "$g_forcereload" ]; then',
+		  "    progress_message2 \"The IP address or gateway of $physical has changed -- forcing reload of the ruleset\"",
+		  '    COMMAND=reload',
+		  '    detect_configuration',
+		  '    define_firewall',
+		  'fi' );
+	}
+
 	pop_indent;
 
 	unless ( $pseudo ) {
@@ -1043,6 +1072,17 @@ CEOF
 	}
 
 	emit "fi\n";
+
+	if ( get_interface_option( $interface, 'used_address_variable' ) ) {
+	    my $variable = interface_address( $interface );
+
+	    emit( "echo \$$variable > \${VARDIR}/${physical}.address" );
+	}
+
+	if ( get_interface_option( $interface, 'used_gateway_variable' ) ) {
+	    my $variable = interface_gateway( $interface );
+	    emit( qq(echo "\$$variable" > \${VARDIR}/${physical}.gateway\n) );
+	}
     } else {
 	emit( qq(progress_message "Provider $table ($number) Started") );
     }
@@ -1067,6 +1107,17 @@ CEOF
 	} else {
 	    emit ( "error_message \"WARNING: Interface $physical is not usable -- Provider $table ($number) not Started\"" );
 	}
+
+
+	if ( get_interface_option( $interface, 'used_address_variable' ) ) {
+	    my $variable = interface_address( $interface );
+	    emit( "\necho \$$variable > \${VARDIR}/${physical}.address" );
+	}
+
+	if ( get_interface_option( $interface, 'used_gateway_variable' ) ) {
+	    my $variable = interface_gateway( $interface );
+	    emit( qq(\necho "\$$variable" > \${VARDIR}/${physical}.gateway) );
+	}
     } else {
 	if ( $shared ) {
 	    emit( "fatal_error \"Gateway $gateway is not reachable -- Provider $table ($number) Cannot be Started\"" );
@@ -1205,7 +1256,7 @@ sub add_an_rtrule1( $$$$$ ) {
     if ( $source eq '-' ) {
 	$source = 'from ' . ALLIP;
     } elsif ( $source =~ s/^&// ) {
-	$source = 'from ' . record_runtime_address '&', $source;
+	$source = 'from ' . record_runtime_address( '&', $source, undef, 1 );
     } elsif ( $family == F_IPV4 ) {
 	if ( $source =~ /:/ ) {
 	    ( my $interface, $source , my $remainder ) = split( /:/, $source, 3 );
@@ -1459,7 +1510,18 @@ sub finish_providers() {
 
     if ( $balancing ) {
 	emit  ( 'if [ -n "$DEFAULT_ROUTE" ]; then' );
+
+	if ( $family == F_IPV4 ) {
 	    emit  ( "    run_ip route replace default scope global table $table \$DEFAULT_ROUTE" );
+	} else {
+	    emit  ( "    if echo \$DEFAULT_ROUTE | grep -q 'nexthop.+nexthop'; then",
+		    "        qt \$IP -6 route delete default scope global table $table \$DEFAULT_ROUTE",
+		    "        run_ip -6 route add default scope global table $table \$DEFAULT_ROUTE",
+		    '    else',
+		    "        run_ip -6 route replace default scope global table $table \$DEFAULT_ROUTE",
+		    '    fi',
+		    '' );
+	}
 
 	if ( $config{USE_DEFAULT_RT} ) {
 	    emit  ( "    while qt \$IP -$family route del default table $main; do",
@@ -1512,7 +1574,13 @@ sub finish_providers() {
 
     if ( $fallback ) {
 	emit  ( 'if [ -n "$FALLBACK_ROUTE" ]; then' );
+
+	if ( $family == F_IPV4 ) {
 	    emit( "    run_ip route replace default scope global table $default \$FALLBACK_ROUTE" );
+	} else {
+	    emit( "    run_ip route delete default scope global table $default \$FALLBACK_ROUTE" );
+	    emit( "    run_ip route add default scope global table $default \$FALLBACK_ROUTE" );
+	}
 
 	emit( "    progress_message \"Fallback route '\$(echo \$FALLBACK_ROUTE | sed 's/\$\\s*//')' Added\"",
 	      'else',
@@ -2139,6 +2207,7 @@ sub handle_optional_interfaces( $ ) {
 		}
 
 		push_indent;
+
 		if ( $providerref->{gatewaycase} eq 'detect' ) {
 		    emit qq(if interface_is_usable $physical && [ -n "$providerref->{gateway}" ]; then);
 		} else {
@@ -2151,6 +2220,28 @@ sub handle_optional_interfaces( $ ) {
 		emit( "    SW_${wildbase}_IS_USABLE=Yes" ) if $interfaceref->{wildcard};
 		emit( 'fi' );
 
+		if ( get_interface_option( $interface, 'used_address_variable' ) ) {
+		    my $variable = interface_address( $interface );
+
+		    emit( '',
+			  "if [ -f \${VARDIR}/${physical}.address ]; then",
+			  "    if [ \$(cat \${VARDIR}/${physical}.address) != \$$variable ]; then",
+			  '        g_forcereload=Yes',
+			  '    fi',
+			  'fi' );
+		}
+
+		if ( get_interface_option( $interface, 'used_gateway_variable' ) ) {
+		    my $variable = interface_gateway( $interface );
+
+		    emit( '',
+			  "if [ -f \${VARDIR}/${physical}.gateway ]; then",
+			  "    if [ \$(cat \${VARDIR}/${physical}.gateway) != \"\$$variable\" ]; then",
+			  '        g_forcereload=Yes',
+			  '    fi',
+			  'fi' );
+		}
+
 		pop_indent;
 
 		emit( "fi\n" );
@@ -2161,6 +2252,7 @@ sub handle_optional_interfaces( $ ) {
 		my $base        = uc var_base( $physical );
 		my $case        = $physical;
 		my $wild        = $case =~ s/\+$/*/;
+		my $variable    = interface_address( $interface );
 
 		if ( $wildcards ) {
 		    emit( "$case)" );
@@ -2181,6 +2273,15 @@ sub handle_optional_interfaces( $ ) {
 		emit ( "    SW_${base}_IS_USABLE=Yes" ,
 		       'fi' );
 
+		if ( get_interface_option( $interface, 'used_address_variable' ) ) {
+		    emit( '',
+			  "if [ -f \${VARDIR}/${physical}.address ]; then",
+			  "    if [ \$(cat \${VARDIR}/${physical}.address) != \$$variable ]; then",
+			  '        g_forcereload=Yes',
+			  '    fi',
+			  'fi' );
+		}
+
 		if ( $wildcards ) {
 		    pop_indent, emit( 'fi' ) if $wild;
 		    emit( ';;' );

Shorewall/Perl/Shorewall/Tc.pm

@@ -42,7 +42,7 @@ use strict;
 
 our @ISA = qw(Exporter);
 our @EXPORT = qw( process_tc setup_tc );
-our @EXPORT_OK = qw( process_tc_rule initialize );
+our @EXPORT_OK = qw( initialize );
 our $VERSION = 'MODULEVERSION';
 
 our %flow_keys = ( 'src'            => 1,
@@ -827,7 +827,7 @@ sub validate_tc_class( ) {
 		fatal_error "Invalid 'occurs' ($val)"                               unless defined $occurs && $occurs > 1 && $occurs <= 256;
 		fatal_error "Invalid 'occurs' ($val)"                               if $occurs > $globals{TC_MAX};
 		fatal_error q(Duplicate 'occurs')                                   if $tcref->{occurs} > 1;
-		fatal_error q(The 'occurs' option is not valid with 'default')      if $devref->{default} == $classnumber;
+               fatal_error q(The 'occurs' option is not valid with 'default')      if defined($devref->{default}) && $devref->{default} == $classnumber;
 		fatal_error q(The 'occurs' option is not valid with 'tos')          if @{$tcref->{tos}};
 		warning_message "MARK ($mark) is ignored on an occurring class"     if $mark ne '-';
 
@@ -1308,6 +1308,8 @@ sub handle_ematch( $$ ) {
 
     $setname =~ s/\+//;
 
+    add_ipset($setname);
+
     return "ipset\\($setname $options\\)";
 }
 
@@ -1518,7 +1520,7 @@ sub process_tc_filter2( $$$$$$$$$ ) {
 	$rule .= ' and' if $have_rule;
 
 	if ( $source =~ /^\+/ ) {
-	    $rule = join( '', "\\\n   ", handle_ematch( $source, 'src' ) );
+	    $rule .= join( '', "\\\n   ", handle_ematch( $source, 'src' ) );
 	} else {
 	    my @parts = decompose_net_u32( $source );
 
@@ -1557,10 +1559,10 @@ sub process_tc_filter2( $$$$$$$$$ ) {
 		    $rule .= ' and' if @parts;
 		}
 	    }
+	}
 
 	$have_rule = 1;
     }
-    }
 
     if ( $have_rule ) {
 	push @$filtersref, ( "\nrun_tc $rule\\" ,
@@ -2148,41 +2150,14 @@ sub process_secmark_rule() {
     }
 }
 
-
-sub convert_tos($$) {
-    my ( $mangle, $fn1 ) = @_;
-
-    my $have_tos = 0;
-
-    sub unlink_tos( $ ) {
-	my $fn = shift;
-
-	if ( unlink $fn ) {
-	    warning_message "Empty tos file ($fn) removed";
-	} else {
-	    warning_message "Unable to remove empty tos file $fn: $!";
-	}
-    }
-
-    if ( my $fn = open_file 'tos' ) {
-	first_entry(
-		    sub {
-			my $date = compiletime;
-			progress_message2 "Converting $fn...";
-			print( $mangle
-			       "#\n" ,
-			       "# Rules generated from tos file $fn by Shorewall $globals{VERSION} - $date\n" ,
-			       "#\n" );
-		    }
-		   );
-
-	while ( read_a_line( NORMAL_READ ) ) {
-
-	    $have_tos = 1;
+sub convert_one_tos( $ ) {
+    my ( $mangle ) = @_;
 
     my ($src, $dst, $proto, $ports, $sports , $tos, $mark ) =
-		split_line( 'tos file entry',
-			    { source => 0, dest => 1, proto => 2, dport => 3, sport => 4, tos => 5, mark => 6 } );
+	split_rawline2( 'tos file entry',
+			{ source => 0, dest => 1, proto => 2, dport => 3, sport => 4, tos => 5, mark => 6 },
+			undef,
+			7 );
 
     my $chain_designator = 'P';
 
@@ -2217,8 +2192,62 @@ sub convert_tos($$) {
     $mark   = '-' unless supplied $mark;
 
     print $mangle "TOS($tos):$chain_designator\t$src\t$dst\t$proto\t$ports\t$sports\t-\t$mark\n"
+}
 
+
+sub convert_tos($$) {
+    my ( $mangle, $fn1 ) = @_;
+
+    my $have_tos = 0;
+
+    sub unlink_tos( $ ) {
+	my $fn = shift;
+
+	if ( unlink $fn ) {
+	    warning_message "Empty tos file ($fn) removed";
+	} else {
+	    warning_message "Unable to remove empty tos file $fn: $!";
 	}
+    }
+
+    if ( my $fn = open_file 'tos' ) {
+	directive_callback(
+	    sub ()
+	    {
+		if ( $_[0] eq 'OMITTED' ) {
+		    #
+		    # Convert the raw rule
+		    #
+		    if ( $rawcurrentline =~ /^\s*(?:#.*)?$/ ) {
+			print $mangle "$_[1]\n";
+		    } else {
+			convert_one_tos( $mangle );
+			$have_tos = 1;
+		    }
+		} else {
+		    print $mangle "$_[1]\n" unless $_[0] eq 'FORMAT';
+		}
+	    }
+	    );
+
+	first_entry(
+		    sub {
+			my $date = compiletime;
+			progress_message2 "Converting $fn...";
+			print( $mangle
+			       "#\n" ,
+			       "# Rules generated from tos file $fn by Shorewall $globals{VERSION} - $date\n" ,
+			       "#\n" );
+		    }
+		   );
+
+	while ( read_a_line( NORMAL_READ ) ) {
+
+	    convert_one_tos( $mangle );
+	    $have_tos = 1;
+	}
+
+	directive_callback(0);
 
 	if ( $have_tos ) {
 	    progress_message2 "Converted $fn to $fn1";
@@ -2248,9 +2277,10 @@ sub open_mangle_for_output( $ ) {
 	#
 	transfer_permissions( $fn, $fn1 );
 
+	if ( $family == F_IPV4 ) {
 	    print $mangle <<'EOF';
 #
-# Shorewall version 4 - Mangle File
+# Shorewall -- /etc/shorewall/mangle
 #
 # For information about entries in this file, type "man shorewall-mangle"
 #
@@ -2260,13 +2290,31 @@ sub open_mangle_for_output( $ ) {
 #
 # See http://shorewall.net/PacketMarking.html for a detailed description of
 # the Netfilter/Shorewall packet marking mechanism.
-####################################################################################################################################################
-#ACTION         SOURCE          DEST            PROTO   DEST    SOURCE  USER    TEST    LENGTH  TOS     CONNBYTES       HELPER  PROBABILITY     DSCP
-#                                                       PORT(S) PORT(S)
+##############################################################################################################################################################
+#ACTION         SOURCE          DEST            PROTO   DEST    SOURCE  USER    TEST    LENGTH  TOS     CONNBYTES       HELPER  PROBABILITY     DSCP    SWITCH
 EOF
+	} else {
+	    print $mangle <<'EOF';
+#
+# Shorewall6 -- /etc/shorewall6/mangle
+#
+# For information about entries in this file, type "man shorewall6-mangle"
+#
+# See http://shorewall.net/traffic_shaping.htm for additional information.
+# For usage in selecting among multiple ISPs, see
+# http://shorewall.net/MultiISP.html
+#
+# See http://shorewall.net/PacketMarking.html for a detailed description of
+# the Netfilter/Shorewall packet marking mechanism.
+#
+######################################################################################################################################################################
+#ACTION		SOURCE		DEST		PROTO	DPORT	SPORT	USER	TEST	LENGTH	TOS	CONNBYTES	HELPER	HEADERS	PROBABILITY	DSCP	SWITCH
+EOF
+
 	}
 
 	return ( $mangle, $fn1 );
+    }
 }
 
 #
@@ -2276,13 +2324,13 @@ sub setup_tc( $ ) {
     $convert = $_[0];
 
     if ( $config{MANGLE_ENABLED} ) {
-	ensure_mangle_chain 'tcpre';
-	ensure_mangle_chain 'tcout';
+	ensure_mangle_chain( 'tcpre', PREROUTING, PREROUTE_RESTRICT );
+	ensure_mangle_chain( 'tcout', OUTPUT    , OUTPUT_RESTRICT );
 
 	if ( have_capability( 'MANGLE_FORWARD' ) ) {
-	    ensure_mangle_chain 'tcfor';
-	    ensure_mangle_chain 'tcpost';
-	    ensure_mangle_chain 'tcin';
+	    ensure_mangle_chain( 'tcfor',  FORWARD    , NO_RESTRICT );
+	    ensure_mangle_chain( 'tcpost', POSTROUTING, POSTROUTE_RESTRICT );
+	    ensure_mangle_chain( 'tcin',   INPUT      , INPUT_RESTRICT );
 	}
 
 	my @mark_part;
@@ -2335,7 +2383,24 @@ sub setup_tc( $ ) {
 		#
 		( $mangle, $fn1 ) = open_mangle_for_output( $fn );
 
-		directive_callback( sub () { print $mangle "$_[1]\n" unless $_[0] eq 'FORMAT'; 0; } );
+		directive_callback(
+		    sub ()
+		    {
+			if ( $_[0] eq 'OMITTED' ) {
+			    #
+			    # Convert the raw rule
+			    #
+			    if ( $rawcurrentline =~ /^\s*(?:#.*)?$/ ) {
+				print $mangle "$_[1]\n";
+			    } else {
+				process_tc_rule;
+				$have_tcrules++;
+			    }
+			} else {
+			    print $mangle "$_[1]\n" unless $_[0] eq 'FORMAT';
+			}
+		    }
+		    );
 
 		first_entry(
 			    sub {

Shorewall/Perl/Shorewall/Zones.pm

@@ -95,7 +95,6 @@ our @EXPORT = ( qw( NOTHING
                     get_interface_origin
 		    interface_has_option
 		    set_interface_option
-		    set_interface_provider
 		    interface_zone
 		    interface_zones
 		    verify_required_interfaces
@@ -195,7 +194,6 @@ our %reservedName = ( all => 1,
 #                                     number      => <ordinal position in the interfaces file>
 #                                     physical    => <physical interface name>
 #                                     base        => <shell variable base representing this interface>
-#                                     provider    => <Provider Name, if interface is associated with a provider>
 #                                     wildcard    => undef|1 # Wildcard Name
 #                                     zones       => { zone1 => 1, ... }
 #                                     origin      => <where defined>
@@ -398,7 +396,6 @@ sub initialize( $$ ) {
 				    nodbl       => SIMPLE_IF_OPTION,
 				    nosmurfs    => SIMPLE_IF_OPTION + IF_OPTION_HOST,
 				    optional    => SIMPLE_IF_OPTION,
-				    optional    => SIMPLE_IF_OPTION,
 				    proxyndp    => BINARY_IF_OPTION,
 				    required    => SIMPLE_IF_OPTION,
 				    routeback   => BINARY_IF_OPTION + IF_OPTION_ZONEONLY + IF_OPTION_HOST + IF_OPTION_VSERVER,

Shorewall/Perl/compiler.pl

@@ -1,6 +1,6 @@
 #! /usr/bin/perl -w
 #
-#     The Shoreline Firewall Packet Filtering Firewall Compiler - V4.4
+#     The Shoreline Firewall Packet Filtering Firewall Compiler
 #
 #     (c) 2007,2008,2009,2010,2011,2014 - Tom Eastep (teastep@shorewall.net)
 #

Shorewall/Perl/getparams

@@ -38,12 +38,11 @@ fi
 #
 . /usr/share/shorewall/shorewallrc
 
-g_program=$PRODUCT
-g_sharedir="$SHAREDIR/shorewall"
-g_confdir="$CONFDIR/$PRODUCT"
-g_readrc=1
+g_basedir=${SHAREDIR}/shorewall
 
-. $g_sharedir/lib.cli
+. $g_basedir/lib.cli
+
+setup_product_environment
 
 CONFIG_PATH="$2"
 

Shorewall/Perl/prog.footer

@@ -128,6 +128,7 @@ g_compiled=
 g_file=
 g_docker=
 g_dockernetwork=
+g_forcereload=
 
 initialize
 

Shorewall/Samples/Universal/shorewall.conf

@@ -1,6 +1,6 @@
 ###############################################################################
 #
-#  Shorewall Version 4.4 -- /etc/shorewall/shorewall.conf
+#  Shorewall Version 5 -- /etc/shorewall/shorewall.conf
 #
 #  For information about the settings in this file, type "man shorewall.conf"
 #
@@ -47,11 +47,11 @@ LOGALLNEW=
 
 LOGFILE=/var/log/messages
 
-LOGFORMAT="Shorewall:%s:%s:"
+LOGFORMAT="%s %s "
 
 LOGTAGONLY=No
 
-LOGLIMIT=
+LOGLIMIT="s:1/sec:10"
 
 MACLIST_LOG_LEVEL=info
 
@@ -75,7 +75,7 @@ UNTRACKED_LOG_LEVEL=
 
 ARPTABLES=
 
-CONFIG_PATH=${CONFDIR}/shorewall:${SHAREDIR}/shorewall
+CONFIG_PATH="${CONFDIR}/shorewall:${SHAREDIR}/shorewall"
 
 GEOIPDIR=/usr/share/xt_geoip/LE
 
@@ -144,8 +144,6 @@ BASIC_FILTERS=No
 
 BLACKLIST="NEW,INVALID,UNTRACKED"
 
-CHAIN_SCRIPTS=No
-
 CLAMPMSS=No
 
 CLEAR_TC=Yes
@@ -293,5 +291,3 @@ PROVIDER_OFFSET=
 MASK_BITS=
 
 ZONE_BITS=0
-
-#LAST LINE -- DO NOT REMOVE

Shorewall/Samples/one-interface/shorewall.conf

@@ -58,11 +58,11 @@ LOGALLNEW=
 
 LOGFILE=/var/log/messages
 
-LOGFORMAT="Shorewall:%s:%s:"
+LOGFORMAT="%s %s "
 
 LOGTAGONLY=No
 
-LOGLIMIT=
+LOGLIMIT="s:1/sec:10"
 
 MACLIST_LOG_LEVEL=info
 
@@ -86,7 +86,7 @@ UNTRACKED_LOG_LEVEL=
 
 ARPTABLES=
 
-CONFIG_PATH=${CONFDIR}/shorewall:${SHAREDIR}/shorewall
+CONFIG_PATH="${CONFDIR}/shorewall:${SHAREDIR}/shorewall"
 
 GEOIPDIR=/usr/share/xt_geoip/LE
 
@@ -155,8 +155,6 @@ BASIC_FILTERS=No
 
 BLACKLIST="NEW,INVALID,UNTRACKED"
 
-CHAIN_SCRIPTS=No
-
 CLAMPMSS=No
 
 CLEAR_TC=Yes
@@ -304,5 +302,3 @@ PROVIDER_OFFSET=
 MASK_BITS=
 
 ZONE_BITS=0
-
-#LAST LINE -- DO NOT REMOVE

Shorewall/Samples/three-interfaces/masq

@@ -1,19 +0,0 @@
-#
-# Shorewall - Sample Masq file for three-interface configuration.
-# Copyright (C) 2006-2015 by the Shorewall Team
-#
-# This library is free software; you can redistribute it and/or
-# modify it under the terms of the GNU Lesser General Public
-# License as published by the Free Software Foundation; either
-# version 2.1 of the License, or (at your option) any later version.
-#
-# See the file README.txt for further details.
-#------------------------------------------------------------------------------
-# For information about entries in this file, type "man shorewall-masq"
-################################################################################################################
-#INTERFACE:DEST		SOURCE		ADDRESS		PROTO	PORT(S)	IPSEC	MARK	USER/	SWITCH	ORIGINAL
-#											GROUP		DEST
-eth0			10.0.0.0/8,\
-			169.254.0.0/16,\
-			172.16.0.0/12,\
-			192.168.0.0/16

Shorewall/Samples/three-interfaces/shorewall.conf

@@ -55,11 +55,11 @@ LOGALLNEW=
 
 LOGFILE=/var/log/messages
 
-LOGFORMAT="Shorewall:%s:%s:"
+LOGFORMAT="%s %s "
 
 LOGTAGONLY=No
 
-LOGLIMIT=
+LOGLIMIT="s:1/sec:10"
 
 MACLIST_LOG_LEVEL=info
 
@@ -83,7 +83,7 @@ UNTRACKED_LOG_LEVEL=
 
 ARPTABLES=
 
-CONFIG_PATH=${CONFDIR}/shorewall:${SHAREDIR}/shorewall
+CONFIG_PATH="${CONFDIR}/shorewall:${SHAREDIR}/shorewall"
 
 GEOIPDIR=/usr/share/xt_geoip/LE
 
@@ -152,8 +152,6 @@ BASIC_FILTERS=No
 
 BLACKLIST="NEW,INVALID,UNTRACKED"
 
-CHAIN_SCRIPTS=No
-
 CLAMPMSS=Yes
 
 CLEAR_TC=Yes
@@ -301,5 +299,3 @@ PROVIDER_OFFSET=
 MASK_BITS=
 
 ZONE_BITS=0
-
-#LAST LINE -- DO NOT REMOVE

Shorewall/Samples/three-interfaces/snat

@@ -0,0 +1,23 @@
+#
+# Shorewall - Sample SNAT/Masqueradee File for three-interface configuration.
+# Copyright (C) 2006-2016 by the Shorewall Team
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# See the file README.txt for further details.
+#------------------------------------------------------------------------------
+# For information about entries in this file, type "man shorewall-snat"
+#
+# See http://shorewall.net/manpages/shorewall-snat.html for more information
+###########################################################################################################################################
+#ACTION			SOURCE			DEST            PROTO	PORT	IPSEC	MARK	USER	SWITCH	ORIGDEST	PROBABILITY
+#
+# Rules generated from masq file /home/teastep/shorewall/trunk/Shorewall/Samples/three-interfaces/masq by Shorewall 5.0.13-RC1 - Sat Oct 15 11:43:47 PDT 2016
+#
+MASQUERADE		10.0.0.0/8,\
+			169.254.0.0/16,\
+			172.16.0.0/12,\
+			192.168.0.0/16		eth0

Shorewall/Samples/two-interfaces/masq

@@ -1,19 +0,0 @@
-#
-# Shorewall - Sample Masq file for two-interface configuration.
-# Copyright (C) 2006-2015 by the Shorewall Team
-#
-# This library is free software; you can redistribute it and/or
-# modify it under the terms of the GNU Lesser General Public
-# License as published by the Free Software Foundation; either
-# version 2.1 of the License, or (at your option) any later version.
-#
-# See the file README.txt for further details.
-#------------------------------------------------------------------------------
-# For information about entries in this file, type "man shorewall-masq"
-################################################################################################################
-#INTERFACE:DEST		SOURCE		ADDRESS		PROTO	PORT(S)	IPSEC	MARK	USER/	SWITCH	ORIGINAL
-#											GROUP		DEST
-eth0			10.0.0.0/8,\
-			169.254.0.0/16,\
-			172.16.0.0/12,\
-			192.168.0.0/16

Shorewall/Samples/two-interfaces/shorewall.conf

@@ -58,11 +58,11 @@ LOGALLNEW=
 
 LOGFILE=/var/log/messages
 
-LOGFORMAT="Shorewall:%s:%s:"
+LOGFORMAT="%s %s "
 
 LOGTAGONLY=No
 
-LOGLIMIT=
+LOGLIMIT="s:1/sec:10"
 
 MACLIST_LOG_LEVEL=info
 
@@ -86,7 +86,7 @@ UNTRACKED_LOG_LEVEL=
 
 ARPTABLES=
 
-CONFIG_PATH=${CONFDIR}/shorewall:${SHAREDIR}/shorewall
+CONFIG_PATH="${CONFDIR}/shorewall:${SHAREDIR}/shorewall"
 
 GEOIPDIR=/usr/share/xt_geoip/LE
 
@@ -155,8 +155,6 @@ BASIC_FILTERS=No
 
 BLACKLIST="NEW,INVALID,UNTRACKED"
 
-CHAIN_SCRIPTS=No
-
 CLAMPMSS=Yes
 
 CLEAR_TC=Yes
@@ -304,5 +302,3 @@ PROVIDER_OFFSET=
 MASK_BITS=
 
 ZONE_BITS=0
-
-#LAST LINE -- DO NOT REMOVE

Shorewall/Samples/two-interfaces/snat

@@ -0,0 +1,23 @@
+#
+# Shorewall - Sample SNAT/Masqueradee File for two-interface configuration.
+# Copyright (C) 2006-2016 by the Shorewall Team
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# See the file README.txt for further details.
+#------------------------------------------------------------------------------
+# For information about entries in this file, type "man shorewall-snat"
+#
+# See http://shorewall.net/manpages/shorewall-snat.html for more information
+###########################################################################################################################################
+#ACTION			SOURCE			DEST            PROTO	PORT	IPSEC	MARK	USER	SWITCH	ORIGDEST	PROBABILITY
+#
+# Rules generated from masq file /home/teastep/shorewall/trunk/Shorewall/Samples/two-interfaces/masq by Shorewall 5.0.13-RC1 - Sat Oct 15 11:41:40 PDT 2016
+#
+MASQUERADE		10.0.0.0/8,\
+			169.254.0.0/16,\
+			172.16.0.0/12,\
+			92.168.0.0/16		eth0

Shorewall/configfiles/mangle

@@ -10,5 +10,5 @@
 # See http://shorewall.net/PacketMarking.html for a detailed description of
 # the Netfilter/Shorewall packet marking mechanism.
 #
-####################################################################################################################################################
-#ACTION		SOURCE		DEST		PROTO	DPORT	SPORT	USER	TEST	LENGTH	TOS	CONNBYTES	HELPER	PROBABILITY	DSCP
+##############################################################################################################################################################
+#ACTION		SOURCE		DEST		PROTO	DPORT	SPORT	USER	TEST	LENGTH	TOS	CONNBYTES	HELPER	PROBABILITY	DSCP	SWITCH

Shorewall/configfiles/shorewall.conf

@@ -47,11 +47,11 @@ LOGALLNEW=
 
 LOGFILE=/var/log/messages
 
-LOGFORMAT="Shorewall:%s:%s:"
+LOGFORMAT="%s %s "
 
 LOGTAGONLY=No
 
-LOGLIMIT=
+LOGLIMIT="s:1/sec:10"
 
 MACLIST_LOG_LEVEL=info
 
@@ -99,7 +99,7 @@ RESTOREFILE=restore
 
 SHOREWALL_SHELL=/bin/sh
 
-SUBSYSLOCK=/var/lock/subsys/shorewall
+SUBSYSLOCK=
 
 TC=
 
@@ -138,14 +138,12 @@ AUTOCOMMENT=Yes
 
 AUTOHELPERS=Yes
 
-AUTOMAKE=No
+AUTOMAKE=Yes
 
 BASIC_FILTERS=No
 
 BLACKLIST="NEW,INVALID,UNTRACKED"
 
-CHAIN_SCRIPTS=Yes
-
 CLAMPMSS=No
 
 CLEAR_TC=Yes
@@ -184,7 +182,7 @@ INLINE_MATCHES=No
 
 IPSET_WARNINGS=Yes
 
-IP_FORWARDING=On
+IP_FORWARDING=Keep
 
 KEEP_RT_TABLES=No
 
@@ -210,7 +208,7 @@ MUTEX_TIMEOUT=60
 
 NULL_ROUTE_RFC1918=No
 
-OPTIMIZE=0
+OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 

Shorewall/configfiles/snat

@@ -0,0 +1,9 @@
+#
+# Shorewall -- /etc/shorewall/snat
+#
+# For information about entries in this file, type "man shorewall-snat"
+#
+# See http://shorewall.net/manpages/shorewall-snat.html for more information
+#
+###########################################################################################################################################
+#ACTION			SOURCE			DEST		PROTO	PORT	IPSEC	MARK	USER	SWITCH	ORIGDEST	PROBABILITY

Shorewall/install.sh

@@ -103,7 +103,7 @@ require()
 
 cd "$(dirname $0)"
 
-if [ -f shorewall ]; then
+if [ -f shorewall.service ]; then
     PRODUCT=shorewall
     Product=Shorewall
 else
@@ -381,9 +381,9 @@ fi
 echo "Installing $Product Version $VERSION"
 
 #
-# Check for /sbin/$PRODUCT
+# Check for /usr/share/$PRODUCT/version
 #
-if [ -f ${DESTDIR}${SBINDIR}/$PRODUCT ]; then
+if [ -f ${DESTDIR}${SHAREDIR}/$PRODUCT/version ]; then
     first_install=""
 else
     first_install="Yes"
@@ -394,10 +394,6 @@ if [ -z "${DESTDIR}" -a $PRODUCT = shorewall -a ! -f ${SHAREDIR}/$PRODUCT/coreve
     exit 1
 fi
 
-install_file $PRODUCT ${DESTDIR}${SBINDIR}/$PRODUCT 0755
-[ $SHAREDIR = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SBINDIR}/${PRODUCT}
-echo "$PRODUCT control program installed in ${DESTDIR}${SBINDIR}/$PRODUCT"
-
 #
 # Install the Firewall Script
 #
@@ -468,6 +464,7 @@ if [ -z "$first_install" ]; then
 	delete_file ${DESTDIR}/usr/share/shorewall6/lib.cli
 	delete_file ${DESTDIR}/usr/share/shorewall6/lib.common
 	delete_file ${DESTDIR}/usr/share/shorewall6/wait4ifup
+	delete_file ${DESTDIR}/${SBINDIR}/shorewall6
     fi
 
     delete_file ${DESTDIR}/usr/share/$PRODUCT/prog.header6
@@ -696,17 +693,15 @@ if [ -z "$SPARSE" -a ! -f ${DESTDIR}${CONFDIR}/$PRODUCT/maclist ]; then
     echo "mac list file installed as ${DESTDIR}${CONFDIR}/$PRODUCT/maclist"
 fi
 
-if [ -f masq ]; then
-    #
-    # Install the Masq file
-    #
-    run_install $OWNERSHIP -m 0644 masq           ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles
-    run_install $OWNERSHIP -m 0644 masq.annotated ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles
+#
+# Install the SNAT file
+#
+run_install $OWNERSHIP -m 0644 snat           ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles
+run_install $OWNERSHIP -m 0644 snat.annotated ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles
 
-    if [ -z "$SPARSE" -a ! -f ${DESTDIR}${CONFDIR}/$PRODUCT/masq ]; then
-	run_install $OWNERSHIP -m 0600 masq${suffix} ${DESTDIR}${CONFDIR}/$PRODUCT/masq
-	echo "Masquerade file installed as ${DESTDIR}${CONFDIR}/$PRODUCT/masq"
-    fi
+if [ -z "$SPARSE" -a ! -f ${DESTDIR}${CONFDIR}/$PRODUCT/snat ]; then
+    run_install $OWNERSHIP -m 0600 snat${suffix} ${DESTDIR}${CONFDIR}/$PRODUCT/snat
+    echo "SNAT file installed as ${DESTDIR}${CONFDIR}/$PRODUCT/snat"
 fi
 
 if [ -f arprules ]; then
@@ -1106,7 +1101,6 @@ if [ $PRODUCT = shorewall6 ]; then
     # Symbolically link 'functions' to lib.base
     #
     ln -sf lib.base ${DESTDIR}${SHAREDIR}/$PRODUCT/functions
-    [ $SHAREDIR = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/${PRODUCT}/lib.base
 fi
 
 if [ -d Perl ]; then
@@ -1181,7 +1175,7 @@ if [ -n "$MANDIR" ]; then
 
 cd manpages
 
-[ -n "$INSTALLD" ] || mkdir -p ${DESTDIR}${MANDIR}/man5/ ${DESTDIR}${MANDIR}/man8/
+[ -n "$INSTALLD" ] || mkdir -p ${DESTDIR}${MANDIR}/man5/
 
 for f in *.5; do
     gzip -9c $f > $f.gz
@@ -1189,11 +1183,15 @@ for f in *.5; do
     echo "Man page $f.gz installed to ${DESTDIR}${MANDIR}/man5/$f.gz"
 done
 
-for f in *.8; do
+if [ $PRODUCT = shorewall ]; then
+    [ -n "$INSTALLD" ] || mkdir -p ${DESTDIR}${MANDIR}/man5/
+
+    for f in *.8; do
 	gzip -9c $f > $f.gz
 	run_install $INSTALLD  -m 0644 $f.gz ${DESTDIR}${MANDIR}/man8/$f.gz
 	echo "Man page $f.gz installed to ${DESTDIR}${MANDIR}/man8/$f.gz"
-done
+    done
+fi
 
 cd ..
 

Shorewall/lib.cli-std

@@ -48,10 +48,10 @@ get_config() {
     fi
 
     if [ "$(id -u)" -eq 0 ]; then
-	config=$(find_file $g_program.conf)
+	config=$(find_file ${PRODUCT}.conf)
     else
-	[ -n "$g_shorewalldir" ] || fatal_error "Ordinary users may not $COMMAND the $CONFDIR/$g_program configuration"
-	config="$g_shorewalldir/$g_program.conf"
+	[ -n "$g_shorewalldir" ] || fatal_error "Ordinary users may not $COMMAND the $CONFDIR/$PRODUCT configuration"
+	config="$g_shorewalldir/$PRODUCT.conf"
     fi
 
     if [ -f $config ]; then
@@ -155,7 +155,7 @@ get_config() {
 	if [ "$2" = Yes ]; then
 	    case $STARTUP_ENABLED in
 		No|no|NO)
-		    not_configured_error "$g_product startup is disabled. To enable startup, set STARTUP_ENABLED=Yes in ${g_confdir}/${g_program}.conf"
+		    not_configured_error "$g_product startup is disabled. To enable startup, set STARTUP_ENABLED=Yes in ${g_confdir}/${PRODUCT}.conf"
 		    ;;
 		Yes|yes|YES)
 		    ;;
@@ -318,6 +318,7 @@ get_config() {
 
     [ -n "$PAGER" ] || PAGER=$DEFAULT_PAGER
 
+    if [ -z "$g_nopager" ]; then
 	if [ -n "$PAGER" -a -t 1 ]; then
 	    case $PAGER in
 		/*)
@@ -334,6 +335,7 @@ get_config() {
 
 	    g_pager="| $g_pager"
 	fi
+    fi
 
     if [ -n "$DYNAMIC_BLACKLIST" ]; then
 	setup_dbl
@@ -395,8 +397,8 @@ compiler() {
     pc=${LIBEXECDIR}/shorewall/compiler.pl
 
     if [ $(id -u) -ne 0 ]; then
-	if [ -z "$g_shorewalldir" -o "$g_shorewalldir" = $CONFDIR/$g_program ]; then
-	    startup_error "Ordinary users may not $COMMAND the $CONFDIR/$g_program configuration"
+	if [ -z "$g_shorewalldir" -o "$g_shorewalldir" = $CONFDIR/$PRODUCT ]; then
+	    startup_error "Ordinary users may not $COMMAND the $CONFDIR/$PRODUCT configuration"
 	fi
     fi
     #
@@ -1417,6 +1419,7 @@ remote_reload_command() # $* = original arguments less the command.
     sharedir=${SHAREDIR}
     local litedir
     local exitstatus
+    local program
 
     while [ $finished -eq 0 -a $# -gt 0 ]; do
 	option=$1
@@ -1493,12 +1496,17 @@ remote_reload_command() # $* = original arguments less the command.
 	sbindir="$SBINDIR"
 	confdir="$CONFDIR"
 	libexec="$LIBEXECDIR"
+	litedir="${VARDIR}-lite"
 	. $sharedir/shorewall/shorewallrc
     else
-	error_message "   WARNING: $g_shorewalldir/shorewallrc does not exist; using settings from $SHAREDIR/shorewall" >&2
+	error_message "   WARNING: $g_shorewalldir/shorewallrc does not exist; using settings from $g_basedir/shorewalrc" >&2
+	sbindir="$SBINDIR"
+	confdir="$CONFDIR"
+	libexec="$LIBEXECDIR"
+	litedir="${VARDIR}-lite"
     fi
 
-    if [ -f $g_shorewalldir/${g_program}.conf ]; then
+    if [ -f $g_shorewalldir/${PRODUCT}.conf ]; then
 	if [ -f $g_shorewalldir/params ]; then
 	    . $g_shorewalldir/params
 	fi
@@ -1514,7 +1522,7 @@ remote_reload_command() # $* = original arguments less the command.
 	    [ -n "$system" ] || fatal_error "No system name given and the FIREWALL option is not set"
 	fi
     else
-	fatal_error "$g_shorewalldir/$g_program.conf does not exist"
+	fatal_error "$g_shorewalldir/$PRODUCT.conf does not exist"
     fi
 
     if [ -z "$getcaps" ]; then
@@ -1538,13 +1546,23 @@ remote_reload_command() # $* = original arguments less the command.
     file=$(resolve_file $g_shorewalldir/firewall)
 
     g_export=Yes
+    #
+    # Determine the remote CLI program
+    #
+    temp=$(rsh_command /bin/ls $sbindir/${PRODUCT}-lite 2> /dev/null)
 
-    temp=$(rsh_command ${g_program}-lite show config 2> /dev/null | grep ^LITEDIR | sed 's/LITEDIR is //')
+    if [ -n "$temp" ]; then
+	program=$sbindir/${PRODUCT}-lite
+    else
+	program="$sbindir/shorewall $g_options"
+    fi
+    #
+    # Handle nonstandard remote VARDIR
+    #
+    temp=$(rsh_command $program show config 2> /dev/null | grep ^LITEDIR | sed 's/LITEDIR is //')
  
     [ -n "$temp" ] && litedir="$temp"
 
-    [ -n "$litedir" ] || litedir=${VARLIB}/${g_program}-lite
-
     g_file="$g_shorewalldir/firewall"
 
     exitstatus=0
@@ -1555,30 +1573,29 @@ remote_reload_command() # $* = original arguments less the command.
 	    save=$(find_file save);
 
 	    if [ -f $save ]; then
-		progress_message3 "Copying $save to ${system}:${confdir}/${g_program}-lite/"
-		rcp_command $save ${confdir}/shorewall-lite/
+		progress_message3 "Copying $save to ${system}:${confdir}/${PRODUCT}-lite/"
+		rcp_command $save ${confdir}/$PRODUCT/
 		exitstatus=$?
 	    fi
 
 	    if [ $exitstatus -eq 0 ]; then
-
 		progress_message3 "Copy complete"
 
 		if [ $COMMAND = remote-reload ]; then
-		    if rsh_command "${sbindir}/${g_program}-lite $g_debugging $verbose $timestamp reload"; then
+		    if rsh_command "$program $g_debugging $verbose $timestamp reload"; then
 			progress_message3 "System $system reloaded"
 		    else
 			exitstatus=$?
 			savit=
 		    fi
 		elif [ $COMMAND = remote-restart ]; then
-		    if rsh_command "${sbindir}/${g_program}-lite $g_debugging $verbose $timestamp restart"; then
+		    if rsh_command "$program $g_debugging $verbose $timestamp restart"; then
 			progress_message3 "System $system restarted"
 		    else
 			exitstatus=$?
 			saveit=
 		    fi
-		elif rsh_command "${sbindir}/${g_program}-lite $g_debugging $verbose $timestamp start"; then
+		elif rsh_command "$program $g_debugging $verbose $timestamp start"; then
 		    progress_message3 "System $system started"
 		else
 		    exitstatus=$?
@@ -1586,7 +1603,7 @@ remote_reload_command() # $* = original arguments less the command.
 		fi
 
 		if [ -n "$saveit" ]; then
-		    if rsh_command "${sbindir}/${g_program}-lite $g_debugging $verbose $timestamp save"; then
+		    if rsh_command "$program $g_debugging $verbose $timestamp save"; then
 			progress_message3 "Configuration on system $system saved"
 		    else
 			exitstatus=$?
@@ -1651,7 +1668,7 @@ export_command() # $* = original arguments less the command.
 	    target=$2
 	    ;;
 	*)
-	    fatal_error "Invalid command syntax (\"man $g_program\" for help)"
+	    fatal_error "Invalid command syntax (\"man shorewall\" for help)"
 	    ;;
     esac
 

Shorewall/manpages/shorewall-actions.xml

@@ -154,6 +154,20 @@
               </listitem>
             </varlistentry>
 
+            <varlistentry>
+              <term><option>nat</option></term>
+
+              <listitem>
+                <para>Added in Shorewall 5.0.13. Specifies that this action is
+                to be used in <ulink
+                url="shorewall-snat.html">shorewall-snat(5)</ulink> rather
+                than <ulink
+                url="shorewall-rules.html">shorewall-rules(5)</ulink>. The
+                <option>mangle</option> and <option>nat</option> options are
+                mutually exclusive.</para>
+              </listitem>
+            </varlistentry>
+
             <varlistentry>
               <term><option>noinline</option></term>
 

Shorewall/manpages/shorewall-conntrack.xml

@@ -380,7 +380,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>SOURCE (format 3) ‒
+        <term>SOURCE (format 3 prior to Shorewall 5.1.0) ‒
         {-|<emphasis>interface</emphasis>[:<emphasis>address-list</emphasis>]|<replaceable>address-list</replaceable>}</term>
 
         <listitem>
@@ -394,7 +394,91 @@
       </varlistentry>
 
       <varlistentry>
-        <term>DEST ‒
+        <term><emphasis role="bold">SOURCE (format 3 on Shorewall 5.1.0 and
+        later) -
+        {-|[<replaceable>source-spec</replaceable>[,...]]}</emphasis></term>
+
+        <listitem>
+          <para>where <replaceable>source-spec</replaceable> is one of the
+          following:</para>
+
+          <variablelist>
+            <varlistentry>
+              <term><replaceable>interface</replaceable></term>
+
+              <listitem>
+                <para>Where interface is the logical name of an interface
+                defined in <ulink
+                url="shorewall-interfaces.html">shorewall-interface</ulink>(5).</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>]</term>
+
+              <listitem>
+                <para>where <replaceable>address</replaceable> may be:</para>
+
+                <itemizedlist>
+                  <listitem>
+                    <para>A host or network IP address.</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>A MAC address in Shorewall format (preceded by a
+                    tilde ("~") and using dash ("-") as a separator.</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>The name of an ipset preceded by a plus sign ("+").
+                    See <ulink
+                    url="shorewall-ipsets.html">shorewall-ipsets</ulink>(5).</para>
+                  </listitem>
+                </itemizedlist>
+
+                <para><replaceable>exclusion</replaceable> is described in
+                <ulink
+                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5).</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>interface</replaceable>:<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>]</term>
+
+              <listitem>
+                <para>This form combines the preceding two and requires that
+                both the incoming interace and source address match.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>exclusion</replaceable></term>
+
+              <listitem>
+                <para>See <ulink
+                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>
+                (5)</para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
+
+          <para>Beginning with Shorewall 5.1.0, multiple
+          <replaceable>source-spec</replaceable>s separated by commas may be
+          specified provided that the following alternative forms are
+          used:</para>
+
+          <blockquote>
+            <para>(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
+
+            <para><replaceable>interface</replaceable>:(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
+
+            <para>(<replaceable>exclusion</replaceable>)</para>
+          </blockquote>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>DEST (Prior to Shorewall 5.1.0) ‒
         {-|<emphasis>interface</emphasis>[:<emphasis>address-list</emphasis>]|<replaceable>address-list</replaceable>}</term>
 
         <listitem>
@@ -406,6 +490,89 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><emphasis role="bold">DEST (Shorewall 5.1.0 and later) -
+        {-|<replaceable>dest-spec</replaceable>[,...]}</emphasis></term>
+
+        <listitem>
+          <para>where <replaceable>dest-spec</replaceable> is one of the
+          following:</para>
+
+          <variablelist>
+            <varlistentry>
+              <term><replaceable>interface</replaceable></term>
+
+              <listitem>
+                <para>Where interface is the logical name of an interface
+                defined in <ulink
+                url="shorewall-interfaces.html">shorewall-interface</ulink>(5).</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>]</term>
+
+              <listitem>
+                <para>where <replaceable>address</replaceable> may be:</para>
+
+                <itemizedlist>
+                  <listitem>
+                    <para>A host or network IP address.</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>A MAC address in Shorewall format (preceded by a
+                    tilde ("~") and using dash ("-") as a separator.</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>The name of an ipset preceded by a plus sign ("+").
+                    See <ulink
+                    url="shorewall-ipsets.html">shorewall-ipsets</ulink>(5).</para>
+                  </listitem>
+                </itemizedlist>
+
+                <para><replaceable>exclusion</replaceable> is described in
+                <ulink
+                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5).</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>interface</replaceable>:<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>]</term>
+
+              <listitem>
+                <para>This form combines the preceding two and requires that
+                both the outgoing interace and destination address
+                match.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>exclusion</replaceable></term>
+
+              <listitem>
+                <para>See <ulink
+                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>
+                (5)</para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
+
+          <para>Beginning with Shorewall 5.1.0, multiple source-specs
+          separated by commas may be specified provided that the following
+          alternative forms are used:</para>
+
+          <blockquote>
+            <para>(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
+
+            <para><replaceable>interface</replaceable>:(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
+
+            <para>(<replaceable>exclusion</replaceable>)</para>
+          </blockquote>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term>PROTO ‒
         <replaceable>protocol-name-or-number</replaceable>[,...]</term>

Shorewall/manpages/shorewall-mangle.xml

@@ -775,98 +775,253 @@ Normal-Service       =&gt; 0x00</programlisting>
       </varlistentry>
 
       <varlistentry>
-        <term><emphasis role="bold">SOURCE</emphasis> - {<emphasis
-        role="bold">-</emphasis>|{<emphasis>interface</emphasis>|<emphasis
-        role="bold">$FW</emphasis>}|[{<emphasis>interface</emphasis>|<emphasis
-        role="bold">$FW</emphasis>}:]<emphasis>address-or-range</emphasis>[<emphasis
-        role="bold">,</emphasis><emphasis>address-or-range</emphasis>]...}[<emphasis>exclusion</emphasis>]</term>
+        <term><emphasis role="bold">SOURCE -
+        {-|<replaceable>source-spec</replaceable>[,...]}</emphasis></term>
 
         <listitem>
-          <para>May be:</para>
+          <para>where <replaceable>source-spec</replaceable> is one of:</para>
 
-          <orderedlist>
-            <listitem>
-              <para>An interface name - matches traffic entering the firewall
-              on the specified interface. May not be used in classify rules or
-              in rules using the :T chain qualifier.</para>
-            </listitem>
+          <variablelist>
+            <varlistentry>
+              <term><replaceable>interface</replaceable></term>
 
               <listitem>
-              <para>A comma-separated list of host or network IP addresses or
-              MAC addresses. <emphasis role="bold">This form will not match
-              traffic that originates on the firewall itself unless either
-              &lt;major&gt;&lt;minor&gt; or the :T chain qualifier is used in
-              the ACTION column.</emphasis></para>
-
-              <para>Examples:<simplelist>
-                  <member>0.0.0.0/0</member>
-                </simplelist></para>
-
-              <para><simplelist>
-                  <member>192.168.1.0/24, 172.20.4.0/24</member>
-                </simplelist></para>
-            </listitem>
-
-            <listitem>
-              <para>An interface name followed by a colon (":") followed by a
-              comma-separated list of host or network IP addresses or MAC
-              addresses. May not be used in classify rules or in rules using
+                <para>where <replaceable>interface</replaceable> is the
+                logical name of an interface defined in <ulink
+                url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5).
+                Matches packets entering the firewall from the named
+                interface. May not be used in CLASSIFY rules or in rules using
                 the :T chain qualifier.</para>
               </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>]</term>
 
               <listitem>
-              <para>$FW optionally followed by a colon (":") and a
-              comma-separated list of host or network IP addresses. Matches
-              packets originating on the firewall. May not be used with a
-              chain qualifier (:P, :F, etc.) in the ACTION column.</para>
+                <para>where <replaceable>address</replaceable> is:</para>
+
+                <blockquote>
+                  <para>A host or network IP address.</para>
+
+                  <para>The name of an ipset preceded by a plus sign
+                  ("+").</para>
+
+                  <para>A MAC address in Shorewall format (preceded by a tilde
+                  ("~") and using dash ("-") as a separator (e.g.,
+                  ~00-A0-C9-15-39-78).</para>
+                </blockquote>
+
+                <para>Matches traffic whose source IP address matches one of
+                the listed addresses and that does not match an address listed
+                in the <replaceable>exclusion</replaceable> (see <ulink
+                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
+
+                <para><emphasis role="bold">This form will not match traffic
+                that originates on the firewall itself unless either
+                &lt;major&gt;&lt;minor&gt; or the :T chain qualifier is used
+                in the ACTION column.</emphasis></para>
               </listitem>
-          </orderedlist>
+            </varlistentry>
 
-          <para>MAC addresses must be prefixed with "~" and use "-" as a
-          separator.</para>
+            <varlistentry>
+              <term><replaceable>interface</replaceable>:<replaceable>address</replaceable>,[...][<replaceable>exclusion</replaceable>]</term>
 
-          <para>Example: ~00-A0-C9-15-39-78</para>
+              <listitem>
+                <para>This form combines the preceding two forms and matches
+                when both the incoming interface and source IP address
+                match.</para>
+              </listitem>
+            </varlistentry>
 
-          <para>You may exclude certain hosts from the set already defined
-          through use of an <emphasis>exclusion</emphasis> (see <ulink
+            <varlistentry>
+              <term><replaceable>interface</replaceable>:<replaceable>exclusion</replaceable></term>
+
+              <listitem>
+                <para>This form matches packets arriving through the named
+                <replaceable>interface</replaceable> and whose source IP
+                address does not match any of the addresses in the
+                <replaceable>exclusion</replaceable>.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>$FW</term>
+
+              <listitem>
+                <para>Matches packets originating on the firewall system. May
+                not be used with a chain qualifier (:P, :F, etc.) in the
+                ACTION column.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>$FW:<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>]</term>
+
+              <listitem>
+                <para>where <replaceable>address</replaceable> is as above
+                (MAC addresses are not permitted). Matches packets originating
+                on the firewall and whose source IP address matches one of the
+                listed addresses and does not match any address listed in the
+                <replaceable>exclusion</replaceable>. May not be used with a
+                chain qualifier (:P, :F, etc.) in the ACTION column. </para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>$FW:<replaceable>exclusion</replaceable></term>
+
+              <listitem>
+                <para>Matches traffic originating on the firewall, provided
+                that the source IP address does not match any address listed
+                in the <replaceable>exclusion</replaceable>.</para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
+
+          <para>Beginning with Shorewall 5.1.0, multiple
+          <replaceable>source_spec</replaceable>s, separated by commas, may be
+          given provided that the following alternative forms are used:</para>
+
+          <blockquote>
+            <para>(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
+
+            <para><replaceable>interface</replaceable>:(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
+
+            <para><replaceable>interface</replaceable>:(<replaceable>exclusion</replaceable>)</para>
+
+            <para>$FW:(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
+
+            <para>$FW:(<replaceable>exclusion</replaceable>)</para>
+          </blockquote>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">DEST -
+        {-|<replaceable>dest-spec</replaceable>[,...]}</emphasis></term>
+
+        <listitem>
+          <para>where <replaceable>dest-spec</replaceable> is one of:</para>
+
+          <variablelist>
+            <varlistentry>
+              <term><replaceable>interface</replaceable></term>
+
+              <listitem>
+                <para>where <replaceable>interface</replaceable> is the
+                logical name of an interface defined in <ulink
+                url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5).
+                Matches packets leaving the firewall through the named
+                interface. May not be used in the PREROUTING chain (:P in the
+                mark column or no chain qualifier and MARK_IN_FORWARD_CHAIN=No
+                in <ulink url="manpages/shorewall.conf">shorewall.conf</ulink>
+                (5)).</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>]</term>
+
+              <listitem>
+                <para>where <replaceable>address</replaceable> is:</para>
+
+                <blockquote>
+                  <para>A host or network IP address.</para>
+
+                  <para>The name of an ipset preceded by a plus sign
+                  ("+").</para>
+
+                  <para>A MAC address in Shorewall format (preceded by a tilde
+                  ("~") and using dash ("-") as a separator (e.g.,
+                  ~00-A0-C9-15-39-78).</para>
+                </blockquote>
+
+                <para>Matches traffic whose destination IP address matches one
+                of the listed addresses and that does not match an address
+                listed in the <replaceable>exclusion</replaceable> (see <ulink
                 url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
               </listitem>
             </varlistentry>
 
             <varlistentry>
-        <term><emphasis role="bold">DEST</emphasis> - {<emphasis
-        role="bold">-</emphasis>|{<emphasis>interface</emphasis>|$FW}|[<emphasis>{interface</emphasis>|$FW}:]<emphasis>address-or-range</emphasis>[<emphasis
-        role="bold">,</emphasis><emphasis>address-or-range</emphasis>]...}[<emphasis>exclusion</emphasis>]</term>
+              <term><replaceable>interface</replaceable>:<replaceable>address</replaceable>,[...][<replaceable>exclusion</replaceable>]</term>
 
               <listitem>
-          <para>May be:</para>
-
-          <orderedlist>
-            <listitem>
-              <para>An interface name. May not be used in the PREROUTING chain
-              (:P in the mark column or no chain qualifier and
-              MARK_IN_FORWARD_CHAIN=No in <ulink
-              url="manpages/shorewall.conf">shorewall.conf</ulink> (5)). The
-              interface name may be optionally followed by a colon (":") and
-              an IP address list.</para>
+                <para>This form combines the preceding two forms and matches
+                when both the outgoing interface and destination IP address
+                match. May not be used in the PREROUTING chain (:P in the mark
+                column or no chain qualifier and MARK_IN_FORWARD_CHAIN=No in
+                <ulink url="manpages/shorewall.conf">shorewall.conf</ulink>
+                (5)).</para>
               </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>interface</replaceable>:<replaceable>exclusion</replaceable></term>
 
               <listitem>
-              <para>A comma-separated list of host or network IP addresses.
-              The list may include ip address ranges if your kernel and
-              iptables include iprange support.</para>
+                <para>This form matches packets leaving through the named
+                <replaceable>interface</replaceable> and whose destination IP
+                address does not match any of the addresses in the
+                <replaceable>exclusion</replaceable>. May not be used in the
+                PREROUTING chain (:P in the mark column or no chain qualifier
+                and MARK_IN_FORWARD_CHAIN=No in <ulink
+                url="manpages/shorewall.conf">shorewall.conf</ulink>
+                (5)).</para>
               </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>$FW</term>
 
               <listitem>
-              <para>Beginning with Shorewall 4.4.13, $FW may be specified by
-              itself or qualified by an address list. This causes marking to
-              occur in the INPUT chain.</para>
+                <para>Matches packets originating on the firewall system. May
+                not be used with a chain qualifier (:P, :F, etc.) in the
+                ACTION column.</para>
               </listitem>
-          </orderedlist>
+            </varlistentry>
 
-          <para>You may exclude certain hosts from the set already defined
-          through use of an <emphasis>exclusion</emphasis> (see <ulink
-          url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
+            <varlistentry>
+              <term>$FW:<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>]</term>
+
+              <listitem>
+                <para>where <replaceable>address</replaceable> is as above
+                (MAC addresses are not permitted). Matches packets destined
+                for the firewall and whose destination IP address matches one
+                of the listed addresses and does not match any address listed
+                in the <replaceable>exclusion</replaceable>. May not be used
+                with a chain qualifier (:P, :F, etc.) in the ACTION
+                column.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>$FW:<replaceable>exclusion</replaceable></term>
+
+              <listitem>
+                <para>Matches traffic destined for the firewall, provided that
+                the destination IP address does not match any address listed
+                in the <replaceable>exclusion</replaceable>.</para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
+
+          <para>Beginning with Shorewall 5.1.0, multiple
+          <replaceable>dest_spec</replaceable>s, separated by commas, may be
+          given provided that the following alternative forms are used:</para>
+
+          <blockquote>
+            <para>(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
+
+            <para><replaceable>interface</replaceable>:(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
+
+            <para><replaceable>interface</replaceable>:(<replaceable>exclusion</replaceable>)</para>
+
+            <para>$FW:(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
+
+            <para>$FW:(<replaceable>exclusion</replaceable>)</para>
+          </blockquote>
         </listitem>
       </varlistentry>
 
@@ -1332,6 +1487,53 @@ Normal-Service       =&gt; 0x00</programlisting>
           </variablelist>
         </listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">SWITCH -
+        [!]<replaceable>switch-name</replaceable>[={0|1}]</emphasis></term>
+
+        <listitem>
+          <para>Added in Shorewall 5.1.0 and allows enabling and disabling the
+          rule without requiring <command>shorewall restart</command>.</para>
+
+          <para>The rule is enabled if the value stored in
+          <filename>/proc/net/nf_condition/<replaceable>switch-name</replaceable></filename>
+          is 1. The rule is disabled if that file contains 0 (the default). If
+          '!' is supplied, the test is inverted such that the rule is enabled
+          if the file contains 0.</para>
+
+          <para>Within the <replaceable>switch-name</replaceable>, '@0' and
+          '@{0}' are replaced by the name of the chain to which the rule is a
+          added. The <replaceable>switch-name</replaceable> (after '@...'
+          expansion) must begin with a letter and be composed of letters,
+          decimal digits, underscores or hyphens. Switch names must be 30
+          characters or less in length.</para>
+
+          <para>Switches are normally <emphasis role="bold">off</emphasis>. To
+          turn a switch <emphasis role="bold">on</emphasis>:</para>
+
+          <simplelist>
+            <member><command>echo 1 &gt;
+            /proc/net/nf_condition/<replaceable>switch-name</replaceable></command></member>
+          </simplelist>
+
+          <para>To turn it <emphasis role="bold">off</emphasis> again:</para>
+
+          <simplelist>
+            <member><command>echo 0 &gt;
+            /proc/net/nf_condition/<replaceable>switch-name</replaceable></command></member>
+          </simplelist>
+
+          <para>Switch settings are retained over <command>shorewall
+          restart</command>.</para>
+
+          <para>When the <replaceable>switch-name</replaceable> is followed by
+          <option>=0</option> or <option>=1</option>, then the switch is
+          initialized to off or on respectively by the
+          <command>start</command> command. Other commands do not affect the
+          switch setting.</para>
+        </listitem>
+      </varlistentry>
     </variablelist>
   </refsect1>
 

Shorewall/manpages/shorewall-masq.xml

@@ -25,8 +25,10 @@
   <refsect1>
     <title>Description</title>
 
-    <para>Use this file to define dynamic NAT (Masquerading) and to define
-    Source NAT (SNAT).</para>
+    <para>This file is used to define dynamic NAT (Masquerading) and to define
+    Source NAT (SNAT). While still supported, its use is deprecated in favor
+    of <ulink url="shorewall-snat.html">shorewall-snat</ulink>(5) which was
+    introduced in Shorewall 5.0.14.</para>
 
     <warning>
       <para>The entries in this file are order-sensitive. The first entry that
@@ -162,7 +164,7 @@
       <varlistentry>
         <term><emphasis role="bold">ADDRESS</emphasis> (Optional) - [<emphasis
         role="bold">-</emphasis>|<emphasis
-        role="bold">NONAT</emphasis>|[<emphasis>address-or-address-range</emphasis>[,<emphasis>address-or-address-range</emphasis>]...][:<emphasis>lowport</emphasis><emphasis
+        role="bold">NONAT</emphasis>|[<emphasis>address-or-address-range</emphasis>][:<emphasis>lowport</emphasis><emphasis
         role="bold">-</emphasis><emphasis>highport</emphasis>][<emphasis
         role="bold">:random</emphasis>][:persistent]|<emphasis
         role="bold">detect</emphasis>|<emphasis
@@ -682,7 +684,7 @@
        #INTERFACE SOURCE         ADDRESS     ...
        eth0       192.168.1.0/24 1.1.1.1 ; mark=1:C
        eth0       192.168.1.0/24 1.1.1.3 ; mark=2:C
-       eth0       192.168.1.0/24 1.1.1.4 ; mark=3:C</programlisting>
+       eth0       192.168.1.0/24 1.1.1.9 ; mark=3:C</programlisting>
         </listitem>
       </varlistentry>
 

Shorewall/manpages/shorewall-rules.xml

@@ -629,7 +629,7 @@
 
             <varlistentry>
               <term><emphasis
-              role="bold">NFQUEUE</emphasis>[([<replaceable>queuenumber</replaceable>1[:<replaceable>queuenumber2</replaceable>][,bypass]]|bypass)]</term>
+              role="bold">NFQUEUE</emphasis>[([<replaceable>queuenumber</replaceable>1[:<replaceable>queuenumber2</replaceable>[c]][,bypass]]|bypass)]</term>
 
               <listitem>
                 <para>Queues the packet to a user-space application using the
@@ -648,12 +648,19 @@
                 systems: start multiple instances of the userspace program on
                 queues x, x+1, .. x+n and use "x:x+n". Packets belonging to
                 the same connection are put into the same nfqueue.</para>
+
+                <para>Beginning with Shorewall 5.1.0, queuenumber2 may be
+                followed by the letter 'c' to indicate that the CPU ID will be
+                used as an index to map packets to the queues. The idea is
+                that you can improve performance if there's a queue per CPU.
+                Requires the NFQUEUE CPU Fanout capability in your kernel and
+                iptables.</para>
               </listitem>
             </varlistentry>
 
             <varlistentry>
               <term><emphasis role="bold"><emphasis
-              role="bold">NFQUEUE!</emphasis>[([<replaceable>queuenumber1</replaceable>[,<replaceable>queuenumber2</replaceable>][,bypass]]|bypass)]</emphasis></term>
+              role="bold">NFQUEUE!</emphasis>[([<replaceable>queuenumber1</replaceable>[:<replaceable>queuenumber2</replaceable>[c]][,bypass]]|bypass)]</emphasis></term>
 
               <listitem>
                 <para>like NFQUEUE but exempts the rule from being suppressed
@@ -900,108 +907,199 @@
       </varlistentry>
 
       <varlistentry>
-        <term><emphasis role="bold">SOURCE</emphasis> -
-        {<emphasis>zone</emphasis>|<emphasis>zone-list</emphasis>[+]|{<emphasis
-        role="bold">all</emphasis>|<emphasis
-        role="bold">any</emphasis>}[<emphasis
-        role="bold">+</emphasis>][<emphasis
-        role="bold">-</emphasis>]}<emphasis
-        role="bold">[:</emphasis><emphasis>interface</emphasis>][<emphasis
-        role="bold">:</emphasis>{<emphasis>address-or-range</emphasis>[,<emphasis>address-or-range</emphasis>]...[<emphasis>exclusion</emphasis>]|<emphasis>exclusion</emphasis>|<emphasis
-        role="bold">+</emphasis><emphasis>ipset</emphasis>|<replaceable>^countrycode-list</replaceable>}</term>
+        <term><emphasis role="bold">SOURCE -
+        <replaceable>source-spec</replaceable>[,...]</emphasis></term>
 
         <listitem>
-          <para>Source hosts to which the rule applies. May be a
-          <replaceable>zone</replaceable> declared in /etc/shorewall/zones,
-          <emphasis role="bold">$FW</emphasis> to indicate the firewall
-          itself, <emphasis role="bold">all</emphasis>, <emphasis
-          role="bold">all+</emphasis>, <emphasis role="bold">all-</emphasis>,
-          <emphasis role="bold">all+-</emphasis> or <emphasis
-          role="bold">none</emphasis>.</para>
+          <para>Source hosts to which the rule applies.</para>
 
-          <para>Beginning with Shorewall 4.4.13, you may use a
-          <replaceable>zone-list </replaceable>which consists of a
-          comma-separated list of zones declared in <ulink
-          url="/manpages/shorewall-zones.html">shorewall-zones</ulink> (5).
-          This <replaceable>zone-list</replaceable> may be optionally followed
-          by "+" to indicate that the rule is to apply to intra-zone traffic
-          as well as inter-zone traffic.</para>
+          <para><replaceable>source-spec</replaceable> is one of the
+          following:</para>
 
-          <para>When <emphasis role="bold">none</emphasis> is used either in
-          the <emphasis role="bold">SOURCE</emphasis> or <emphasis
-          role="bold">DEST</emphasis> column, the rule is ignored.</para>
+          <variablelist>
+            <varlistentry>
+              <term><emphasis
+              role="bold"><replaceable>zone</replaceable>[,...[+]]</emphasis></term>
 
-          <para><emphasis role="bold">all</emphasis> means "All Zones",
-          including the firewall itself. <emphasis role="bold">all-</emphasis>
-          means "All Zones, except the firewall itself". When <emphasis
-          role="bold">all</emphasis>[<emphasis role="bold">-</emphasis>] is
-          used either in the <emphasis role="bold">SOURCE</emphasis> or
-          <emphasis role="bold">DEST</emphasis> column intra-zone traffic is
-          not affected. When <emphasis role="bold">all+</emphasis>[<emphasis
-          role="bold">-</emphasis>] is "used, intra-zone traffic is affected.
-          Beginning with Shorewall 4.4.13, exclusion is supported -- see see
-          <ulink
-          url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5).</para>
+              <listitem>
+                <para>The name of a zone defined in <ulink
+                url="shorewall-zones.html">shorewall-zones</ulink>(5). When
+                only the zone name is specified, the packet source may be any
+                host in that zone.</para>
 
-          <para>Except when <emphasis role="bold">all</emphasis>[<emphasis
-          role="bold">+</emphasis>][<emphasis role="bold">-</emphasis>] or
-          <emphasis role="bold">any</emphasis>[<emphasis
-          role="bold">+</emphasis>][<emphasis role="bold">-</emphasis>] is
-          specified, clients may be further restricted to a list of networks
-          and/or hosts by appending ":" and a comma-separated list of network
-          and/or host addresses. Hosts may be specified by IP or MAC address;
-          mac addresses must begin with "~" and must use "-" as a
-          separator.</para>
+                <para>zone may also be one of the following:</para>
 
-          <para>The above restriction on <emphasis
-          role="bold">all</emphasis>[<emphasis
-          role="bold">+</emphasis>][<emphasis role="bold">-</emphasis>] and
-          <emphasis role="bold">any</emphasis>[<emphasis
-          role="bold">+</emphasis>][<emphasis role="bold">-</emphasis>] is
-          removed in Shorewall-4.4.13.</para>
+                <variablelist>
+                  <varlistentry>
+                    <term>all[+][-]</term>
 
-          <para><emphasis role="bold">any</emphasis> is equivalent to
-          <emphasis role="bold">all</emphasis> when there are no nested zones.
-          When there are nested zones, <emphasis role="bold">any</emphasis>
-          only refers to top-level zones (those with no parent zones). Note
-          that <emphasis role="bold">any</emphasis> excludes all vserver
-          zones, since those zones are nested within the firewall zone.
-          Beginning with Shorewall 4.4.13, exclusion is supported with
-          <emphasis role="bold">any</emphasis> -- see see <ulink
-          url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5).</para>
+                    <listitem>
+                      <para><emphasis role="bold">all</emphasis>, without the
+                      "-" means "All Zones, including the firewall zone". If
+                      the "-" is included, the firewall zone is omitted.
+                      Normally all omits intra-zone traffic, but intra-zone
+                      traffic can be included specifying "+".</para>
+                    </listitem>
+                  </varlistentry>
 
-          <para>Hosts may also be specified as an IP address range using the
-          syntax
-          <emphasis>lowaddress</emphasis>-<emphasis>highaddress</emphasis>.
-          This requires that your kernel and iptables contain iprange match
-          support. If your kernel and iptables have ipset match support then
-          you may give the name of an ipset prefaced by "+". The ipset name
-          may be optionally followed by a number from 1 to 6 enclosed in
-          square brackets ([]) to indicate the number of levels of source
-          bindings to be matched.</para>
+                  <varlistentry>
+                    <term>any[+][-]</term>
 
-          <para>Beginning with Shorewall 4.4.17, the primary IP address of a
-          firewall interface can be specified by an ampersand ('&amp;')
-          followed by the logical name of the interface as found in the
-          INTERFACE column of <ulink
+                    <listitem>
+                      <para><emphasis role="bold">any</emphasis> is equivalent
+                      to <emphasis role="bold">all</emphasis> when there are
+                      no nested zones. When there are nested zones, <emphasis
+                      role="bold">any</emphasis> only refers to top-level
+                      zones (those with no parent zones). Note that <emphasis
+                      role="bold">any</emphasis> excludes all vserver zones,
+                      since those zones are nested within the firewall
+                      zone.</para>
+                    </listitem>
+                  </varlistentry>
+
+                  <varlistentry>
+                    <term>none</term>
+
+                    <listitem>
+                      <para>When <emphasis role="bold">none</emphasis> is used
+                      either in the <emphasis role="bold">SOURCE</emphasis> or
+                      <emphasis role="bold">DEST</emphasis> column, the rule
+                      is ignored.</para>
+                    </listitem>
+                  </varlistentry>
+                </variablelist>
+
+                <para>Similar to with <emphasis role="bold">all</emphasis> and
+                <emphasis role="bold">any</emphasis>, intra-zone traffic is
+                normally excluded when multiple zones are listed. Intra-zone
+                traffic may be included by following the list with a plus sign
+                ("+").</para>
+
+                <para><emphasis role="bold">all</emphasis> and <emphasis
+                role="bold">any</emphasis> may be followed by an exclamation
+                point ("!") and a comma-separated list of zone names to be
+                omitted.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>zone</replaceable>:<replaceable>interface</replaceable></term>
+
+              <listitem>
+                <para>When this form is used,
+                <replaceable>interface</replaceable> must be the name of an
+                interface associated with the named
+                <replaceable>zone</replaceable> in either <ulink
+                url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
+                or <ulink
+                url="shorewall.hosts.html">shorewall-hosts</ulink>(5). Only
+                packets from hosts in the <replaceable>zone</replaceable> that
+                arrive through the named interface will match the rule.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>zone</replaceable>:<replaceable>address</replaceable>[,...]</term>
+
+              <listitem>
+                <para>where address can be:</para>
+
+                <itemizedlist>
+                  <listitem>
+                    <para>A host or network IP address. A network address may
+                    be followed by exclusion (see <ulink
+                    url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>An address range, specified using the syntax
+                    <emphasis>lowaddress</emphasis>-<emphasis>highaddress</emphasis>.</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>+<replaceable>ipset</replaceable> where
+                    <replaceable>ipset</replaceable> is the name of an ipset
+                    and must be preceded by a plus sign ("+").</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>A MAC address in Shorewall format (preceded by a
+                    tilde ("~") and with the hex byte values separated by
+                    dashes (e.g., "~00-0a-f6-04-9c-7d").</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>^<replaceable>country-code</replaceable> where
+                    country-code is a two-character ISO-3661 country code
+                    preceded by a caret ("^").</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>^<replaceable>country-code-list</replaceable> where
+                    <replaceable>country-code-list</replaceable> is a
+                    comma-separated list of up to 15 ISO-3661 country codes
+                    enclosed in square brackets ("[...]").</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>The primary IP address of a firewall interface can
+                    be specified by an ampersand ('&amp;') followed by the
+                    logical name of the interface as found in the INTERFACE
+                    column of <ulink
                     url="/manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>
                     (5).</para>
+                  </listitem>
+                </itemizedlist>
+              </listitem>
+            </varlistentry>
 
-          <para>Beginning with Shorewall 4.5.4, A
-          <replaceable>countrycode-list</replaceable> may be specified. A
-          countrycode-list is a comma-separated list of up to 15 two-character
-          ISO-3661 country codes enclosed in square brackets ('[...]') and
-          preceded by a caret ('^'). When a single country code is given, the
-          square brackets may be omitted. A list of country codes supported by
-          Shorewall may be found at <ulink
-          url="/ISO-3661.html">http://www.shorewall.net/ISO-3661.html</ulink>.
-          Specifying a <replaceable>countrycode-list</replaceable> requires
-          <firstterm>GeoIP Match</firstterm> support in your iptables and
-          Kernel.</para>
+            <varlistentry>
+              <term><replaceable>zone</replaceable>:<replaceable>interface</replaceable>:<replaceable>address</replaceable>[,...]</term>
 
-          <para>You may exclude certain hosts from the set already defined
-          through use of an <emphasis>exclusion</emphasis> (see <ulink
-          url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
+              <listitem>
+                <para>This form combines the preceding two and requires that
+                both the incoming interface and source address match.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>zone</replaceable>:<replaceable>exclusion</replaceable></term>
+
+              <listitem>
+                <para>This form matches if the host IP address does not match
+                any of the entries in the exclusion (see <ulink
+                url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>zone</replaceable>:<replaceable>interface</replaceable>:<replaceable>exclusion</replaceable></term>
+
+              <listitem>
+                <para>This form matches packets from the named
+                <replaceable>zone</replaceable> entering through the specified
+                <replaceable>interface</replaceable> where the source address
+                does not match any entry in the
+                <replaceable>exclusion</replaceable>.</para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
+
+          <para>Beginning with Shorewall 5.1.0, multiple
+          <replaceable>source-spec</replaceable>s may be listed, provided that
+          extended forms of the source-spec are used:</para>
+
+          <blockquote>
+            <para><replaceable>zone</replaceable>:(<replaceable>interface</replaceable>)</para>
+
+            <para><replaceable>zone</replaceable>:(<replaceable>address</replaceable>[,...])</para>
+
+            <para>zone:(interface:address[,...])</para>
+
+            <para><replaceable>zone</replaceable>:(<replaceable>exclusion</replaceable>)</para>
+
+            <para><replaceable>zone</replaceable>:(<replaceable>interface</replaceable>:<replaceable>exclusion</replaceable>)</para>
+          </blockquote>
 
           <para>Examples:</para>
 
@@ -1070,8 +1168,8 @@
               <term>$FW:&amp;eth0</term>
 
               <listitem>
-                <para>The primary IP address of eth0 in the firewall zone
-                (Shorewall 4.4.17 and later).</para>
+                <para>The primary IP address of eth0 in the firewall
+                zone.</para>
               </listitem>
             </varlistentry>
 
@@ -1092,92 +1190,259 @@
                 zone.</para>
               </listitem>
             </varlistentry>
+
+            <varlistentry>
+              <term>net:^CN</term>
+
+              <listitem>
+                <para>China.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>loc:(eth1:1.2.3.4,2.3.4.5),dmz:(eth2:5.6.7.8,9.10.11.12),net</term>
+
+              <listitem>
+                <para>Hosts 1.2.3.4 and 2.3.4.5 in the loc zone when the
+                packet arrives through eth1 plus hosts 5.6.7.8 and 9.10.11.12
+                in the dmz zone when the packet arrives through eth2 plus all
+                of the net zone.</para>
+              </listitem>
+            </varlistentry>
           </variablelist>
         </listitem>
       </varlistentry>
 
       <varlistentry>
-        <term><emphasis role="bold">DEST</emphasis> -
-        {<emphasis>zone</emphasis>|<emphasis>zone-list</emphasis>[+]|{<emphasis
-        role="bold">all</emphasis>|<emphasis
-        role="bold">any</emphasis>}[<emphasis
-        role="bold">+</emphasis>][<emphasis
-        role="bold">-</emphasis>]}<emphasis
-        role="bold">[:{</emphasis><emphasis>interface</emphasis>|<emphasis>address-or-range</emphasis>[,<emphasis>address-or-range</emphasis>]...[<emphasis>exclusion</emphasis>]|<emphasis>exclusion</emphasis>|<emphasis
-        role="bold">+</emphasis><emphasis>ipset</emphasis>|<emphasis>^countrycode-list</emphasis>}][<option>:</option><replaceable>port</replaceable>[:<emphasis
-        role="bold">random</emphasis>]]</term>
+        <term><emphasis role="bold">DEST -
+        <replaceable>dest-spec</replaceable>[,...]</emphasis></term>
 
         <listitem>
-          <para>Location of Server. May be a zone declared in <ulink
-          url="/manpages/shorewall-zones.html">shorewall-zones</ulink>(5),
-          $<emphasis role="bold">FW</emphasis> to indicate the firewall
-          itself, <emphasis role="bold">all</emphasis>. <emphasis
-          role="bold">all+</emphasis> or <emphasis
-          role="bold">none</emphasis>.</para>
+          <para>Destination hosts to which the rule applies.</para>
 
-          <para>Beginning with Shorewall 4.4.13, you may use a
-          <replaceable>zone-list </replaceable>which consists of a
-          comma-separated list of zones declared in <ulink
-          url="/manpages/shorewall-zones.html">shorewall-zones</ulink> (5).
-          This <replaceable>zone-list</replaceable> may be optionally followed
-          by "+" to indicate that the rule is to apply to intra-zone traffic
-          as well as inter-zone traffic.</para>
+          <para><replaceable>dest-spec</replaceable> is one of the
+          following:</para>
 
-          <para>Beginning with Shorewall 4.5.4, A
-          <replaceable>countrycode-list</replaceable> may be specified. A
-          countrycode-list is a comma-separated list of up to 15 two-character
-          ISO-3661 country codes enclosed in square brackets ('[...]') and
-          preceded by a caret ('^'). When a single country code is given, the
-          square brackets may be omitted. A list of country codes supported by
-          Shorewall may be found at <ulink
-          url="/ISO-3661.html">http://www.shorewall.net/ISO-3661.html</ulink>.
-          Specifying a <replaceable>countrycode-list</replaceable> requires
-          <firstterm>GeoIP Match</firstterm> support in your iptables and
-          Kernel.</para>
+          <variablelist>
+            <varlistentry>
+              <term><emphasis
+              role="bold"><replaceable>zone</replaceable>[,...[+]]</emphasis></term>
 
-          <para>When <emphasis role="bold">none</emphasis> is used either in
-          the <emphasis role="bold">SOURCE</emphasis> or <emphasis
-          role="bold">DEST</emphasis> column, the rule is ignored.</para>
+              <listitem>
+                <para>The name of a zone defined in <ulink
+                url="shorewall-zones.html">shorewall-zones</ulink>(5). When
+                only the zone name is specified, the packet destination may be
+                any host in that zone.</para>
 
-          <para><emphasis role="bold">all</emphasis> means "All Zones",
-          including the firewall itself. <emphasis role="bold">all-</emphasis>
-          means "All Zones, except the firewall itself". When <emphasis
-          role="bold">all</emphasis>[<emphasis role="bold">-</emphasis>] is
-          used either in the <emphasis role="bold">SOURCE</emphasis> or
-          <emphasis role="bold">DEST</emphasis> column intra-zone traffic is
-          not affected. When <emphasis role="bold">all+</emphasis>[<emphasis
-          role="bold">-</emphasis>] is "used, intra-zone traffic is affected.
-          Beginning with Shorewall 4.4.13, exclusion is supported -- see see
-          <ulink
-          url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5).</para>
+                <para>zone may also be one of the following:</para>
 
-          <para><emphasis role="bold">any</emphasis> is equivalent to
-          <emphasis role="bold">all</emphasis> when there are no nested zones.
-          When there are nested zones, <emphasis role="bold">any</emphasis>
-          only refers to top-level zones (those with no parent zones). Note
-          that <emphasis role="bold">any</emphasis> excludes all vserver
-          zones, since those zones are nested within the firewall zone.</para>
+                <variablelist>
+                  <varlistentry>
+                    <term>all[+][-]</term>
 
-          <para>Except when <emphasis role="bold">all</emphasis>[<emphasis
-          role="bold">+</emphasis>][<emphasis role="bold">-</emphasis>] or
-          <emphasis role="bold">any</emphasis>[<emphasis
-          role="bold">+</emphasis>][<emphasis role="bold">-</emphasis>] is
-          specified, clients may be further restricted to a list of networks
-          and/or hosts by appending ":" and a comma-separated list of network
-          and/or host addresses. Hosts may be specified by IP or MAC address;
-          mac addresses must begin with "~" and must use "-" as a
-          separator.</para>
+                    <listitem>
+                      <para><emphasis role="bold">all</emphasis>, without the
+                      "-" means "All Zones, including the firewall zone". If
+                      the "-" is included, the firewall zone is omitted.
+                      Normally all omits intra-zone traffic, but intra-zone
+                      traffic can be included specifying "+".</para>
+                    </listitem>
+                  </varlistentry>
 
-          <para>When <emphasis role="bold">all</emphasis> is used either in
-          the <emphasis role="bold">SOURCE</emphasis> or <emphasis
-          role="bold">DEST</emphasis> column intra-zone traffic is not
-          affected. When <emphasis role="bold">all+</emphasis> is used,
-          intra-zone traffic is affected. Beginning with Shorewall 4.4.13,
-          exclusion is supported -- see see <ulink
-          url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5).</para>
+                  <varlistentry>
+                    <term>any[+][-]</term>
 
-          <para>The <replaceable>zone</replaceable> should be omitted in
-          DNAT-, REDIRECT- and NONAT rules.</para>
+                    <listitem>
+                      <para><emphasis role="bold">any</emphasis> is equivalent
+                      to <emphasis role="bold">all</emphasis> when there are
+                      no nested zones. When there are nested zones, <emphasis
+                      role="bold">any</emphasis> only refers to top-level
+                      zones (those with no parent zones). Note that <emphasis
+                      role="bold">any</emphasis> excludes all vserver zones,
+                      since those zones are nested within the firewall
+                      zone.</para>
+                    </listitem>
+                  </varlistentry>
+
+                  <varlistentry>
+                    <term>none</term>
+
+                    <listitem>
+                      <para>When <emphasis role="bold">none</emphasis> is used
+                      either in the <emphasis role="bold">SOURCE</emphasis> or
+                      <emphasis role="bold">DEST</emphasis> column, the rule
+                      is ignored.</para>
+                    </listitem>
+                  </varlistentry>
+                </variablelist>
+
+                <para>Similar to with <emphasis role="bold">all</emphasis> and
+                <emphasis role="bold">any</emphasis>, intra-zone traffic is
+                normally excluded when multiple zones are listed. Intra-zone
+                traffic may be included by following the list with a plus sign
+                ("+").</para>
+
+                <para><emphasis role="bold">all</emphasis> and <emphasis
+                role="bold">any</emphasis> may be followed by an exclamation
+                point ("!") and a comma-separated list of zone names to be
+                omitted.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>zone</replaceable>:<replaceable>interface</replaceable></term>
+
+              <listitem>
+                <para>When this form is used,
+                <replaceable>interface</replaceable> must be the name of an
+                interface associated with the named
+                <replaceable>zone</replaceable> in either <ulink
+                url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
+                or <ulink
+                url="shorewall.hosts.html">shorewall-hosts</ulink>(5). Only
+                packets to hosts in the <replaceable>zone</replaceable> that
+                are sent through the named interface will match the
+                rule.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>zone</replaceable>:<replaceable>address</replaceable>[,...]</term>
+
+              <listitem>
+                <para>where address can be:</para>
+
+                <itemizedlist>
+                  <listitem>
+                    <para>A host or network IP address. A network address may
+                    be followed by exclusion (see <ulink
+                    url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>An address range, specified using the syntax
+                    <emphasis>lowaddress</emphasis>-<emphasis>highaddress</emphasis>.</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>+<replaceable>ipset</replaceable> where
+                    <replaceable>ipset</replaceable> is the name of an ipset
+                    and must be preceded by a plus sign ("+").</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>^<replaceable>country-code</replaceable> where
+                    country-code is a two-character ISO-3661 country code
+                    preceded by a caret ("^").</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>^<replaceable>country-code-list</replaceable> where
+                    <replaceable>country-code-list</replaceable> is a
+                    comma-separated list of up to 15 ISO-3661 country codes
+                    enclosed in square brackets ("[...]").</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>The primary IP address of a firewall interface can
+                    be specified by an ampersand ('&amp;') followed by the
+                    logical name of the interface as found in the INTERFACE
+                    column of <ulink
+                    url="/manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>
+                    (5).</para>
+                  </listitem>
+                </itemizedlist>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>zone</replaceable>:<replaceable>interface</replaceable>:<replaceable>address</replaceable>[,...]</term>
+
+              <listitem>
+                <para>This form combines the preceding two and requires that
+                both the outgoing interface and destinationaddress
+                match.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>zone</replaceable>:<replaceable>exclusion</replaceable></term>
+
+              <listitem>
+                <para>This form matches if the host IP address does not match
+                any of the entries in the exclusion (see <ulink
+                url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>zone</replaceable>:<replaceable>interface</replaceable>:<replaceable>exclusion</replaceable></term>
+
+              <listitem>
+                <para>This form matches packets to the named
+                <replaceable>zone</replaceable> leaving through the specified
+                <replaceable>interface</replaceable> where the destination
+                address does not match any entry in the
+                <replaceable>exclusion</replaceable>.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>[<replaceable>zone</replaceable>]:[<replaceable>server-IP</replaceable>][:<replaceable>port-or-port-range</replaceable>[:random]]</term>
+
+              <listitem>
+                <para>This form applies when the ACTION is DNAT[-] or
+                REDIRECT[-]. The zone may be omitted in REDIRECT rules ($FW is
+                assumed) and must be omitted in DNAT-, REDIRECT- and NONAT
+                rules.</para>
+
+                <para><replaceable role="bold">server-IP</replaceable> is not
+                allowed in REDIRECT rules and may be omitted in DNAT[-] rules
+                provided that <replaceable>port-or-port-range</replaceable> is
+                included.</para>
+
+                <itemizedlist>
+                  <listitem>
+                    <para>The IP address of the server to which the packet is
+                    to be sent.</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>A range of IP address with the low and high address
+                    separated by a dash (:"-"). Connections are distributed
+                    among the IP addresses in the range.</para>
+                  </listitem>
+                </itemizedlist>
+
+                <para>If <replaceable>server-IP </replaceable>is omitted in a
+                DNAT[-] rule, only the destination port number is modified by
+                the rule.</para>
+
+                <para>port-or-port-range may be:</para>
+
+                <itemizedlist>
+                  <listitem>
+                    <para>An integer port number in the range 1 -
+                    65535.</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>The name of a service from
+                    <filename>/etc/services</filename>.</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>A port range with the low and high integer port
+                    numbers separated by a dash ("-"). Connections are
+                    distributed among the ports in the range.</para>
+                  </listitem>
+                </itemizedlist>
+
+                <para>If <emphasis role="bold">random</emphasis> is specified,
+                port mapping will be randomized.</para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
 
           <para>If the DEST <replaceable>zone</replaceable> is a bport zone,
           then either:<orderedlist numeration="loweralpha">
@@ -1194,82 +1459,134 @@
                 <para>the SOURCE <replaceable>zone</replaceable> must be an
                 ipv4 zone that is associated with only the same bridge.</para>
               </listitem>
-            </orderedlist></para>
+            </orderedlist>Beginning with Shorewall 5.1.0, multiple
+          <replaceable>dest-spec</replaceable>s may be listed, provided that
+          extended forms of the source-spec are used:</para>
 
-          <para>Except when <emphasis
-          role="bold">{all|any}</emphasis>[<emphasis
-          role="bold">+]|[-</emphasis>] is specified, the server may be
-          further restricted to a particular network, host or interface by
-          appending ":" and the network, host or interface. See <emphasis
-          role="bold">SOURCE</emphasis> above.</para>
+          <blockquote>
+            <para><replaceable>zone</replaceable>:(<replaceable>interface</replaceable>)</para>
 
-          <para>You may exclude certain hosts from the set already defined
-          through use of an <emphasis>exclusion</emphasis> (see <ulink
-          url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
+            <para><replaceable>zone</replaceable>:(<replaceable>address</replaceable>[,...])</para>
 
-          <para>Restriction: MAC addresses are not allowed (this is a
-          Netfilter restriction).</para>
+            <para>zone:(interface:address[,...])</para>
 
-          <para>Like in the <emphasis role="bold">SOURCE</emphasis> column,
-          you may specify a range of IP addresses using the syntax
-          <emphasis>lowaddress</emphasis>-<emphasis>highaddress</emphasis>.
-          When the <emphasis role="bold">ACTION</emphasis> is <emphasis
-          role="bold">DNAT</emphasis> or <emphasis
-          role="bold">DNAT-</emphasis>, the connections will be assigned to
-          addresses in the range in a round-robin fashion.</para>
+            <para><replaceable>zone</replaceable>:(<replaceable>exclusion</replaceable>)</para>
 
-          <para>If your kernel and iptables have ipset match support then you
-          may give the name of an ipset prefaced by "+". The ipset name may be
-          optionally followed by a number from 1 to 6 enclosed in square
-          brackets ([]) to indicate the number of levels of destination
-          bindings to be matched. Only one of the <emphasis
-          role="bold">SOURCE</emphasis> and <emphasis
-          role="bold">DEST</emphasis> columns may specify an ipset
-          name.</para>
+            <para><replaceable>zone</replaceable>:(<replaceable>interface</replaceable>:<replaceable>exclusion</replaceable>)</para>
+          </blockquote>
 
-          <para>Beginning with Shorewall 4.4.17, the primary IP address of a
-          firewall interface can be specified by an ampersand ('&amp;')
-          followed by the logical name of the interface as found in the
-          INTERFACE column of <ulink
-          url="/manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>
-          (5).</para>
+          <para>Multiple <replaceable>dest-spec</replaceable>s are not
+          permitted in DNAT[-] and REDIRECT[-] rules.</para>
 
-          <para>The <replaceable>port</replaceable> that the server is
-          listening on may be included and separated from the server's IP
-          address by ":". If omitted, the firewall will not modify the
-          destination port. A destination port may only be included if the
-          <emphasis role="bold">ACTION</emphasis> is <emphasis
-          role="bold">DNAT</emphasis> or <emphasis
-          role="bold">REDIRECT</emphasis>.</para>
+          <para>Examples:</para>
 
           <variablelist>
             <varlistentry>
-              <term>Example:</term>
+              <term>dmz:192.168.2.2</term>
 
               <listitem>
-                <para><emphasis role="bold">loc:192.168.1.3:3128</emphasis>
-                specifies a local server at IP address 192.168.1.3 and
-                listening on port 3128.</para>
+                <para>Host 192.168.2.2 in the DMZ</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>net:155.186.235.0/24</term>
+
+              <listitem>
+                <para>Subnet 155.186.235.0/24 on the Internet</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>loc:192.168.1.1,192.168.1.2</term>
+
+              <listitem>
+                <para>Hosts 192.168.1.1 and 192.168.1.2 in the local
+                zone.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>net:192.0.2.11-192.0.2.17</term>
+
+              <listitem>
+                <para>Hosts 192.0.2.11-192.0.2.17 in the net zone.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>net:!192.0.2.11-192.0.2.17</term>
+
+              <listitem>
+                <para>All hosts in the net zone except for
+                192.0.2.11-192.0.2.17.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>net:155.186.235.0/24!155.186.235.16/28</term>
+
+              <listitem>
+                <para>Subnet 155.186.235.0/24 on the Internet except for
+                155.186.235.16/28</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>$FW:&amp;eth0</term>
+
+              <listitem>
+                <para>The primary IP address of eth0 in the firewall
+                zone.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>loc,dmz</term>
+
+              <listitem>
+                <para>Both the <emphasis role="bold">loc</emphasis> and
+                <emphasis role="bold">dmz</emphasis> zones.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>all!dmz</term>
+
+              <listitem>
+                <para>All but the <emphasis role="bold">dmz</emphasis>
+                zone.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>net:^CN</term>
+
+              <listitem>
+                <para>China.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>dmz:192.168.10.4:25</term>
+
+              <listitem>
+                <para>Port 25 on server 192.168.10.4 in the dmz zone (DNAT
+                rule).</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>loc:(eth1:1.2.3.4,2.3.4.5),dmz:(eth2:5.6.7.8,9.10.11.12),net</term>
+
+              <listitem>
+                <para>Hosts 1.2.3.4 and 2.3.4.5 in the loc zone when the
+                packet arrives through eth1 plus hosts 5.6.7.8 and 9.10.11.12
+                in the dmz zone when the packet arrives through eth2 plus all
+                of the net zone.</para>
               </listitem>
             </varlistentry>
           </variablelist>
-
-          <para>The <emphasis>port</emphasis> may be specified as a service
-          name. You may specify a port range in the form
-          <emphasis>lowport-highport</emphasis> to cause connections to be
-          assigned to ports in the range in round-robin fashion. When a port
-          range is specified, <emphasis>lowport</emphasis> and
-          <emphasis>highport</emphasis> must be given as integers; service
-          names are not permitted. Additionally, the port range may be
-          optionally followed by <emphasis role="bold">:random</emphasis>
-          which causes assignment to ports in the list to be random.</para>
-
-          <para>If the <emphasis role="bold">ACTION</emphasis> is <emphasis
-          role="bold">REDIRECT</emphasis> or <emphasis
-          role="bold">REDIRECT-</emphasis>, this column needs only to contain
-          the port number on the firewall that the request should be
-          redirected to. That is equivalent to specifying
-          <option>$FW</option>::<replaceable>port</replaceable>.</para>
         </listitem>
       </varlistentry>
 

Shorewall/manpages/shorewall-snat.xml

@@ -0,0 +1,743 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<refentry>
+  <refmeta>
+    <refentrytitle>shorewall-snat</refentrytitle>
+
+    <manvolnum>5</manvolnum>
+
+    <refmiscinfo>Configuration Files</refmiscinfo>
+  </refmeta>
+
+  <refnamediv>
+    <refname>snat</refname>
+
+    <refpurpose>Shorewall SNAT/Masquerade definition file</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <cmdsynopsis>
+      <command>/etc/shorewall/snat</command>
+    </cmdsynopsis>
+  </refsynopsisdiv>
+
+  <refsect1>
+    <title>Description</title>
+
+    <para>This file is used to define dynamic NAT (Masquerading) and to define
+    Source NAT (SNAT). It superseded <ulink
+    url="shorewall-masq.html">shorewall-masq</ulink>(5) in Shorewall
+    5.0.14.</para>
+
+    <warning>
+      <para>The entries in this file are order-sensitive. The first entry that
+      matches a particular connection will be the one that is used.</para>
+    </warning>
+
+    <warning>
+      <para>If you have more than one ISP link, adding entries to this file
+      will <emphasis role="bold">not</emphasis> force connections to go out
+      through a particular link. You must use entries in <ulink
+      url="/manpages/shorewall-rtrules.html">shorewall-rtrules</ulink>(5) or
+      PREROUTING entries in <ulink
+      url="/manpages/shorewall-mangle.html">shorewall-mangle</ulink>(5) to do
+      that.</para>
+    </warning>
+
+    <para>The columns in the file are as follows.</para>
+
+    <variablelist>
+      <varlistentry>
+        <term><emphasis role="bold">ACTION</emphasis></term>
+
+        <listitem>
+          <para>Defines the type of rule to generate. Choices are:</para>
+
+          <variablelist>
+            <varlistentry>
+              <term><emphasis
+              role="bold">MASQUERADE[+]</emphasis>[([<replaceable>lowport</replaceable>-<replaceable>highport</replaceable>][<option>random</option>])]</term>
+
+              <listitem>
+                <para>Causes matching outgoing packages to have their source
+                IP address set to the primary IP address of the interface
+                specified in the DEST column. if
+                <replaceable>lowport</replaceable>-<replaceable>highport</replaceable>
+                is given, that port range will be used to assign a source
+                port. If option <option>random</option> is used then port
+                mapping will be randomized. MASQUERADE should only be used
+                when the DEST interface has a dynamic IP address. Otherwise,
+                SNAT should be used and should specify the interface's static
+                address.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis
+              role="bold">SNAT[+]</emphasis>([<emphasis>address-or-address-range</emphasis>][:<emphasis>lowport</emphasis><emphasis
+              role="bold">-</emphasis><emphasis>highport</emphasis>][<emphasis
+              role="bold">:random</emphasis>][:<option>persistent</option>]|<emphasis
+              role="bold">detect</emphasis>|</term>
+
+              <listitem>
+                <para>If you specify an address here, matching packets will
+                have their source address set to that address. If
+                ADD_SNAT_ALIASES is set to Yes or yes in <ulink
+                url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5)
+                then Shorewall will automatically add this address to the
+                INTERFACE named in the first column.</para>
+
+                <para>You may also specify a range of up to 256 IP addresses
+                if you want the SNAT address to be assigned from that range in
+                a round-robin fashion by connection. The range is specified by
+                <emphasis>first.ip.in.range</emphasis>-<emphasis>last.ip.in.range</emphasis>.
+                You may follow the port range with<emphasis role="bold">
+                :random</emphasis> in which case assignment of ports from the
+                list will be random. <emphasis role="bold">random</emphasis>
+                may also be specified by itself in this column in which case
+                random local port assignments are made for the outgoing
+                connections.</para>
+
+                <para>Example: 206.124.146.177-206.124.146.180</para>
+
+                <para>You may follow the port range (or <emphasis
+                role="bold">:random</emphasis>) with <emphasis
+                role="bold">:persistent</emphasis>. This is only useful when
+                an address range is specified and causes a client to be given
+                the same source/destination IP pair. This feature replaces the
+                SAME modifier which was removed from Shorewall in version
+                4.4.0.</para>
+
+                <para>You may also use the special value
+                <option>detect</option> which causes Shorewall to determine
+                the IP addresses configured on the interface named in the DEST
+                column and substitute them in this column.</para>
+
+                <para>Finally, you may also specify a comma-separated list of
+                ranges and/or addresses in this column.</para>
+
+                <para>DNS Names names are not allowed.</para>
+
+                <para>Normally, Netfilter will attempt to retain the source
+                port number. You may cause netfilter to remap the source port
+                by following an address or range (if any) by ":" and a port
+                range with the format
+                <emphasis>lowport</emphasis>-<emphasis>highport</emphasis>. If
+                this is done, you must specify "tcp", "udp", "dccp" or "stcp"
+                in the PROTO column.</para>
+
+                <para>Examples:</para>
+
+                <programlisting>        192.0.2.4:5000-6000
+        :4000-5000</programlisting>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">CONTINUE</emphasis>[+]</term>
+
+              <listitem>
+                <para>Causes matching packets to be exempted from any
+                following rules in the file.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis
+              role="bold"><replaceable>action</replaceable></emphasis>[+][(<replaceable>parameter</replaceable>,...)]</term>
+
+              <listitem>
+                <para>where <replaceable>action</replaceable> is an action
+                declared in <ulink
+                url="shorewall-actions.html">shorewall-actions(5)</ulink> with
+                the <option>nat</option> option. See <ulink
+                url="/Actions.html">www.shorewall.net/Actions.html</ulink> for
+                further information.</para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
+
+          <para>Normally Masq/SNAT rules are evaluated after those for
+          one-to-one NAT (defined in <ulink
+          url="/manpages/shorewall-nat.html">shorewall-nat</ulink>(5)). If you
+          want the rule to be applied before one-to-one NAT rules, follow the
+          action name with "+": This feature should only be required if you
+          need to insert rules in this file that preempt entries in <ulink
+          url="/manpages/shorewall-nat.html">shorewall-nat</ulink>(5).</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">SOURCE</emphasis> (Optional) -
+        [<emphasis>interface</emphasis>|<emphasis>address</emphasis>[<emphasis
+        role="bold">,</emphasis><emphasis>address</emphasis>...][<emphasis>exclusion</emphasis>]]</term>
+
+        <listitem>
+          <para>Set of hosts that you wish to masquerade. You can specify this
+          as an <emphasis>address</emphasis> (net or host) or as an
+          <emphasis>interface</emphasis> (use of an
+          <emphasis>interface</emphasis> is deprecated). If you give the name
+          of an interface, the interface must be up before you start the
+          firewall and the Shorewall rules compiler will warn you of that
+          fact. (Shorewall will use your main routing table to determine the
+          appropriate addresses to masquerade).</para>
+
+          <para>The preferred way to specify the SOURCE is to supply one or
+          more host or network addresses separated by comma. You may use ipset
+          names preceded by a plus sign (+) to specify a set of hosts.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">DEST</emphasis> - {[<emphasis
+        role="bold">+</emphasis>]<emphasis>interface</emphasis>[<emphasis
+        role="bold">:</emphasis>[<emphasis>digit</emphasis>]][<emphasis
+        role="bold">:</emphasis>[<emphasis>dest-address</emphasis>[<emphasis
+        role="bold">,</emphasis><emphasis>dest-address</emphasis>]...[<emphasis>exclusion</emphasis>]]}</term>
+
+        <listitem>
+          <para>Outgoing <emphasis>interface</emphasis>. This is usually your
+          internet interface. If ADD_SNAT_ALIASES=Yes in <ulink
+          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5), you
+          may add ":" and a <emphasis>digit</emphasis> to indicate that you
+          want the alias added with that name (e.g., eth0:0). This will allow
+          the alias to be displayed with ifconfig. <emphasis role="bold">That
+          is the only use for the alias name; it may not appear in any other
+          place in your Shorewall configuration.</emphasis></para>
+
+          <para>Each interface must match an entry in <ulink
+          url="/manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>(5).
+          Shorewall allows loose matches to wildcard entries in <ulink
+          url="/manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>(5).
+          For example, <filename class="devicefile">ppp0</filename> in this
+          file will match a <ulink
+          url="/manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
+          entry that defines <filename
+          class="devicefile">ppp+</filename>.</para>
+
+          <para>Where <ulink url="/4.4/MultiISP.html#Shared">more that one
+          internet provider share a single interface</ulink>, the provider is
+          specified by including the provider name or number in
+          parentheses:</para>
+
+          <programlisting>        eth0(Avvanta)</programlisting>
+
+          <para>In that case, you will want to specify the interface's address
+          for that provider as the SNAT parameter.</para>
+
+          <para>The interface may be qualified by adding the character ":"
+          followed by a comma-separated list of destination host or subnet
+          addresses to indicate that you only want to change the source IP
+          address for packets being sent to those particular destinations.
+          Exclusion is allowed (see <ulink
+          url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5))
+          as are ipset names preceded by a plus sign '+';</para>
+
+          <para>If you wish to inhibit the action of ADD_SNAT_ALIASES for this
+          entry then include the ":" but omit the digit:</para>
+
+          <programlisting>        eth0(Avvanta):
+        eth2::192.0.2.32/27</programlisting>
+
+          <para>Comments may be attached to Netfilter rules generated from
+          entries in this file through the use of ?COMMENT lines. These lines
+          begin with ?COMMENT; the remainder of the line is treated as a
+          comment which is attached to subsequent rules until another ?COMMENT
+          line is found or until the end of the file is reached. To stop
+          adding comments to rules, use a line containing only
+          ?COMMENT.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">PROTO</emphasis> (Optional) - {<emphasis
+        role="bold">-</emphasis>|[!]{<emphasis>protocol-name</emphasis>|<emphasis>protocol-number</emphasis>}[,...]|+<replaceable>ipset</replaceable>}</term>
+
+        <listitem>
+          <para>If you wish to restrict this entry to a particular protocol
+          then enter the protocol name (from protocols(5)) or number
+          here.</para>
+
+          <para>Beginning with Shorewall 4.5.12, this column can accept a
+          comma-separated list of protocols.</para>
+
+          <para>Beginning with Shorewall 4.6.0, an
+          <replaceable>ipset</replaceable> name can be specified in this
+          column. This is intended to be used with
+          <firstterm>bitmap:port</firstterm> ipsets.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">PORT</emphasis> (Optional) -
+        {-|[!]<emphasis>port-name-or-number</emphasis>[,<emphasis>port-name-or-number</emphasis>]...|+<replaceable>ipset</replaceable>}</term>
+
+        <listitem>
+          <para>If the PROTO column specifies TCP (6), UDP (17), DCCP (33),
+          SCTP (132) or UDPLITE (136) then you may list one or more port
+          numbers (or names from services(5)) or port ranges separated by
+          commas.</para>
+
+          <para>Port ranges are of the form
+          <emphasis>lowport</emphasis>:<emphasis>highport</emphasis>.</para>
+
+          <para>Beginning with Shorewall 4.6.0, an
+          <replaceable>ipset</replaceable> name can be specified in this
+          column. This is intended to be used with
+          <firstterm>bitmap:port</firstterm> ipsets.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">IPSEC</emphasis> (Optional) -
+        [<emphasis>option</emphasis>[<emphasis
+        role="bold">,</emphasis><emphasis>option</emphasis>]...]</term>
+
+        <listitem>
+          <para>If you specify a value other than "-" in this column, you must
+          be running kernel 2.6 and your kernel and iptables must include
+          policy match support.</para>
+
+          <para>Comma-separated list of options from the following. Only
+          packets that will be encrypted via an SA that matches these options
+          will have their source address changed.</para>
+
+          <variablelist>
+            <varlistentry>
+              <term><emphasis
+              role="bold">reqid=</emphasis><emphasis>number</emphasis></term>
+
+              <listitem>
+                <para>where <emphasis>number</emphasis> is specified using
+                setkey(8) using the 'unique:<emphasis>number</emphasis> option
+                for the SPD level.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">spi=</emphasis>&lt;number&gt;</term>
+
+              <listitem>
+                <para>where <emphasis>number</emphasis> is the SPI of the SA
+                used to encrypt/decrypt packets.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">proto=</emphasis><emphasis
+              role="bold">ah</emphasis>|<emphasis
+              role="bold">esp</emphasis>|<emphasis
+              role="bold">ipcomp</emphasis></term>
+
+              <listitem>
+                <para>IPSEC Encapsulation Protocol</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis
+              role="bold">mss=</emphasis><emphasis>number</emphasis></term>
+
+              <listitem>
+                <para>sets the MSS field in TCP packets</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">mode=</emphasis><emphasis
+              role="bold">transport</emphasis>|<emphasis
+              role="bold">tunnel</emphasis></term>
+
+              <listitem>
+                <para>IPSEC mode</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis
+              role="bold">tunnel-src=</emphasis><emphasis>address</emphasis>[/<emphasis>mask</emphasis>]</term>
+
+              <listitem>
+                <para>only available with mode=tunnel</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis
+              role="bold">tunnel-dst=</emphasis><emphasis>address</emphasis>[/<emphasis>mask</emphasis>]</term>
+
+              <listitem>
+                <para>only available with mode=tunnel</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">strict</emphasis></term>
+
+              <listitem>
+                <para>Means that packets must match all rules.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">next</emphasis></term>
+
+              <listitem>
+                <para>Separates rules; can only be used with strict</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">yes</emphasis></term>
+
+              <listitem>
+                <para>When used by itself, causes all traffic that will be
+                encrypted/encapsulated to match the rule.</para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">MARK</emphasis> - [<emphasis
+        role="bold">!</emphasis>]<emphasis>value</emphasis>[/<emphasis>mask</emphasis>][<emphasis
+        role="bold">:C</emphasis>]</term>
+
+        <listitem>
+          <para>Defines a test on the existing packet or connection mark. The
+          rule will match only if the test returns true.</para>
+
+          <para>If you don't want to define a test but need to specify
+          anything in the following columns, place a "-" in this field.</para>
+
+          <variablelist>
+            <varlistentry>
+              <term>!</term>
+
+              <listitem>
+                <para>Inverts the test (not equal)</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis>value</emphasis></term>
+
+              <listitem>
+                <para>Value of the packet or connection mark.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis>mask</emphasis></term>
+
+              <listitem>
+                <para>A mask to be applied to the mark before testing.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">:C</emphasis></term>
+
+              <listitem>
+                <para>Designates a connection mark. If omitted, the packet
+                mark's value is tested.</para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">USER</emphasis> (Optional) - [<emphasis
+        role="bold">!</emphasis>][<emphasis>user-name-or-number</emphasis>][<emphasis
+        role="bold">:</emphasis><emphasis>group-name-or-number</emphasis>][<emphasis
+        role="bold">+</emphasis><emphasis>program-name</emphasis>]</term>
+
+        <listitem>
+          <para>This column was formerly labelled USER/GROUP.</para>
+
+          <para>Only locally-generated connections will match if this column
+          is non-empty.</para>
+
+          <para>When this column is non-empty, the rule matches only if the
+          program generating the output is running under the effective
+          <emphasis>user</emphasis> and/or <emphasis>group</emphasis>
+          specified (or is NOT running under that id if "!" is given).</para>
+
+          <para>Examples:</para>
+
+          <variablelist>
+            <varlistentry>
+              <term>joe</term>
+
+              <listitem>
+                <para>program must be run by joe</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>:kids</term>
+
+              <listitem>
+                <para>program must be run by a member of the 'kids'
+                group</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>!:kids</term>
+
+              <listitem>
+                <para>program must not be run by a member of the 'kids'
+                group</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>+upnpd</term>
+
+              <listitem>
+                <para>#program named upnpd</para>
+
+                <important>
+                  <para>The ability to specify a program name was removed from
+                  Netfilter in kernel version 2.6.14.</para>
+                </important>
+              </listitem>
+            </varlistentry>
+          </variablelist>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">SWITCH -
+        [!]<replaceable>switch-name</replaceable>[={0|1}]</emphasis></term>
+
+        <listitem>
+          <para>Added in Shorewall 4.5.1 and allows enabling and disabling the
+          rule without requiring <command>shorewall restart</command>.</para>
+
+          <para>The rule is enabled if the value stored in
+          <filename>/proc/net/nf_condition/<replaceable>switch-name</replaceable></filename>
+          is 1. The rule is disabled if that file contains 0 (the default). If
+          '!' is supplied, the test is inverted such that the rule is enabled
+          if the file contains 0.</para>
+
+          <para>Within the <replaceable>switch-name</replaceable>, '@0' and
+          '@{0}' are replaced by the name of the chain to which the rule is a
+          added. The <replaceable>switch-name</replaceable> (after '@...'
+          expansion) must begin with a letter and be composed of letters,
+          decimal digits, underscores or hyphens. Switch names must be 30
+          characters or less in length.</para>
+
+          <para>Switches are normally <emphasis role="bold">off</emphasis>. To
+          turn a switch <emphasis role="bold">on</emphasis>:</para>
+
+          <simplelist>
+            <member><command>echo 1 &gt;
+            /proc/net/nf_condition/<replaceable>switch-name</replaceable></command></member>
+          </simplelist>
+
+          <para>To turn it <emphasis role="bold">off</emphasis> again:</para>
+
+          <simplelist>
+            <member><command>echo 0 &gt;
+            /proc/net/nf_condition/<replaceable>switch-name</replaceable></command></member>
+          </simplelist>
+
+          <para>Switch settings are retained over <command>shorewall
+          restart</command>.</para>
+
+          <para>Beginning with Shorewall 4.5.10, when the
+          <replaceable>switch-name</replaceable> is followed by
+          <option>=0</option> or <option>=1</option>, then the switch is
+          initialized to off or on respectively by the
+          <command>start</command> command. Other commands do not affect the
+          switch setting.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">ORIGDEST</emphasis> - [<emphasis
+        role="bold">-</emphasis>|<emphasis>address</emphasis>[,<emphasis>address</emphasis>]...[<emphasis>exclusion</emphasis>]|<emphasis>exclusion</emphasis>]</term>
+
+        <listitem>
+          <para>(Optional) Added in Shorewall 4.5.6. This column may be
+          included and may contain one or more addresses (host or network)
+          separated by commas. Address ranges are not allowed. When this
+          column is supplied, rules are generated that require that the
+          original destination address matches one of the listed addresses. It
+          is useful for specifying that SNAT should occur only for connections
+          that were acted on by a DNAT when they entered the firewall.</para>
+
+          <para>This column was formerly labelled ORIGINAL DEST.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">PROBABILITY</emphasis> -
+        [<replaceable>probability</replaceable>]</term>
+
+        <listitem>
+          <para>Added in Shorewall 5.0.0. When non-empty, requires the
+          <firstterm>Statistics Match</firstterm> capability in your kernel
+          and ip6tables and causes the rule to match randomly but with the
+          given <replaceable>probability</replaceable>. The
+          <replaceable>probability</replaceable> is a number 0 &lt;
+          <replaceable>probability</replaceable> &lt;= 1 and may be expressed
+          at up to 8 decimal points of precision.</para>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+
+  <refsect1>
+    <title>Examples</title>
+
+    <variablelist>
+      <varlistentry>
+        <term>Example 1:</term>
+
+        <listitem>
+          <para>You have a simple masquerading setup where eth0 connects to a
+          DSL or cable modem and eth1 connects to your local network with
+          subnet 192.168.0.0/24.</para>
+
+          <para>Your entry in the file will be:</para>
+
+          <programlisting>        #ACTION    SOURCE              DEST
+        MASQUERADE 192.168.0.0/24      eth0</programlisting>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>Example 2:</term>
+
+        <listitem>
+          <para>You add a router to your local network to connect subnet
+          192.168.1.0/24 which you also want to masquerade. You then add a
+          second entry for eth0 to this file:</para>
+
+          <programlisting>        #ACTION    SOURCE              DEST
+        MASQUERADE 192.168.0.0/24      eth0
+        MASQUERADE 192.168.1.0/24      eth0</programlisting>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>Example 3:</term>
+
+        <listitem>
+          <para>You want all outgoing traffic from 192.168.1.0/24 through eth0
+          to use source address 206.124.146.176 which is NOT the primary
+          address of eth0. You want 206.124.146.176 to be added to eth0 with
+          name eth0:0.</para>
+
+          <programlisting>        #ACTION                 SOURCE          DEST
+        SNAT(206.124.146.176)   192.168.1.0/24  eth0:0</programlisting>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>Example 4:</term>
+
+        <listitem>
+          <para>You want all outgoing SMTP traffic entering the firewall from
+          172.20.1.0/29 to be sent from eth0 with source IP address
+          206.124.146.177. You want all other outgoing traffic from
+          172.20.1.0/29 to be sent from eth0 with source IP address
+          206.124.146.176.</para>
+
+          <programlisting>        #INTERFACE   SOURCE           ADDRESS         PROTO   DPORT
+        eth0         172.20.1.0/29    206.124.146.177 tcp     smtp
+        eth0         172.20.1.0/29    206.124.146.176</programlisting>
+
+          <programlisting>        #ACTION                 SOURCE          DEST        PROTO     PORT
+        SNAT(206.124.146.177)   172.20.1.0/29   eth0        tcp       smtp
+        SNAT(206.124.146.176)   172.20.1.0/29   eth0</programlisting>
+
+          <warning>
+            <para>The order of the above two rules is significant!</para>
+          </warning>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>Example 5:</term>
+
+        <listitem>
+          <para>Connections leaving on eth0 and destined to any host defined
+          in the ipset <emphasis>myset</emphasis> should have the source IP
+          address changed to 206.124.146.177.</para>
+
+          <programlisting>        #ACTION                 SOURCE          DEST
+        SNAT(206.124.146.177)   -               eth0+myset[dst]</programlisting>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>Example 6:</term>
+
+        <listitem>
+          <para>SNAT outgoing connections on eth0 from 192.168.1.0/24 in
+          round-robin fashion between addresses 1.1.1.1, 1.1.1.3, and 1.1.1.9
+          (Shorewall 4.5.9 and later).</para>
+
+          <programlisting>/etc/shorewall/tcrules:
+
+       #ACTION   SOURCE         DEST         PROTO   DPORT         SPORT    USER    TEST
+       1-3:CF    192.168.1.0/24 eth0 ; state=NEW
+
+/etc/shorewall/snat:
+
+       #ACTION                 SOURCE          DEST
+       SNAT(1.1.1.1)           192.168.1.0/24  eth0  { mark=1:C }
+       SNAT(1.1.1.3)           192.168.1.0/24  eth0  { mark=2:C }
+       SNAT(1.1.1.9)           192.168.1.0/24  eth0  { mark=3:C }</programlisting>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>Example 7:</term>
+
+        <listitem>
+          <para>Your eth1 has two public IP addresses: 70.90.191.121 and
+          70.90.191.123. You want to use the iptables statistics match to
+          masquerade outgoing connections evenly between these two
+          addresses.</para>
+
+          <programlisting>/etc/shorewall/snat:
+
+       #ACTION                 SOURCE           DEST
+       SNAT(70.90.191.121)     -                eth1 { probability=.50 }
+       SNAT(70.90.191.123)     -                eth1</programlisting>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+
+  <refsect1>
+    <title>FILES</title>
+
+    <para>/etc/shorewall/snat</para>
+  </refsect1>
+
+  <refsect1>
+    <title>See ALSO</title>
+
+    <para><ulink
+    url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
+
+    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
+    shorewall-blacklist(5), shorewall-exclusion(5), shorewall-hosts(5),
+    shorewall_interfaces(5), shorewall-ipsets(5), shorewall-maclist(5),
+    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
+    shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
+    shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5),
+    shorewall.conf(5), shorewall-secmarks(5), shorewall-tcclasses(5),
+    shorewall-tcdevices(5), shorewall-mangle(5), shorewall-tos(5),
+    shorewall-tunnels(5), shorewall-zones(5)</para>
+  </refsect1>
+</refentry>

Shorewall/manpages/shorewall.conf.xml

@@ -533,22 +533,6 @@
         </listitem>
       </varlistentry>
 
-      <varlistentry>
-        <term><emphasis role="bold">CHAIN_SCRIPTS=</emphasis>{<emphasis
-        role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>}</term>
-
-        <listitem>
-          <para>Added in Shorewall 4.5.16. Prior to the availability of BEGIN
-          PERL....END PERL in configuration files, the only way to execute a
-          chain-specific script was to create a script file with the same name
-          as the chain and place it in a directory on the CONFIG_PATH. That
-          facility has the drawback that the compiler will attempt to run a
-          non-script file just because it has the same name as a chain. To
-          disable this facility, set CHAIN_SCRIPTS=No. If not specified or
-          specified as the empty value, CHAIN_SCRIPTS=Yes is assumed.</para>
-        </listitem>
-      </varlistentry>
-
       <varlistentry>
         <term><emphasis role="bold">CLAMPMSS=[</emphasis><emphasis
         role="bold">Yes</emphasis>|<emphasis
@@ -798,7 +782,7 @@
                 <para>Normally, only packets whose source address matches an
                 entry in the ipset are dropped. If <option>src-dst</option> is
                 included, then packets whose destination address matches an
-                entry in the ipset are also dropped. </para>
+                entry in the ipset are also dropped.</para>
               </listitem>
             </varlistentry>
 
@@ -920,7 +904,8 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
           an administrative system in directories containing the
           configurations of remote firewalls. The contents of the variable are
           the default value for the <replaceable>system</replaceable>
-          parameter to the <command>remote-reload</command> and
+          parameter to the <command>remote-start</command>,
+          <command>remote-reload</command> and
           <command>remote-restart</command> commands.</para>
         </listitem>
       </varlistentry>
@@ -1086,10 +1071,12 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
 
           <para>Beginning with Shorewall 5.0.0, it is no longer necessary to
           set INLINE_MATCHES=Yes in order to be able to specify your own
-          iptables text in a rule. You may simply preface that text with a
-          pair of semicolons (";;"). If alternate input is also specified in
-          the rule, it should appear before the semicolons and may be
-          separated from normal column input by a single semicolon.</para>
+          iptables text in a rule and INLINE_MATCHES=Yes is deprecated.
+          Beginning with 5.0.0, you may simply preface your text with a pair
+          of semicolons (";;"). If alternate input is also specified in the
+          rule, it should appear before the semicolons and may be separated
+          from normal column input by a single semicolon or enclosed in curly
+          braces ("{....}").</para>
         </listitem>
       </varlistentry>
 
@@ -2148,36 +2135,27 @@ LOG:info:,bar                        net                    fw</programlisting>
           <command>load</command> and <command>reload</command> commands.
           Beginning with release 3.9.5, you may define an alternative means
           for accessing the remote firewall system. In that release, two new
-          options were added to shorewall.conf:<simplelist>
+          options were added to shorewall.conf:</para>
+
+          <simplelist>
             <member>RSH_COMMAND</member>
 
             <member>RCP_COMMAND</member>
-            </simplelist>The default values for these are as
-          follows:<simplelist>
-              <member>RSH_COMMAND: ssh ${root}@${system} ${command}</member>
+          </simplelist>
 
-              <member>RCP_COMMAND: scp ${files}
-              ${root}@${system}:${destination}</member>
-            </simplelist>Shell variables that will be set when the commands
-          are invoked are as follows:<simplelist>
-              <member><replaceable>root</replaceable> - root user. Normally
-              <option>root</option> but may be overridden using the '-r'
-              option.</member>
+          <para>The default values for these are as follows:</para>
 
-              <member><replaceable>system</replaceable> - The name/IP address
-              of the remote firewall system.</member>
+          <programlisting>RSH_COMMAND: ssh ${root}@${system} ${command}
+RCP_COMMAND: scp ${files} ${root}@${system}:${destination}</programlisting>
 
-              <member><replaceable>command</replaceable> - For RSH_COMMAND,
-              the command to be executed on the firewall system.</member>
+          <para>Shell variables that will be set when the commands are invoked
+          are as follows:</para>
 
-              <member><replaceable>files</replaceable> - For RCP_COMMAND, a
-              space-separated list of files to be copied to the remote
-              firewall system.</member>
-
-              <member><replaceable>destination</replaceable> - The directory
-              on the remote system that the files are to be copied
-              into.</member>
-            </simplelist></para>
+          <programlisting><replaceable>root</replaceable>        - root user. Normally <option>root</option> but may be overridden using the '-r' option.
+<replaceable>system</replaceable>      - The name/IP address of the remote firewall system.
+<replaceable>command</replaceable>     - For RSH_COMMAND, the command to be executed on the firewall system.
+<replaceable>files</replaceable>       - For RCP_COMMAND, a space-separated list of files to be copied to the remote firewall system.
+<replaceable>destination</replaceable> - The directory on the remote system that the files are to be copied into.</programlisting>
         </listitem>
       </varlistentry>
 

Shorewall6-lite/init.debian.sh

@@ -13,7 +13,7 @@
 
 . /lib/lsb/init-functions
 
-SRWL=/sbin/shorewall6-lite
+SRWL='/sbin/shorewall6-lite -6'
 SRWL_OPTS="-tvv"
 test -n ${INITLOG:=/var/log/shorewall6-lite-init.log}
 

Shorewall6-lite/init.fedora.sh

@@ -25,7 +25,7 @@
 #
 . /usr/share/shorewall/shorewallrc
 
-prog="shorewall6-lite"
+prog="shorewall -6l"
 shorewall="${SBINDIR}/$prog"
 logger="logger -i -t $prog"
 lockfile="/var/lock/subsys/$prog"

Shorewall6-lite/init.openwrt.sh

@@ -79,17 +79,17 @@ boot() {
 }
 
 restart() {
-	exec ${SBINDIR}/shorewall6-lite $OPTIONS $command $RESTARTOPTIONS
+	exec ${SBINDIR}/shorewall -6l $OPTIONS $command $RESTARTOPTIONS
 }
 
 reload() {
-	exec ${SBINDIR}/shorewall6-lite $OPTIONS $command $RELOADOPTION
+	exec ${SBINDIR}/shorewall -6l $OPTIONS $command $RELOADOPTION
 }
 
 stop() {
-	exec ${SBINDIR}/shorewall6-lite $OPTIONS $command $STOPOPTIONS
+	exec ${SBINDIR}/shorewall -6l $OPTIONS $command $STOPOPTIONS
 }
 
 status() {
-	exec ${SBINDIR}/shorewall6-lite $OPTIONS $command $@
+	exec ${SBINDIR}/shorewall -6l $OPTIONS $command $@
 }

Shorewall6-lite/init.sh

@@ -76,13 +76,13 @@ command="$1"
 
 case "$command" in
     start)
-	exec ${SBINDIR}/shorewall6-lite $OPTIONS start $STARTOPTIONS
+	exec ${SBINDIR}/shorewall -6l $OPTIONS start $STARTOPTIONS
 	;;
     restart|reload)
-	exec ${SBINDIR}/shorewall6-lite $OPTIONS restart $RESTARTOPTIONS
+	exec ${SBINDIR}/shorewall -6l $OPTIONS restart $RESTARTOPTIONS
 	;;
     status|stop)
-	exec ${SBINDIR}/shorewall6-lite $OPTIONS $command $@
+	exec ${SBINDIR}/shorewall -6l $OPTIONS $command $@
 	;;
     *)
 	usage

Shorewall6-lite/init.suse.sh

@@ -73,13 +73,13 @@ command="$1"
 
 case "$command" in
     start)
-	exec ${SBINDIR}/shorewall6-lite $OPTIONS start $STARTOPTIONS
+	exec ${SBINDIR}/shorewall -6l $OPTIONS start $STARTOPTIONS
 	;;
     restart|reload)
-	exec ${SBINDIR}/shorewall6-lite $OPTIONS restart $RESTARTOPTIONS
+	exec ${SBINDIR}/shorewall -6l $OPTIONS restart $RESTARTOPTIONS
 	;;
     status|stop)
-	exec ${SBINDIR}/shorewall6-lite $OPTIONS $command $@
+	exec ${SBINDIR}/shorewall -6l $OPTIONS $command $@
 	;;
     *)
 	usage

Shorewall6-lite/shorecap

@@ -44,18 +44,19 @@
 #    used during firewall compilation, then the generated firewall program will likewise not
 #    require Shorewall to be installed.
 
-g_program=shorewall6-lite
+PRODUCT=shorewall6-lite
 
 #
 # This is modified by the installer when ${SHAREDIR} != /usr/share
 #
 . /usr/share/shorewall/shorewallrc
 
-g_sharedir="$SHAREDIR"/shorewall6-lite
-g_confdir="$CONFDIR"/shorewall6-lite
-g_readrc=1
+g_basedir=${SHAREDIR}/shorewall
 
 . ${SHAREDIR}/shorewall/lib.cli
+
+setup_product_environment
+
 . ${SHAREDIR}/shorewall-lite/configpath
 
 [ -n "$PATH" ] || PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin

Shorewall6-lite/shorewall6-lite

@@ -1,42 +0,0 @@
-#!/bin/sh
-#
-#     Shorewall6 Lite Packet Filtering Firewall Control Program - V4.5
-#
-#     (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011, 2012-2014
-#         Tom Eastep (teastep@shorewall.net)
-#
-#	Shorewall documentation is available at http://www.shorewall.net
-#
-#       This program is part of Shorewall.
-#
-#	This program is free software; you can redistribute it and/or modify
-#	it under the terms of the GNU General Public License as published by the
-#       Free Software Foundation, either version 2 of the license or, at your
-#       option, any later version.
-#
-#	This program is distributed in the hope that it will be useful,
-#	but WITHOUT ANY WARRANTY; without even the implied warranty of
-#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-#	GNU General Public License for more details.
-#
-#	You should have received a copy of the GNU General Public License
-#	along with this program; if not, see <http://www.gnu.org/licenses/>.
-#
-#       For a list of supported commands, type 'shorewall help' or 'shorewall6 help'
-#
-################################################################################################
-PRODUCT=shorewall6-lite
-
-#
-# This is modified by the installer when ${SHAREDIR} != /usr/share
-#
-. /usr/share/shorewall/shorewallrc
-
-g_program=$PRODUCT
-g_sharedir="$SHAREDIR"/shorewall6-lite
-g_confdir="$CONFDIR"/shorewall6-lite
-g_readrc=1
-
-. ${SHAREDIR}/shorewall/lib.cli
-
-shorewall_cli $@

Shorewall6-lite/shorewall6-lite.service

@@ -14,8 +14,9 @@ Type=oneshot
 RemainAfterExit=yes
 EnvironmentFile=-/etc/sysconfig/shorewall6-lite
 StandardOutput=syslog
-ExecStart=/sbin/shorewall6-lite $OPTIONS start $STARTOPTIONS
-ExecStop=/sbin/shorewall6-lite $OPTIONS stop
+ExecStart=/sbin/shorewal -6l $OPTIONS start $STARTOPTIONS
+ExecStop=/sbin/shorewall -6l $OPTIONS stop
+ExecReload=/sbin/shorewall -6l $OPTIONS reload $RELOADOPTIONS
 
 [Install]
 WantedBy=basic.target

Shorewall6/Macros/macro.mDNSbi

@@ -0,0 +1,14 @@
+#
+# Shorewall6 -- /usr/share/shorewall6/macro.mDNSbi
+#
+# This macro handles bidirectional multicast DNS traffic.
+#
+###############################################################################
+#ACTION SOURCE  DEST                    PROTO   DPORT   SPORT
+
+PARAM   -       [ff02::fb]              udp     5353
+PARAM   -       -                       udp     1024:   5353
+PARAM   -       [ff02::fb]              2
+PARAM   DEST    SOURCE:[ff02::fb]       udp     5353
+PARAM   DEST    SOURCE                  udp     1024:   5353
+PARAM   DEST    SOURCE:[ff02::fb]       2

Shorewall6/Samples6/Universal/shorewall6.conf

@@ -1,6 +1,6 @@
 ###############################################################################
 #
-#  Shorewall Version 4 -- /etc/shorewall6/shorewall6.conf
+#  Shorewall Version 5 -- /etc/shorewall6/shorewall6.conf
 #
 #  For information about the settings in this file, type "man shorewall6.conf"
 #
@@ -46,9 +46,9 @@ LOGALLNEW=
 
 LOGFILE=
 
-LOGFORMAT="Shorewall:%s:%s:"
+LOGFORMAT="%s %s "
 
-LOGLIMIT=
+LOGLIMIT="s:1/sec:10"
 
 LOGTAGONLY=No
 
@@ -92,7 +92,7 @@ PERL=/usr/bin/perl
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
 
-RESTOREFILE=
+RESTOREFILE=restore
 
 SHOREWALL_SHELL=/bin/sh
 
@@ -137,11 +137,9 @@ BASIC_FILTERS=No
 
 BLACKLIST="NEW,INVALID,UNTRACKED"
 
-CHAIN_SCRIPTS=No
-
 CLAMPMSS=No
 
-CLEAR_TC=Yes
+CLEAR_TC=No
 
 COMPLETE=Yes
 
@@ -171,7 +169,7 @@ INLINE_MATCHES=Yes
 
 IPSET_WARNINGS=Yes
 
-IP_FORWARDING=keep
+IP_FORWARDING=Keep
 
 KEEP_RT_TABLES=Yes
 
@@ -264,5 +262,3 @@ PROVIDER_OFFSET=
 MASK_BITS=
 
 ZONE_BITS=0
-
-#LAST LINE -- DO NOT REMOVE

Shorewall6/Samples6/one-interface/shorewall6.conf

@@ -47,9 +47,9 @@ LOGALLNEW=
 
 LOGFILE=
 
-LOGFORMAT="Shorewall:%s:%s:"
+LOGFORMAT="%s %s "
 
-LOGLIMIT=
+LOGLIMIT="s:1/sec:10"
 
 LOGTAGONLY=No
 
@@ -73,7 +73,7 @@ UNTRACKED_LOG_LEVEL=
 #	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
 ###############################################################################
 
-CONFIG_PATH=${CONFDIR}/shorewall6:${SHAREDIR}/shorewall6:${SHAREDIR}/shorewall
+CONFIG_PATH="${CONFDIR}/shorewall6:/usr/share/shorewall6:${SHAREDIR}/shorewall"
 
 GEOIPDIR=/usr/share/xt_geoip/LE
 
@@ -93,7 +93,7 @@ PERL=/usr/bin/perl
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
 
-RESTOREFILE=
+RESTOREFILE=restore
 
 SHOREWALL_SHELL=/bin/sh
 
@@ -138,11 +138,9 @@ BASIC_FILTERS=No
 
 BLACKLIST="NEW,INVALID,UNTRACKED"
 
-CHAIN_SCRIPTS=No
-
 CLAMPMSS=No
 
-CLEAR_TC=Yes
+CLEAR_TC=No
 
 COMPLETE=No
 
@@ -154,13 +152,13 @@ DONT_LOAD=
 
 DYNAMIC_BLACKLIST=Yes
 
-EXPAND_POLICIES=No
+EXPAND_POLICIES=Yes
 
 EXPORTMODULES=Yes
 
 FASTACCEPT=No
 
-FORWARD_CLEAR_MARK=
+FORWARD_CLEAR_MARK=Yes
 
 HELPERS=
 
@@ -172,7 +170,7 @@ INLINE_MATCHES=Yes
 
 IPSET_WARNINGS=Yes
 
-IP_FORWARDING=keep
+IP_FORWARDING=Keep
 
 KEEP_RT_TABLES=Yes
 
@@ -265,5 +263,3 @@ PROVIDER_OFFSET=
 MASK_BITS=
 
 ZONE_BITS=0
-
-#LAST LINE -- DO NOT REMOVE

Shorewall6/Samples6/three-interfaces/shorewall6.conf

@@ -1,6 +1,6 @@
 ###############################################################################
 #
-#  Shorewall Version 4 -- /etc/shorewall6/shorewall6.conf
+#  Shorewall Version 5 -- /etc/shorewall6/shorewall6.conf
 #
 #  For information about the settings in this file, type "man shorewall6.conf"
 #
@@ -46,9 +46,9 @@ LOGALLNEW=
 
 LOGFILE=/var/log/messages
 
-LOGFORMAT="Shorewall:%s:%s:"
+LOGFORMAT="%s %s "
 
-LOGLIMIT=
+LOGLIMIT="s:1/sec:10"
 
 LOGTAGONLY=No
 
@@ -92,7 +92,7 @@ PERL=/usr/bin/perl
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
 
-RESTOREFILE=
+RESTOREFILE=restore
 
 SHOREWALL_SHELL=/bin/sh
 
@@ -137,11 +137,9 @@ BASIC_FILTERS=No
 
 BLACKLIST="NEW,INVALID,UNTRACKED"
 
-CHAIN_SCRIPTS=No
-
 CLAMPMSS=No
 
-CLEAR_TC=Yes
+CLEAR_TC=No
 
 COMPLETE=No
 
@@ -171,7 +169,7 @@ INLINE_MATCHES=Yes
 
 IPSET_WARNINGS=Yes
 
-IP_FORWARDING=keep
+IP_FORWARDING=Keep
 
 KEEP_RT_TABLES=Yes
 
@@ -264,5 +262,3 @@ PROVIDER_OFFSET=
 MASK_BITS=
 
 ZONE_BITS=0
-
-#LAST LINE -- DO NOT REMOVE

Shorewall6/Samples6/two-interfaces/shorewall6.conf

@@ -46,9 +46,9 @@ LOGALLNEW=
 
 LOGFILE=/var/log/messages
 
-LOGFORMAT="Shorewall:%s:%s:"
+LOGFORMAT="%s %s "
 
-LOGLIMIT=
+LOGLIMIT="s:1/sec:10"
 
 LOGTAGONLY=No
 
@@ -92,7 +92,7 @@ PERL=/usr/bin/perl
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
 
-RESTOREFILE=
+RESTOREFILE=restore
 
 SHOREWALL_SHELL=/bin/sh
 
@@ -137,11 +137,9 @@ BASIC_FILTERS=No
 
 BLACKLIST="NEW,INVALID,UNTRACKED"
 
-CHAIN_SCRIPTS=No
-
 CLAMPMSS=No
 
-CLEAR_TC=Yes
+CLEAR_TC=No
 
 COMPLETE=No
 
@@ -153,7 +151,7 @@ DONT_LOAD=
 
 DYNAMIC_BLACKLIST=Yes
 
-EXPAND_POLICIES=No
+EXPAND_POLICIES=Yes
 
 EXPORTMODULES=Yes
 
@@ -171,7 +169,7 @@ INLINE_MATCHES=Yes
 
 IPSET_WARNINGS=Yes
 
-IP_FORWARDING=keep
+IP_FORWARDING=Keep
 
 KEEP_RT_TABLES=Yes
 
@@ -264,5 +262,3 @@ PROVIDER_OFFSET=
 MASK_BITS=
 
 ZONE_BITS=0
-
-#LAST LINE -- DO NOT REMOVE

Shorewall6/configfiles/mangle

@@ -10,5 +10,5 @@
 # See http://shorewall.net/PacketMarking.html for a detailed description of
 # the Netfilter/Shorewall packet marking mechanism.
 #
-############################################################################################################################################################
-#ACTION		SOURCE		DEST		PROTO	DPORT	SPORT	USER	TEST	LENGTH	TOS	CONNBYTES	HELPER	HEADERS	PROBABILITY	DSCP
+######################################################################################################################################################################
+#ACTION		SOURCE		DEST		PROTO	DPORT	SPORT	USER	TEST	LENGTH	TOS	CONNBYTES	HELPER	HEADERS	PROBABILITY	DSCP	SWITCH

Shorewall6/configfiles/shorewall6.conf

@@ -46,9 +46,9 @@ LOGALLNEW=
 
 LOGFILE=/var/log/messages
 
-LOGFORMAT="Shorewall:%s:%s:"
+LOGFORMAT="%s %s "
 
-LOGLIMIT=
+LOGLIMIT="s:1/sec:10"
 
 LOGTAGONLY=No
 
@@ -131,14 +131,12 @@ AUTOCOMMENT=Yes
 
 AUTOHELPERS=Yes
 
-AUTOMAKE=No
+AUTOMAKE=Yes
 
 BASIC_FILTERS=No
 
 BLACKLIST="NEW,INVALID,UNTRACKED"
 
-CHAIN_SCRIPTS=Yes
-
 CLAMPMSS=No
 
 CLEAR_TC=No
@@ -189,7 +187,7 @@ MODULE_SUFFIX=ko
 
 MUTEX_TIMEOUT=60
 
-OPTIMIZE=1
+OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 

Shorewall6/configfiles/snat

@@ -0,0 +1,9 @@
+#
+# Shorewall6 -- /etc/shorewall6/snat
+#
+# For information about entries in this file, type "man shorewall6-snat"
+#
+# See http://shorewall.net/manpages6/shorewall6-snat.html for more information
+#
+###########################################################################################################################################
+#ACTION			SOURCE			DEST		PROTO	PORT	IPSEC	MARK	USER	SWITCH	ORIGDEST	PROBABILITY

Shorewall6/init.debian.sh

@@ -12,7 +12,7 @@
 
 . /lib/lsb/init-functions
 
-SRWL=/sbin/shorewall6
+SRWL='/sbin/shorewall -6'
 SRWL_OPTS="-tvv"
 WAIT_FOR_IFUP=/usr/share/shorewall/wait4ifup
 test -n ${INITLOG:=/var/log/shorewall6-init.log}

Shorewall6/init.fedora.sh

@@ -25,7 +25,7 @@
 #
 . /usr/share/shorewall/shorewallrc
 
-prog="shorewall6"
+prog="shorewall -6"
 shorewall="${SBINDIR}/$prog"
 logger="logger -i -t $prog"
 lockfile="/var/lock/subsys/$prog"

Shorewall6/init.sh

@@ -77,13 +77,13 @@ command="$1"
 
 case "$command" in
     start)
-	exec ${SBINDIR}/shorewall6 $OPTIONS start $STARTOPTIONS
+	exec ${SBINDIR}/shorewall -6 $OPTIONS start $STARTOPTIONS
 	;;
     restart|reload)
-	exec ${SBINDIR}/shorewall6 $OPTIONS restart $RESTARTOPTIONS
+	exec ${SBINDIR}/shorewall -6 $OPTIONS restart $RESTARTOPTIONS
 	;;
     status|stop)
-	exec ${SBINDIR}/shorewall6 $OPTIONS $command $@
+	exec ${SBINDIR}/shorewall -6 $OPTIONS $command $@
 	;;
     *)
 	usage

Shorewall6/init.slackware.shorewall6.sh

@@ -20,21 +20,21 @@ fi
 
 start() {
 	echo "Starting IPv6 shorewall rules..."
-	exec /sbin/shorewall6 $OPTIONS start $STARTOPTIONS
+	exec /sbin/shorewall -6 $OPTIONS start $STARTOPTIONS
 }
 
 stop() {
 	echo "Stopping IPv6 shorewall rules..."
-	exec /sbin/shorewall6 stop
+	exec /sbin/shorewall -6 stop
 }
 
 restart() {
 	echo "Restarting IPv6 shorewall rules..."
-	exec /sbin/shorewall6 restart $RESTARTOPTIONS
+	exec /sbin/shorewall -6 restart $RESTARTOPTIONS
 }
 
 status() {
-	exec /sbin/shorewall6 status
+	exec /sbin/shorewall -6 status
 }
 
 case "$1" in

Shorewall6/init.suse.sh

@@ -75,13 +75,16 @@ command="$1"
 
 case "$command" in
     start)
-	exec ${SBINDIR}/shorewall6 $OPTIONS start $STARTOPTIONS
+	exec ${SBINDIR}/shorewall -6 $OPTIONS start $STARTOPTIONS
 	;;
-    restart|reload)
-	exec ${SBINDIR}/shorewall6 $OPTIONS restart $RESTARTOPTIONS
+    restart)
+	exec ${SBINDIR}/shorewall -6 $OPTIONS restart $RESTARTOPTIONS
+	;;
+    reload)
+	exec ${SBINDIR}/shorewall -6 $OPTIONS reload $RESTARTOPTIONS
 	;;
     status|stop)
-	exec ${SBINDIR}/shorewall6 $OPTIONS $command $@
+	exec ${SBINDIR}/shorewall -6 $OPTIONS $command $@
 	;;
     *)
 	usage

Shorewall6/manpages/shorewall6-actions.xml

@@ -131,6 +131,18 @@
               </listitem>
             </varlistentry>
 
+            <varlistentry>
+              <term><option>logjump</option></term>
+
+              <listitem>
+                <para>Added in Shorewall 5.0.8. Performs the same function as
+                <option>nolog</option> (below), with the addition that the
+                jump to the actions chain is logged if a log level is
+                specified on the action invocation. For inline actions, this
+                option is identical to <option>nolog</option>.</para>
+              </listitem>
+            </varlistentry>
+
             <varlistentry>
               <term><option>mangle</option></term>
 
@@ -143,6 +155,20 @@
               </listitem>
             </varlistentry>
 
+            <varlistentry>
+              <term><option>nat</option></term>
+
+              <listitem>
+                <para>Added in Shorewall 5.0.13. Specifies that this action is
+                to be used in <ulink
+                url="shorewall6-snat.html">shorewall6-snat(5)</ulink> rather
+                than <ulink
+                url="shorewall6-rules.html">shorewall6-rules(5)</ulink>. The
+                <option>mangle</option> and <option>nat</option> options are
+                mutually exclusive.</para>
+              </listitem>
+            </varlistentry>
+
             <varlistentry>
               <term><option>noinline</option></term>
 

Shorewall6/manpages/shorewall6-conntrack.xml

@@ -370,7 +370,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>SOURCE (format 3) ‒
+        <term>SOURCE (format 3 prior to Shorewall 5.1.0) ‒
         {-|<emphasis>interface</emphasis>[:<emphasis>address-list</emphasis>]|<replaceable>address-list</replaceable>}</term>
 
         <listitem>
@@ -388,7 +388,91 @@
       </varlistentry>
 
       <varlistentry>
-        <term>DEST ‒
+        <term><emphasis role="bold">SOURCE (format 3 on Shorewall 5.1.0 and
+        later) -
+        {-|[<replaceable>source-spec</replaceable>[,...]]}</emphasis></term>
+
+        <listitem>
+          <para>where <replaceable>source-spec</replaceable> is one of the
+          following:</para>
+
+          <variablelist>
+            <varlistentry>
+              <term><replaceable>interface</replaceable></term>
+
+              <listitem>
+                <para>Where interface is the logical name of an interface
+                defined in <ulink
+                url="shorewall-interfaces.html">shorewall-interface</ulink>(5).</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>]</term>
+
+              <listitem>
+                <para>where <replaceable>address</replaceable> may be:</para>
+
+                <itemizedlist>
+                  <listitem>
+                    <para>A host or network IP address.</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>A MAC address in Shorewall format (preceded by a
+                    tilde ("~") and using dash ("-") as a separator.</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>The name of an ipset preceded by a plus sign ("+").
+                    See <ulink
+                    url="shorewall-ipsets.html">shorewall-ipsets</ulink>(5).</para>
+                  </listitem>
+                </itemizedlist>
+
+                <para><replaceable>exclusion</replaceable> is described in
+                <ulink
+                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5).</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>interface</replaceable>:<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>]</term>
+
+              <listitem>
+                <para>This form combines the preceding two and requires that
+                both the incoming interace and source address match.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>exclusion</replaceable></term>
+
+              <listitem>
+                <para>See <ulink
+                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>
+                (5)</para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
+
+          <para>Beginning with Shorewall 5.1.0, multiple
+          <replaceable>source-spec</replaceable>s separated by commas may be
+          specified provided that the following alternative forms are
+          used:</para>
+
+          <blockquote>
+            <para>(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
+
+            <para><replaceable>interface</replaceable>:(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
+
+            <para>(<replaceable>exclusion</replaceable>)</para>
+          </blockquote>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>DEST (Prior to Shorewall 5.1.0) ‒
         {-|<emphasis>interface</emphasis>[:<emphasis>address-list</emphasis>]|<replaceable>address-list</replaceable>}</term>
 
         <listitem>
@@ -400,6 +484,89 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><emphasis role="bold">DEST (Shorewall 5.1.0 and later) -
+        {-|<replaceable>dest-spec</replaceable>[,...]}</emphasis></term>
+
+        <listitem>
+          <para>where <replaceable>dest-spec</replaceable> is one of the
+          following:</para>
+
+          <variablelist>
+            <varlistentry>
+              <term><replaceable>interface</replaceable></term>
+
+              <listitem>
+                <para>Where interface is the logical name of an interface
+                defined in <ulink
+                url="shorewall-interfaces.html">shorewall-interface</ulink>(5).</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>]</term>
+
+              <listitem>
+                <para>where <replaceable>address</replaceable> may be:</para>
+
+                <itemizedlist>
+                  <listitem>
+                    <para>A host or network IP address.</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>A MAC address in Shorewall format (preceded by a
+                    tilde ("~") and using dash ("-") as a separator.</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>The name of an ipset preceded by a plus sign ("+").
+                    See <ulink
+                    url="shorewall-ipsets.html">shorewall-ipsets</ulink>(5).</para>
+                  </listitem>
+                </itemizedlist>
+
+                <para><replaceable>exclusion</replaceable> is described in
+                <ulink
+                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5).</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>interface</replaceable>:<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>]</term>
+
+              <listitem>
+                <para>This form combines the preceding two and requires that
+                both the outgoing interace and destination address
+                match.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>exclusion</replaceable></term>
+
+              <listitem>
+                <para>See <ulink
+                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>
+                (5)</para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
+
+          <para>Beginning with Shorewall 5.1.0, multiple source-specs
+          separated by commas may be specified provided that the following
+          alternative forms are used:</para>
+
+          <blockquote>
+            <para>(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
+
+            <para><replaceable>interface</replaceable>:(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
+
+            <para>(<replaceable>exclusion</replaceable>)</para>
+          </blockquote>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term>PROTO ‒
         <replaceable>protocol-name-or-number</replaceable>[,...]</term>

Shorewall6/manpages/shorewall6-mangle.xml

@@ -767,98 +767,252 @@ Normal-Service       =&gt; 0x00</programlisting>
       </varlistentry>
 
       <varlistentry>
-        <term><emphasis role="bold">SOURCE</emphasis> - {<emphasis
-        role="bold">-</emphasis>|{<emphasis>interface</emphasis>|<emphasis
-        role="bold">$FW</emphasis>}|[{<emphasis>interface</emphasis>|<emphasis
-        role="bold">$FW</emphasis>}:]<emphasis>address-or-range</emphasis>[<emphasis
-        role="bold">,</emphasis><emphasis>address-or-range</emphasis>]...}[<emphasis>exclusion</emphasis>]</term>
+        <term><emphasis role="bold">SOURCE -
+        {-|<replaceable>source-spec</replaceable>[,...]}</emphasis></term>
 
         <listitem>
-          <para>May be:</para>
+          <para>where <replaceable>source-spec</replaceable> is one of:</para>
 
-          <orderedlist>
-            <listitem>
-              <para>An interface name - matches traffic entering the firewall
-              on the specified interface. May not be used in classify rules or
-              in rules using the :T chain qualifier.</para>
-            </listitem>
+          <variablelist>
+            <varlistentry>
+              <term><replaceable>interface</replaceable></term>
 
               <listitem>
-              <para>A comma-separated list of host or network IP addresses or
-              MAC addresses. <emphasis role="bold">This form will not match
-              traffic that originates on the firewall itself unless either
-              &lt;major&gt;&lt;minor&gt; or the :T chain qualifier is used in
-              the ACTION column.</emphasis></para>
-
-              <para>Examples:<simplelist>
-                  <member>0.0.0.0/0</member>
-                </simplelist></para>
-
-              <para><simplelist>
-                  <member>192.168.1.0/24, 172.20.4.0/24</member>
-                </simplelist></para>
-            </listitem>
-
-            <listitem>
-              <para>An interface name followed by a colon (":") followed by a
-              comma-separated list of host or network IP addresses or MAC
-              addresses. May not be used in classify rules or in rules using
+                <para>where <replaceable>interface</replaceable> is the
+                logical name of an interface defined in <ulink
+                url="shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5).
+                Matches packets entering the firewall from the named
+                interface. May not be used in CLASSIFY rules or in rules using
                 the :T chain qualifier.</para>
               </listitem>
-
-            <listitem>
-              <para>$FW optionally followed by a colon (":") and a
-              comma-separated list of host or network IP addresses. Matches
-              packets originating on the firewall. May not be used with a
-              chain qualifier (:P, :F, etc.) in the ACTION column.</para>
-            </listitem>
-          </orderedlist>
-
-          <para>MAC addresses must be prefixed with "~" and use "-" as a
-          separator.</para>
-
-          <para>Example: ~00-A0-C9-15-39-78</para>
-
-          <para>You may exclude certain hosts from the set already defined
-          through use of an <emphasis>exclusion</emphasis> (see <ulink
-          url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
-        </listitem>
             </varlistentry>
 
             <varlistentry>
-        <term><emphasis role="bold">DEST</emphasis> - {<emphasis
-        role="bold">-</emphasis>|{<emphasis>interface</emphasis>|$FW}|[<emphasis>{interface</emphasis>|$FW}:]<emphasis>address-or-range</emphasis>[<emphasis
-        role="bold">,</emphasis><emphasis>address-or-range</emphasis>]...}[<emphasis>exclusion</emphasis>]</term>
+              <term><replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>]</term>
 
               <listitem>
-          <para>May be:</para>
+                <para>where <replaceable>address</replaceable> is:</para>
 
-          <orderedlist>
-            <listitem>
-              <para>An interface name. May not be used in the PREROUTING chain
-              (:P in the mark column or no chain qualifier and
-              MARK_IN_FORWARD_CHAIN=No in <ulink
-              url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>
-              (5)). The interface name may be optionally followed by a colon
-              (":") and an IP address list.</para>
+                <blockquote>
+                  <para>A host or network IP address.</para>
+
+                  <para>The name of an ipset preceded by a plus sign
+                  ("+").</para>
+
+                  <para>A MAC address in Shorewall format (preceded by a tilde
+                  ("~") and using dash ("-") as a separator (e.g.,
+                  ~00-A0-C9-15-39-78).</para>
+                </blockquote>
+
+                <para>Matches traffic whose source IP address matches one of
+                the listed addresses and that does not match an address listed
+                in the <replaceable>exclusion</replaceable> (see <ulink
+                url="shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
+
+                <para><emphasis role="bold">This form will not match traffic
+                that originates on the firewall itself unless either
+                &lt;major&gt;&lt;minor&gt; or the :T chain qualifier is used
+                in the ACTION column.</emphasis></para>
               </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>interface</replaceable>:<replaceable>address</replaceable>,[...][<replaceable>exclusion</replaceable>]</term>
 
               <listitem>
-              <para>A comma-separated list of host or network IP addresses.
-              The list may include ip address ranges if your kernel and
-              iptables include iprange support.</para>
+                <para>This form combines the preceding two forms and matches
+                when both the incoming interface and source IP address
+                match.</para>
               </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>interface</replaceable>:<replaceable>exclusion</replaceable></term>
 
               <listitem>
-              <para>Beginning with Shorewall 4.4.13, $FW may be specified by
-              itself or qualified by an address list. This causes marking to
-              occur in the INPUT chain.</para>
+                <para>This form matches packets arriving through the named
+                <replaceable>interface</replaceable> and whose source IP
+                address does not match any of the addresses in the
+                <replaceable>exclusion</replaceable>.</para>
               </listitem>
-          </orderedlist>
+            </varlistentry>
 
-          <para>You may exclude certain hosts from the set already defined
-          through use of an <emphasis>exclusion</emphasis> (see <ulink
-          url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
+            <varlistentry>
+              <term>$FW</term>
+
+              <listitem>
+                <para>Matches packets originating on the firewall system. May
+                not be used with a chain qualifier (:P, :F, etc.) in the
+                ACTION column.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>$FW:<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>]</term>
+
+              <listitem>
+                <para>where <replaceable>address</replaceable> is as above
+                (MAC addresses are not permitted). Matches packets originating
+                on the firewall and whose source IP address matches one of the
+                listed addresses and does not match any address listed in the
+                <replaceable>exclusion</replaceable>. May not be used with a
+                chain qualifier (:P, :F, etc.) in the ACTION column.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>$FW:<replaceable>exclusion</replaceable></term>
+
+              <listitem>
+                <para>Matches traffic originating on the firewall, provided
+                that the source IP address does not match any address listed
+                in the <replaceable>exclusion</replaceable>.</para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
+
+          <para>Beginning with Shorewall 5.1.0, multiple
+          <replaceable>source_spec</replaceable>s, separated by commas, may be
+          given provided that the following alternative forms are used:</para>
+
+          <blockquote>
+            <para>(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
+
+            <para><replaceable>interface</replaceable>:(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
+
+            <para><replaceable>interface</replaceable>:(<replaceable>exclusion</replaceable>)</para>
+
+            <para>$FW:(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
+
+            <para>$FW:(<replaceable>exclusion</replaceable>)</para>
+          </blockquote>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">DEST -
+        {-|<replaceable>dest-spec</replaceable>[,...]}</emphasis></term>
+
+        <listitem>
+          <para>where <replaceable>dest-spec</replaceable> is one of:</para>
+
+          <variablelist>
+            <varlistentry>
+              <term><replaceable>interface</replaceable></term>
+
+              <listitem>
+                <para>where <replaceable>interface</replaceable> is the
+                logical name of an interface defined in <ulink
+                url="shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5).
+                Matches packets leaving the firewall through the named
+                interface. May not be used in the PREROUTING chain (:P in the
+                mark column or no chain qualifier and MARK_IN_FORWARD_CHAIN=No
+                in <ulink url="shorewall6.conf">shorewall6.conf</ulink>
+                (5)).</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>]</term>
+
+              <listitem>
+                <para>where <replaceable>address</replaceable> is:</para>
+
+                <blockquote>
+                  <para>A host or network IP address.</para>
+
+                  <para>The name of an ipset preceded by a plus sign
+                  ("+").</para>
+
+                  <para>A MAC address in Shorewall format (preceded by a tilde
+                  ("~") and using dash ("-") as a separator (e.g.,
+                  ~00-A0-C9-15-39-78).</para>
+                </blockquote>
+
+                <para>Matches traffic whose destination IP address matches one
+                of the listed addresses and that does not match an address
+                listed in the <replaceable>exclusion</replaceable> (see <ulink
+                url="shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>interface</replaceable>:<replaceable>address</replaceable>,[...][<replaceable>exclusion</replaceable>]</term>
+
+              <listitem>
+                <para>This form combines the preceding two forms and matches
+                when both the outgoing interface and destination IP address
+                match. May not be used in the PREROUTING chain (:P in the mark
+                column or no chain qualifier and MARK_IN_FORWARD_CHAIN=No in
+                <ulink url="shorewall6.conf">shorewall6.conf</ulink>
+                (5)).</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>interface</replaceable>:<replaceable>exclusion</replaceable></term>
+
+              <listitem>
+                <para>This form matches packets leaving through the named
+                <replaceable>interface</replaceable> and whose destination IP
+                address does not match any of the addresses in the
+                <replaceable>exclusion</replaceable>. May not be used in the
+                PREROUTING chain (:P in the mark column or no chain qualifier
+                and MARK_IN_FORWARD_CHAIN=No in <ulink
+                url="shorewall6.conf">shorewall6.conf</ulink> (5)).</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>$FW</term>
+
+              <listitem>
+                <para>Matches packets originating on the firewall system. May
+                not be used with a chain qualifier (:P, :F, etc.) in the
+                ACTION column.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>$FW:<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>]</term>
+
+              <listitem>
+                <para>where <replaceable>address</replaceable> is as above
+                (MAC addresses are not permitted). Matches packets destined
+                for the firewall and whose destination IP address matches one
+                of the listed addresses and does not match any address listed
+                in the <replaceable>exclusion</replaceable>. May not be used
+                with a chain qualifier (:P, :F, etc.) in the ACTION
+                column.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>$FW:<replaceable>exclusion</replaceable></term>
+
+              <listitem>
+                <para>Matches traffic destined for the firewall, provided that
+                the destination IP address does not match any address listed
+                in the <replaceable>exclusion</replaceable>.</para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
+
+          <para>Beginning with Shorewall 5.1.0, multiple
+          <replaceable>dest_spec</replaceable>s, separated by commas, may be
+          given provided that the following alternative forms are used:</para>
+
+          <blockquote>
+            <para>(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
+
+            <para><replaceable>interface</replaceable>:(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
+
+            <para><replaceable>interface</replaceable>:(<replaceable>exclusion</replaceable>)</para>
+
+            <para>$FW:(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
+
+            <para>$FW:(<replaceable>exclusion</replaceable>)</para>
+          </blockquote>
         </listitem>
       </varlistentry>
 
@@ -1408,6 +1562,54 @@ Normal-Service       =&gt; 0x00</programlisting>
           </variablelist>
         </listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">SWITCH -
+        [!]<replaceable>switch-name</replaceable>[={0|1}]</emphasis></term>
+
+        <listitem>
+          <para>Added in Shorewall 5.1.0 and allows enabling and disabling the
+          rule without requiring <command>shorewall -6
+          restart</command>.</para>
+
+          <para>The rule is enabled if the value stored in
+          <filename>/proc/net/nf_condition/<replaceable>switch-name</replaceable></filename>
+          is 1. The rule is disabled if that file contains 0 (the default). If
+          '!' is supplied, the test is inverted such that the rule is enabled
+          if the file contains 0.</para>
+
+          <para>Within the <replaceable>switch-name</replaceable>, '@0' and
+          '@{0}' are replaced by the name of the chain to which the rule is a
+          added. The <replaceable>switch-name</replaceable> (after '@...'
+          expansion) must begin with a letter and be composed of letters,
+          decimal digits, underscores or hyphens. Switch names must be 30
+          characters or less in length.</para>
+
+          <para>Switches are normally <emphasis role="bold">off</emphasis>. To
+          turn a switch <emphasis role="bold">on</emphasis>:</para>
+
+          <simplelist>
+            <member><command>echo 1 &gt;
+            /proc/net/nf_condition/<replaceable>switch-name</replaceable></command></member>
+          </simplelist>
+
+          <para>To turn it <emphasis role="bold">off</emphasis> again:</para>
+
+          <simplelist>
+            <member><command>echo 0 &gt;
+            /proc/net/nf_condition/<replaceable>switch-name</replaceable></command></member>
+          </simplelist>
+
+          <para>Switch settings are retained over <command>shorewall
+          restart</command>.</para>
+
+          <para>When the <replaceable>switch-name</replaceable> is followed by
+          <option>=0</option> or <option>=1</option>, then the switch is
+          initialized to off or on respectively by the
+          <command>start</command> command. Other commands do not affect the
+          switch setting.</para>
+        </listitem>
+      </varlistentry>
     </variablelist>
   </refsect1>
 

Shorewall6/manpages/shorewall6-masq.xml

@@ -125,7 +125,7 @@
       <varlistentry>
         <term><emphasis role="bold">ADDRESS</emphasis> (Optional) - [<emphasis
         role="bold">-</emphasis>|<emphasis
-        role="bold">NONAT</emphasis>|[<emphasis>address-or-address-range</emphasis>[,<emphasis>address-or-address-range</emphasis>]...][:<emphasis>lowport</emphasis><emphasis
+        role="bold">NONAT</emphasis>|[<emphasis>address-or-address-range</emphasis>][:<emphasis>lowport</emphasis><emphasis
         role="bold">-</emphasis><emphasis>highport</emphasis>][<emphasis
         role="bold">:random</emphasis>][:persistent]|<emphasis
         role="bold">detect</emphasis>|<emphasis

Shorewall6/manpages/shorewall6-rules.xml

@@ -606,7 +606,7 @@
 
             <varlistentry>
               <term><emphasis
-              role="bold">NFQUEUE</emphasis>[([<replaceable>queuenumber</replaceable>1[:<replaceable>queuenumber2</replaceable>][,bypass]]|bypass)]</term>
+              role="bold">NFQUEUE</emphasis>[([<replaceable>queuenumber</replaceable>1[:<replaceable>queuenumber2</replaceable>[c]][,bypass]]|bypass)]</term>
 
               <listitem>
                 <para>Queues the packet to a user-space application using the
@@ -625,17 +625,24 @@
                 systems: start multiple instances of the userspace program on
                 queues x, x+1, .. x+n and use "x:x+n". Packets belonging to
                 the same connection are put into the same nfqueue.</para>
+
+                <para>Beginning with Shorewall 5.1.0, queuenumber2 may be
+                followed by the letter 'c' to indicate that the CPU ID will be
+                used as an index to map packets to the queues. The idea is
+                that you can improve performance if there's a queue per CPU.
+                Requires the NFQUEUE CPU Fanout capability in your kernel and
+                iptables.</para>
               </listitem>
             </varlistentry>
 
             <varlistentry>
               <term><emphasis role="bold"><emphasis
-              role="bold">NFQUEUE!</emphasis>[([<replaceable>queuenumber1</replaceable>[,<replaceable>queuenumber2</replaceable>][,bypass]]|bypass)]</emphasis></term>
+              role="bold">NFQUEUE!</emphasis>[([<replaceable>queuenumber1</replaceable>[:<replaceable>queuenumber2</replaceable>[c]][,bypass]]|bypass)]</emphasis></term>
 
               <listitem>
                 <para>like NFQUEUE but exempts the rule from being suppressed
                 by OPTIMIZE=1 in <ulink
-                url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
+                url="shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
               </listitem>
             </varlistentry>
 
@@ -822,8 +829,8 @@
 
           <para>If the <emphasis role="bold">ACTION</emphasis> names an
           <emphasis>action</emphasis> declared in <ulink
-          url="/manpages/shorewall-actions.html">shorewall-actions</ulink>(5)
-          or in /usr/share/shorewall/actions.std then:</para>
+          url="shorewall6-actions.html">shorewall6-actions</ulink>(5) or in
+          /usr/share/shorewall/actions.std then:</para>
 
           <itemizedlist>
             <listitem>
@@ -861,106 +868,207 @@
       </varlistentry>
 
       <varlistentry>
-        <term><emphasis role="bold">SOURCE</emphasis> -
-        {<emphasis>zone</emphasis>|<emphasis>zone-list</emphasis>[+]|<emphasis
-        role="bold">{all|any}</emphasis>[<emphasis
-        role="bold">+</emphasis>][<emphasis
-        role="bold">-</emphasis>]}<emphasis
-        role="bold">[:</emphasis><emphasis>interface</emphasis>][<emphasis
-        role="bold">:<option>&lt;</option></emphasis>{<emphasis>address-or-range</emphasis>[,<emphasis>address-or-range</emphasis>]...[<emphasis>exclusion</emphasis>]<option>&gt;</option>|<emphasis>exclusion</emphasis>|<emphasis
-        role="bold">+</emphasis><emphasis>ipset</emphasis>|<replaceable>^countrycode-list</replaceable>}</term>
+        <term><emphasis role="bold">SOURCE -
+        <replaceable>source-spec</replaceable>[,...]</emphasis></term>
 
         <listitem>
-          <para>Source hosts to which the rule applies. May be a zone declared
-          in /etc/shorewall6/zones, <emphasis role="bold">$FW</emphasis> to
-          indicate the firewall itself, <emphasis role="bold">all</emphasis>,
-          <emphasis role="bold">all+</emphasis>, <emphasis
-          role="bold">all-</emphasis>, <emphasis role="bold">all+-</emphasis>
-          or <emphasis role="bold">none</emphasis>.</para>
+          <para>Source hosts to which the rule applies.</para>
 
-          <para>Beginning with Shorewall 4.4.13, you may use a
-          <replaceable>zone-list </replaceable>which consists of a
-          comma-separated list of zones declared in <ulink
-          url="/manpages6/shorewall6-zones.html">shorewall6-zones</ulink> (5).
-          This <replaceable>zone-list</replaceable> may be optionally followed
-          by "+" to indicate that the rule is to apply to intra-zone traffic
-          as well as inter-zone traffic.</para>
+          <para><replaceable>source-spec</replaceable> is one of the
+          following:</para>
 
-          <para>When <emphasis role="bold">none</emphasis> is used either in
-          the <emphasis role="bold">SOURCE</emphasis> or <emphasis
-          role="bold">DEST</emphasis> column, the rule is ignored.</para>
+          <variablelist>
+            <varlistentry>
+              <term><emphasis
+              role="bold"><replaceable>zone</replaceable>[,...[+]]</emphasis></term>
 
-          <para><emphasis role="bold">all</emphasis> means "All Zones",
-          including the firewall itself. <emphasis role="bold">all-</emphasis>
-          means "All Zones, except the firewall itself". When <emphasis
-          role="bold">all</emphasis>[<emphasis role="bold">-</emphasis>] is
-          used either in the <emphasis role="bold">SOURCE</emphasis> or
-          <emphasis role="bold">DEST</emphasis> column intra-zone traffic is
-          not affected. When <emphasis role="bold">all+</emphasis>[<emphasis
-          role="bold">-</emphasis>] is "used, intra-zone traffic is affected.
-          Beginning with Shorewall 4.4.13, exclusion is supported -- see see
-          <ulink
-          url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5).</para>
+              <listitem>
+                <para>The name of a zone defined in <ulink
+                url="shorewall6-zones.html">shorewall6-zones</ulink>(5). When
+                only the zone name is specified, the packet source may be any
+                host in that zone.</para>
 
-          <para><emphasis role="bold">any</emphasis> is equivalent to
-          <emphasis role="bold">all</emphasis> when there are no nested zones.
-          When there are nested zones, <emphasis role="bold">any</emphasis>
-          only refers to top-level zones (those with no parent zones). Note
-          that <emphasis role="bold">any</emphasis> excludes all vserver
-          zones, since those zones are nested within the firewall zone.</para>
+                <para>zone may also be one of the following:</para>
 
-          <para>Except when <emphasis role="bold">all</emphasis>[<emphasis
-          role="bold">+</emphasis>][<emphasis role="bold">-</emphasis>] or
-          <emphasis role="bold">any</emphasis>[<emphasis
-          role="bold">+</emphasis>][<emphasis role="bold">-</emphasis>] is
-          specified, clients may be further restricted to a list of networks
-          and/or hosts by appending ":" and a comma-separated list of network
-          and/or host addresses. Hosts may be specified by IP or MAC address;
-          mac addresses must begin with "~" and must use "-" as a
-          separator.</para>
+                <variablelist>
+                  <varlistentry>
+                    <term>all[+][-]</term>
 
-          <para>Hosts may also be specified as an IP address range using the
-          syntax
-          <emphasis>lowaddress</emphasis>-<emphasis>highaddress</emphasis>.
-          This requires that your kernel and ip6tables contain iprange match
-          support. If your kernel and ip6tables have ipset match support then
-          you may give the name of an ipset prefaced by "+". The ipset name
-          may be optionally followed by a number from 1 to 6 enclosed in
-          square brackets ([]) to indicate the number of levels of source
-          bindings to be matched.</para>
+                    <listitem>
+                      <para><emphasis role="bold">all</emphasis>, without the
+                      "-" means "All Zones, including the firewall zone". If
+                      the "-" is included, the firewall zone is omitted.
+                      Normally all omits intra-zone traffic, but intra-zone
+                      traffic can be included specifying "+".</para>
+                    </listitem>
+                  </varlistentry>
 
-          <para>Beginning with Shorewall6 4.4.17, the primary IP address of a
-          firewall interface can be specified by an ampersand ('&amp;')
-          followed by the logical name of the interface as found in the
-          INTERFACE column of <ulink
-          url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>
+                  <varlistentry>
+                    <term>any[+][-]</term>
+
+                    <listitem>
+                      <para><emphasis role="bold">any</emphasis> is equivalent
+                      to <emphasis role="bold">all</emphasis> when there are
+                      no nested zones. When there are nested zones, <emphasis
+                      role="bold">any</emphasis> only refers to top-level
+                      zones (those with no parent zones). Note that <emphasis
+                      role="bold">any</emphasis> excludes all vserver zones,
+                      since those zones are nested within the firewall
+                      zone.</para>
+                    </listitem>
+                  </varlistentry>
+
+                  <varlistentry>
+                    <term>none</term>
+
+                    <listitem>
+                      <para>When <emphasis role="bold">none</emphasis> is used
+                      either in the <emphasis role="bold">SOURCE</emphasis> or
+                      <emphasis role="bold">DEST</emphasis> column, the rule
+                      is ignored.</para>
+                    </listitem>
+                  </varlistentry>
+                </variablelist>
+
+                <para>Similar to with <emphasis role="bold">all</emphasis> and
+                <emphasis role="bold">any</emphasis>, intra-zone traffic is
+                normally excluded when multiple zones are listed. Intra-zone
+                traffic may be included by following the list with a plus sign
+                ("+").</para>
+
+                <para><emphasis role="bold">all</emphasis> and <emphasis
+                role="bold">any</emphasis> may be followed by an exclamation
+                point ("!") and a comma-separated list of zone names to be
+                omitted.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>zone</replaceable>:<replaceable>interface</replaceable></term>
+
+              <listitem>
+                <para>When this form is used,
+                <replaceable>interface</replaceable> must be the name of an
+                interface associated with the named
+                <replaceable>zone</replaceable> in either <ulink
+                url="shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5)
+                or <ulink
+                url="shorewall6.hosts.html">shorewall6-hosts</ulink>(5). Only
+                packets from hosts in the <replaceable>zone</replaceable> that
+                arrive through the named interface will match the rule.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>zone</replaceable>:<replaceable>address</replaceable>[,...]</term>
+
+              <listitem>
+                <para>where address can be:</para>
+
+                <itemizedlist>
+                  <listitem>
+                    <para>A host or network IP address. IPv6 ddresses must
+                    follow the standard convention and be enclosed in square
+                    brackets (e.g., [2001:470:b:227::0]/64). A network address
+                    may be followed by exclusion (see <ulink
+                    url="shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>An address range, specified using the syntax
+                    <emphasis>lowaddress</emphasis>-<emphasis>highaddress</emphasis>.</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>+<replaceable>ipset</replaceable> where
+                    <replaceable>ipset</replaceable> is the name of an ipset
+                    and must be preceded by a plus sign ("+").</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>A MAC address in Shorewall format (preceded by a
+                    tilde ("~") and with the hex byte values separated by
+                    dashes (e.g., "~00-0a-f6-04-9c-7d").</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>^<replaceable>country-code</replaceable> where
+                    country-code is a two-character ISO-3661 country code
+                    preceded by a caret ("^").</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>^<replaceable>country-code-list</replaceable> where
+                    <replaceable>country-code-list</replaceable> is a
+                    comma-separated list of up to 15 ISO-3661 country codes
+                    enclosed in square brackets ("[...]").</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>The primary IP address of a firewall interface can
+                    be specified by an ampersand ('&amp;') followed by the
+                    logical name of the interface as found in the INTERFACE
+                    column of <ulink
+                    url="shorewall6-interfaces.html">shorewall6-interfaces</ulink>
                     (5).</para>
+                  </listitem>
+                </itemizedlist>
+              </listitem>
+            </varlistentry>
 
-          <para>Beginning with Shorewall 4.5.4, A
-          <replaceable>countrycode-list</replaceable> may be specified. A
-          countrycode-list is a comma-separated list of up to 15 two-character
-          ISO-3661 country codes enclosed in square brackets ('[...]') and
-          preceded by a caret ('^'). When a single country code is given, the
-          square brackets may be omitted. A list of country codes supported by
-          Shorewall may be found at <ulink
-          url="/ISO-3661.html">http://www.shorewall.net/ISO-3661.html</ulink>.
-          Specifying a <replaceable>countrycode-list</replaceable> requires
-          <firstterm>GeoIP Match</firstterm> support in your ip6tables and
-          Kernel.</para>
+            <varlistentry>
+              <term><replaceable>zone</replaceable>:<replaceable>interface</replaceable>:<replaceable>address</replaceable>[,...]</term>
 
-          <para>When an <replaceable>interface</replaceable> is not specified,
-          you may omit the angled brackets ('&lt;' and '&gt;') around the
-          address(es) or you may supply them to improve readability.</para>
+              <listitem>
+                <para>This form combines the preceding two and requires that
+                both the incoming interface and source address match.</para>
+              </listitem>
+            </varlistentry>
 
-          <para>You may exclude certain hosts from the set already defined
-          through use of an <emphasis>exclusion</emphasis> (see <ulink
-          url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
+            <varlistentry>
+              <term><replaceable>zone</replaceable>:<replaceable>exclusion</replaceable></term>
+
+              <listitem>
+                <para>This form matches if the host IP address does not match
+                any of the entries in the exclusion (see <ulink
+                url="shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>zone</replaceable>:<replaceable>interface</replaceable>:<replaceable>exclusion</replaceable></term>
+
+              <listitem>
+                <para>This form matches packets from the named
+                <replaceable>zone</replaceable> entering through the specified
+                <replaceable>interface</replaceable> where the source address
+                does not match any entry in the
+                <replaceable>exclusion</replaceable>.</para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
+
+          <para>Beginning with Shorewall 5.1.0, multiple
+          <replaceable>source-spec</replaceable>s may be listed, provided that
+          extended forms of the source-spec are used:</para>
+
+          <blockquote>
+            <para><replaceable>zone</replaceable>:(<replaceable>interface</replaceable>)</para>
+
+            <para><replaceable>zone</replaceable>:(<replaceable>address</replaceable>[,...])</para>
+
+            <para>zone:(interface:address[,...])</para>
+
+            <para><replaceable>zone</replaceable>:(<replaceable>exclusion</replaceable>)</para>
+
+            <para><replaceable>zone</replaceable>:(<replaceable>interface</replaceable>:<replaceable>exclusion</replaceable>)</para>
+          </blockquote>
 
           <para>Examples:</para>
 
           <variablelist>
             <varlistentry>
-              <term>dmz:2002:ce7c::92b4:1::2</term>
+              <term>dmz:[2002:ce7c:2b4:1::2]</term>
 
               <listitem>
                 <para>Host 2002:ce7c:92b4:1::2 in the DMZ</para>
@@ -976,7 +1084,7 @@
             </varlistentry>
 
             <varlistentry>
-              <term>loc:&lt;2002:cec792b4:1::2,2002:cec792b4:1::44&gt;</term>
+              <term>loc:[2002:cec792b4:1::2],[2002:cec792b4:1::44]</term>
 
               <listitem>
                 <para>Hosts 2002:cec792b4:1::2 and 2002:cec792b4:1::44 in the
@@ -994,11 +1102,11 @@
             </varlistentry>
 
             <varlistentry>
-              <term>net:2001:4d48:ad51:24::/64!2001:4d48:ad51:24:6:/80!2001:4d48:ad51:24:6:/80</term>
+              <term>net:[2001:4d48:ad51:24::]/64![2001:4d48:ad51:24:6::]/80</term>
 
               <listitem>
                 <para>Subnet 2001:4d48:ad51:24::/64 on the Internet except for
-                2001:4d48:ad51:24:6:/80.</para>
+                2001:4d48:ad51:24:6::/80.</para>
               </listitem>
             </varlistentry>
 
@@ -1011,88 +1119,241 @@
               </listitem>
             </varlistentry>
           </variablelist>
+        </listitem>
+      </varlistentry>
 
-          <para>Alternatively, clients may be specified by interface by
-          appending ":" to the zone name followed by the interface name. For
-          example, <emphasis role="bold">loc:eth1</emphasis> specifies a
-          client that communicates with the firewall system through eth1. This
-          may be optionally followed by another colon (":") and an
-          IP/MAC/subnet address as described above (e.g., <emphasis
-          role="bold">loc:eth1:&lt;2002:ce7c::92b4:1::2&gt;</emphasis>).</para>
+      <varlistentry>
+        <term><emphasis role="bold">DEST -
+        <replaceable>dest-spec</replaceable>[,...]</emphasis></term>
 
-          <para>Examples:</para>
+        <listitem>
+          <para>Destination hosts to which the rule applies.</para>
+
+          <para><replaceable>dest-spec</replaceable> is one of the
+          following:</para>
 
           <variablelist>
             <varlistentry>
-              <term>loc:eth1:&lt;2002:cec792b4:1::2,2002:cec792b4:1::44&gt;</term>
+              <term><emphasis
+              role="bold"><replaceable>zone</replaceable>[,...[+]]</emphasis></term>
 
               <listitem>
-                <para>Hosts 2002:cec792b4:1::2 and 2002:cec792b4:1::44 in the
-                Local zone, with <emphasis role="bold">both</emphasis>
-                originating from eth1</para>
-              </listitem>
-            </varlistentry>
-          </variablelist>
+                <para>The name of a zone defined in <ulink
+                url="shorewall6-zones.html">shorewall6-zones</ulink>(5). When
+                only the zone name is specified, the packet destination may be
+                any host in that zone.</para>
+
+                <para>zone may also be one of the following:</para>
+
+                <variablelist>
+                  <varlistentry>
+                    <term>all[+][-]</term>
+
+                    <listitem>
+                      <para><emphasis role="bold">all</emphasis>, without the
+                      "-" means "All Zones, including the firewall zone". If
+                      the "-" is included, the firewall zone is omitted.
+                      Normally all omits intra-zone traffic, but intra-zone
+                      traffic can be included specifying "+".</para>
                     </listitem>
                   </varlistentry>
 
                   <varlistentry>
-        <term><emphasis role="bold"><emphasis role="bold">DEST</emphasis> -
-        {<emphasis>zone|zone-list</emphasis>[+]|<emphasis
-        role="bold">all</emphasis>[<emphasis
-        role="bold">+</emphasis>][<emphasis
-        role="bold">-</emphasis>]}<emphasis
-        role="bold">[:</emphasis><emphasis>interface</emphasis>][<emphasis
-        role="bold">:<option>&lt;</option></emphasis>{<emphasis>address-or-range</emphasis>[,<emphasis>address-or-range</emphasis>]...[<emphasis>exclusion</emphasis>]<option>&gt;</option>|<emphasis>exclusion</emphasis>|<emphasis
-        role="bold">+</emphasis><emphasis>ipset</emphasis>|^<emphasis>countrycode-list</emphasis>}[<option>:</option><replaceable>port</replaceable>[:<emphasis
-        role="bold">random</emphasis>]]</emphasis></term>
+                    <term>any[+][-]</term>
 
                     <listitem>
-          <para>Location of Server. May be a zone declared in <ulink
-          url="/manpages6/shorewall6-zones.html">shorewall6-zones</ulink>(5),
-          $<emphasis role="bold">FW</emphasis> to indicate the firewall
-          itself, <emphasis role="bold">all</emphasis>. <emphasis
-          role="bold">all+</emphasis> or <emphasis
-          role="bold">none</emphasis>.</para>
+                      <para><emphasis role="bold">any</emphasis> is equivalent
+                      to <emphasis role="bold">all</emphasis> when there are
+                      no nested zones. When there are nested zones, <emphasis
+                      role="bold">any</emphasis> only refers to top-level
+                      zones (those with no parent zones). Note that <emphasis
+                      role="bold">any</emphasis> excludes all vserver zones,
+                      since those zones are nested within the firewall
+                      zone.</para>
+                    </listitem>
+                  </varlistentry>
 
-          <para>Beginning with Shorewall 4.4.13, you may use a
-          <replaceable>zone-list </replaceable>which consists of a
-          comma-separated list of zones declared in <ulink
-          url="/manpages6/shorewall6-zones.html">shorewall6-zones</ulink> (5).
-          Ths <replaceable>zone-list</replaceable> may be optionally followed
-          by "+" to indicate that the rule is to apply to intra-zone traffic
-          as well as inter-zone traffic. Beginning with Shorewall-4.4.13,
-          exclusion is supported -- see see <ulink
-          url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5).</para>
+                  <varlistentry>
+                    <term>none</term>
 
-          <para>Beginning with Shorewall6 4.4.17, the primary IP address of a
-          firewall interface can be specified by an ampersand ('&amp;')
-          followed by the logical name of the interface as found in the
-          INTERFACE column of <ulink
-          url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>
+                    <listitem>
+                      <para>When <emphasis role="bold">none</emphasis> is used
+                      either in the <emphasis role="bold">SOURCE</emphasis> or
+                      <emphasis role="bold">DEST</emphasis> column, the rule
+                      is ignored.</para>
+                    </listitem>
+                  </varlistentry>
+                </variablelist>
+
+                <para>Similar to with <emphasis role="bold">all</emphasis> and
+                <emphasis role="bold">any</emphasis>, intra-zone traffic is
+                normally excluded when multiple zones are listed. Intra-zone
+                traffic may be included by following the list with a plus sign
+                ("+").</para>
+
+                <para><emphasis role="bold">all</emphasis> and <emphasis
+                role="bold">any</emphasis> may be followed by an exclamation
+                point ("!") and a comma-separated list of zone names to be
+                omitted.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>zone</replaceable>:<replaceable>interface</replaceable></term>
+
+              <listitem>
+                <para>When this form is used,
+                <replaceable>interface</replaceable> must be the name of an
+                interface associated with the named
+                <replaceable>zone</replaceable> in either <ulink
+                url="shorewall-interfaces.html">shorewall6-interfaces</ulink>(5)
+                or <ulink
+                url="shorewall.hosts.html">shorewall6-hosts</ulink>(5). Only
+                packets to hosts in the <replaceable>zone</replaceable> that
+                are sent through the named interface will match the
+                rule.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>zone</replaceable>:<replaceable>address</replaceable>[,...]</term>
+
+              <listitem>
+                <para>where address can be:</para>
+
+                <itemizedlist>
+                  <listitem>
+                    <para>A host or network IP address. A network address may
+                    be followed by exclusion (see <ulink
+                    url="shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>An address range, specified using the syntax
+                    <emphasis>lowaddress</emphasis>-<emphasis>highaddress</emphasis>.</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>+<replaceable>ipset</replaceable> where
+                    <replaceable>ipset</replaceable> is the name of an ipset
+                    and must be preceded by a plus sign ("+").</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>^<replaceable>country-code</replaceable> where
+                    country-code is a two-character ISO-3661 country code
+                    preceded by a caret ("^").</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>^<replaceable>country-code-list</replaceable> where
+                    <replaceable>country-code-list</replaceable> is a
+                    comma-separated list of up to 15 ISO-3661 country codes
+                    enclosed in square brackets ("[...]").</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>The primary IP address of a firewall interface can
+                    be specified by an ampersand ('&amp;') followed by the
+                    logical name of the interface as found in the INTERFACE
+                    column of <ulink
+                    url="/manpages/shorewall6-interfaces.html">shorewall6-interfaces</ulink>
                     (5).</para>
+                  </listitem>
+                </itemizedlist>
+              </listitem>
+            </varlistentry>
 
-          <para>Beginning with Shorewall 4.5.4, A
-          <replaceable>countrycode-list</replaceable> may be specified. A
-          countrycode-list is a comma-separated list of up to 15 two-character
-          ISO-3661 country codes enclosed in square brackets ('[...]') and
-          preceded by a caret ('^'). When a single country code is given, the
-          square brackets may be omitted. A list of country codes supported by
-          Shorewall may be found at <ulink
-          url="/ISO-3661.html">http://www.shorewall.net/ISO-3661.html</ulink>.
-          Specifying a <replaceable>countrycode-list</replaceable> requires
-          <firstterm>GeoIP Match</firstterm> support in your ip6tables and
-          Kernel.</para>
+            <varlistentry>
+              <term><replaceable>zone</replaceable>:<replaceable>interface</replaceable>:<replaceable>address</replaceable>[,...]</term>
 
-          <para>When <emphasis role="bold">none</emphasis> is used either in
-          the <emphasis role="bold">SOURCE</emphasis> or <emphasis
-          role="bold">DEST</emphasis> column, the rule is ignored.</para>
+              <listitem>
+                <para>This form combines the preceding two and requires that
+                both the outgoing interface and destinationaddress
+                match.</para>
+              </listitem>
+            </varlistentry>
 
-          <para>When <emphasis role="bold">all</emphasis> is used either in
-          the <emphasis role="bold">SOURCE</emphasis> or <emphasis
-          role="bold">DEST</emphasis> column intra-zone traffic is not
-          affected. When <emphasis role="bold">all+</emphasis> is used,
-          intra-zone traffic is affected.</para>
+            <varlistentry>
+              <term><replaceable>zone</replaceable>:<replaceable>exclusion</replaceable></term>
+
+              <listitem>
+                <para>This form matches if the host IP address does not match
+                any of the entries in the exclusion (see <ulink
+                url="shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><replaceable>zone</replaceable>:<replaceable>interface</replaceable>:<replaceable>exclusion</replaceable></term>
+
+              <listitem>
+                <para>This form matches packets to the named
+                <replaceable>zone</replaceable> leaving through the specified
+                <replaceable>interface</replaceable> where the destination
+                address does not match any entry in the
+                <replaceable>exclusion</replaceable>.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>[<replaceable>zone</replaceable>]:[<replaceable>server-IP</replaceable>][:<replaceable>port-or-port-range</replaceable>[:random]]</term>
+
+              <listitem>
+                <para>This form applies when the ACTION is DNAT[-] or
+                REDIRECT[-]. The zone may be omitted in REDIRECT rules ($FW is
+                assumed) and must be omitted in DNAT-, REDIRECT- and NONAT
+                rules.</para>
+
+                <para><replaceable role="bold">server-IP</replaceable> is not
+                allowed in REDIRECT rules and may be omitted in DNAT[-] rules
+                provided that <replaceable>port-or-port-range</replaceable> is
+                included. When omitting the
+                <replaceable>server-IP</replaceable>, simply enter "[]" (e.g.,
+                <emphasis role="bold">loc:[]:3128</emphasis>).</para>
+
+                <itemizedlist>
+                  <listitem>
+                    <para>The IP address of the server to which the packet is
+                    to be sent.</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>A range of IP address with the low and high address
+                    separated by a dash (:"-"). Connections are distributed
+                    among the IP addresses in the range.</para>
+                  </listitem>
+                </itemizedlist>
+
+                <para>If <replaceable>server-IP </replaceable>is omitted in a
+                DNAT[-] rule, only the destination port number is modified by
+                the rule.</para>
+
+                <para>port-or-port-range may be:</para>
+
+                <itemizedlist>
+                  <listitem>
+                    <para>An integer port number in the range 1 -
+                    65535.</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>The name of a service from
+                    <filename>/etc/services</filename>.</para>
+                  </listitem>
+
+                  <listitem>
+                    <para>A port range with the low and high integer port
+                    numbers separated by a dash ("-"). Connections are
+                    distributed among the ports in the range.</para>
+                  </listitem>
+                </itemizedlist>
+
+                <para>If <emphasis role="bold">random</emphasis> is specified,
+                port mapping will be randomized.</para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
 
           <para>If the DEST <replaceable>zone</replaceable> is a bport zone,
           then either:<orderedlist numeration="loweralpha">
@@ -1107,79 +1368,24 @@
 
               <listitem>
                 <para>the SOURCE <replaceable>zone</replaceable> must be an
-                ipv4 zone that is associated with only the same bridge.</para>
+                ipv6 zone that is associated with only the same bridge.</para>
               </listitem>
-            </orderedlist></para>
+            </orderedlist>Beginning with Shorewall 5.1.0, multiple
+          <replaceable>dest-spec</replaceable>s may be listed, provided that
+          extended forms of the source-spec are used:</para>
 
-          <para>Except when <emphasis role="bold">all</emphasis>[<emphasis
-          role="bold">+]|[-</emphasis>] is specified, the server may be
-          further restricted to a particular network, host or interface by
-          appending ":" and the network, host or interface. See <emphasis
-          role="bold">SOURCE</emphasis> above.</para>
+          <blockquote>
+            <para><replaceable>zone</replaceable>:(<replaceable>interface</replaceable>)</para>
 
-          <para>You may exclude certain hosts from the set already defined
-          through use of an <emphasis>exclusion</emphasis> (see <ulink
-          url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5)).</para>
+            <para><replaceable>zone</replaceable>:(<replaceable>address</replaceable>[,...])</para>
 
-          <para>Restriction: MAC addresses are not allowed (this is a
-          Netfilter restriction).</para>
+            <para>zone:(interface:address[,...])</para>
 
-          <para>If your kernel and ip6tables have ipset match support then you
-          may give the name of an ipset prefaced by "+". The ipset name may be
-          optionally followed by a number from 1 to 6 enclosed in square
-          brackets ([]) to indicate the number of levels of destination
-          bindings to be matched. Only one of the <emphasis
-          role="bold">SOURCE</emphasis> and <emphasis
-          role="bold">DEST</emphasis> columns may specify an ipset
-          name.</para>
+            <para><replaceable>zone</replaceable>:(<replaceable>exclusion</replaceable>)</para>
+          </blockquote>
 
-          <para>The <replaceable>port</replaceable> that the server is
-          listening on may be included and separated from the server's IP
-          address by ":". If omitted, the firewall will not modify the
-          destination port. A destination port may only be included if the
-          <emphasis role="bold">ACTION</emphasis> is <emphasis
-          role="bold">DNAT</emphasis> or <emphasis
-          role="bold">REDIRECT</emphasis>.</para>
-
-          <variablelist>
-            <varlistentry>
-              <term>Example 1:</term>
-
-              <listitem>
-                <para><emphasis
-                role="bold">loc:[2001:470:b:227::44]:3128</emphasis> specifies
-                a local server at IP address 2001:470:b:227::44 and listening
-                on port 3128.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>Example 2:</term>
-
-              <listitem>
-                <para><emphasis role="bold">loc:[]:3128</emphasis> specifies
-                that the destination port should be changed to 3128 but the IP
-                address should remain the same.</para>
-              </listitem>
-            </varlistentry>
-          </variablelist>
-
-          <para>The <emphasis>port</emphasis> may be specified as a service
-          name. You may specify a port range in the form
-          <emphasis>lowport-highport</emphasis> to cause connections to be
-          assigned to ports in the range in round-robin fashion. When a port
-          range is specified, <emphasis>lowport</emphasis> and
-          <emphasis>highport</emphasis> must be given as integers; service
-          names are not permitted. Additionally, the port range may be
-          optionally followed by <emphasis role="bold">:random</emphasis>
-          which causes assignment to ports in the list to be random.</para>
-
-          <para>If the <emphasis role="bold">ACTION</emphasis> is <emphasis
-          role="bold">REDIRECT</emphasis> or <emphasis
-          role="bold">REDIRECT-</emphasis>, this column needs only to contain
-          the port number on the firewall that the request should be
-          redirected to. That is equivalent to specifying
-          <option>$FW</option>::<replaceable>port</replaceable>.</para>
+          <para>Multiple <replaceable>dest-spec</replaceable>s are not
+          permitted in DNAT[-] and REDIRECT[-] rules.</para>
         </listitem>
       </varlistentry>
 

Shorewall6/manpages/shorewall6-snat.xml

@@ -0,0 +1,615 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<refentry>
+  <refmeta>
+    <refentrytitle>shorewall6-masq</refentrytitle>
+
+    <manvolnum>5</manvolnum>
+
+    <refmiscinfo>Configuration Files</refmiscinfo>
+  </refmeta>
+
+  <refnamediv>
+    <refname>snat</refname>
+
+    <refpurpose>Shorewall6 SNAT/Masquerade definition file</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <cmdsynopsis>
+      <command>/etc/shorewall6/snat</command>
+    </cmdsynopsis>
+  </refsynopsisdiv>
+
+  <refsect1>
+    <title>Description</title>
+
+    <para>This file is used to define dynamic NAT (Masquerading) and to define
+    Source NAT (SNAT). While still supported, its use is deprecated in favor
+    of <ulink url="shorewall6-snat.html">shorewall6-snat</ulink>(5) which was
+    introduced in Shorewall 5.0.14.</para>
+
+    <warning>
+      <para>The entries in this file are order-sensitive. The first entry that
+      matches a particular connection will be the one that is used.</para>
+    </warning>
+
+    <warning>
+      <para>If you have more than one ISP link, adding entries to this file
+      will <emphasis role="bold">not</emphasis> force connections to go out
+      through a particular link. You must use entries in <ulink
+      url="/manpages6/shorewall6-rtrules.html">shorewall6-rtrules</ulink>(5)
+      or PREROUTING entries in <ulink
+      url="/manpages6/shorewall6-tcrules.html">shorewall-tcrules</ulink>(5) to
+      do that.</para>
+    </warning>
+
+    <para>The columns in the file are as follows.</para>
+
+    <variablelist>
+      <varlistentry>
+        <term><emphasis role="bold">ACTION</emphasis></term>
+
+        <listitem>
+          <para>Defines the type of rule to generate. Choices are:</para>
+
+          <variablelist>
+            <varlistentry>
+              <term><emphasis
+              role="bold">MASQUERADE</emphasis>[+][([<replaceable>lowport</replaceable>-<replaceable>highport</replaceable>][<option>random</option>])]</term>
+
+              <listitem>
+                <para>Causes matching outgoing packages to have their source
+                IP address set to the primary IP address of the interface
+                specified in the DEST column. if
+                <replaceable>lowport</replaceable>-<replaceable>highport</replaceable>
+                is given, that port range will be used to assign a source
+                port. If option <option>random</option> is used then port
+                mapping will be randomized. MASQUERADE should only be used
+                when the DEST interface has a dynamic IP address. Otherwise,
+                SNAT should be used and should specify the interface's static
+                address.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis
+              role="bold">SNAT</emphasis>[+]([<emphasis>address-or-address-range</emphasis>][:<emphasis>lowport</emphasis><emphasis
+              role="bold">-</emphasis><emphasis>highport</emphasis>][<emphasis
+              role="bold">:random</emphasis>][:<option>persistent</option>]|<emphasis
+              role="bold">detect</emphasis>|</term>
+
+              <listitem>
+                <para>If you specify an address here, matching packets will
+                have their source address set to that address. If
+                ADD_SNAT_ALIASES is set to Yes or yes in <ulink
+                url="shorewall6.conf.html">shorewall6.conf</ulink>(5) then
+                Shorewall will automatically add this address to the INTERFACE
+                named in the first column.</para>
+
+                <para>You may also specify a range of up to 256 IP addresses
+                if you want the SNAT address to be assigned from that range in
+                a round-robin fashion by connection. The range is specified by
+                <emphasis>first.ip.in.range</emphasis>-<emphasis>last.ip.in.range</emphasis>.
+                You may follow the port range with<emphasis role="bold">
+                :random</emphasis> in which case assignment of ports from the
+                list will be random. <emphasis role="bold">random</emphasis>
+                may also be specified by itself in this column in which case
+                random local port assignments are made for the outgoing
+                connections.</para>
+
+                <para>Example: 206.124.146.177-206.124.146.180</para>
+
+                <para>You may follow the port range (or <emphasis
+                role="bold">:random</emphasis>) with <emphasis
+                role="bold">:persistent</emphasis>. This is only useful when
+                an address range is specified and causes a client to be given
+                the same source/destination IP pair. This feature replaces the
+                SAME modifier which was removed from Shorewall in version
+                4.4.0.</para>
+
+                <para>You may also use the special value
+                <option>detect</option> which causes Shorewall to determine
+                the IP addresses configured on the interface named in the DEST
+                column and substitute them in this column.</para>
+
+                <para>Finally, you may also specify a comma-separated list of
+                ranges and/or addresses in this column.</para>
+
+                <para>DNS Names names are not allowed.</para>
+
+                <para>Normally, Netfilter will attempt to retain the source
+                port number. You may cause netfilter to remap the source port
+                by following an address or range (if any) by ":" and a port
+                range with the format
+                <emphasis>lowport</emphasis>-<emphasis>highport</emphasis>. If
+                this is done, you must specify "tcp", "udp", "dccp" or "stcp"
+                in the PROTO column.</para>
+
+                <para>Example:</para>
+
+                <programlisting>        [2001:470:a:787::2]:5000-6000</programlisting>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>CONTINUE[+]</term>
+
+              <listitem>
+                <para>Causes matching packets to be exempted from any
+                following rules in the file.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis
+              role="bold"><replaceable>action</replaceable></emphasis>[+][(<replaceable>parameter</replaceable>,...)]</term>
+
+              <listitem>
+                <para>where <replaceable>action</replaceable> is an action
+                declared in <ulink
+                url="shorewall6-actions.html">shorewall6-actions(5)</ulink>
+                with the <option>nat</option> option. See <ulink
+                url="/Actions.html">www.shorewall.net/Actions.html</ulink> for
+                further information.</para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
+
+          <para>Normally Masq/SNAT rules are evaluated after those for
+          one-to-one NAT (defined in <ulink
+          url="/manpages6/shorewall6-nat.html">shorewall6-nat</ulink>(5)). If
+          you want the rule to be applied before one-to-one NAT rules, follow
+          the action name with "+": This feature should only be required if
+          you need to insert rules in this file that preempt entries in <ulink
+          url="/manpages6/shorewall6-nat.html">shorewall6-nat</ulink>(5).</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">SOURCE</emphasis> (Optional) -
+        [<emphasis>interface</emphasis>|<emphasis>address</emphasis>[<emphasis
+        role="bold">,</emphasis><emphasis>address</emphasis>...][<emphasis>exclusion</emphasis>]]</term>
+
+        <listitem>
+          <para>Set of hosts that you wish to SNAT; one or more host or
+          network addresses separated by comma. You may use ipset names
+          preceded by a plus sign (+) to specify a set of hosts.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">DEST</emphasis> -
+        {<emphasis>interface</emphasis>|[<emphasis
+        role="bold">:</emphasis>[<emphasis>dest-address</emphasis>[<emphasis
+        role="bold">,</emphasis><emphasis>dest-address</emphasis>]...[<emphasis>exclusion</emphasis>]]|?COMMENT}</term>
+
+        <listitem>
+          <para>Outgoing <emphasis>interface</emphasis>. This is usually your
+          internet interface.</para>
+
+          <para>The <replaceable>interface</replaceable> must match an entry
+          in <ulink
+          url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5).
+          Shorewall allows loose matches to wildcard entries in <ulink
+          url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5).
+          For example, <filename class="devicefile">ppp0</filename> in this
+          file will match a <ulink
+          url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5)
+          entry that defines <filename
+          class="devicefile">ppp+</filename>.</para>
+
+          <para>Where <ulink url="/4.4/MultiISP.html#Shared">more that one
+          internet provider share a single interface</ulink>, the provider is
+          specified by including the provider name or number in
+          parentheses:</para>
+
+          <programlisting>        eth0(Avvanta)</programlisting>
+
+          <para>In that case, you will want to specify the interface's address
+          for that provider as the SNAT parameter.</para>
+
+          <para>The interface may be qualified by adding the character ":"
+          followed by a comma-separated list of destination host or subnet
+          addresses to indicate that you only want to change the source IP
+          address for packets being sent to those particular destinations.
+          Exclusion is allowed (see <ulink
+          url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5))
+          as are ipset names preceded by a plus sign '+'.</para>
+
+          <para>Comments may be attached to Netfilter rules generated from
+          entries in this file through the use of ?COMMENT lines. These lines
+          begin with ?COMMENT; the remainder of the line is treated as a
+          comment which is attached to subsequent rules until another ?COMMENT
+          line is found or until the end of the file is reached. To stop
+          adding comments to rules, use a line containing only
+          ?COMMENT.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">PROTO</emphasis> (Optional) - {<emphasis
+        role="bold">-</emphasis>|[!]{<emphasis>protocol-name</emphasis>|<emphasis>protocol-number</emphasis>}[,...]|+<replaceable>ipset</replaceable>}</term>
+
+        <listitem>
+          <para>If you wish to restrict this entry to a particular protocol
+          then enter the protocol name (from protocols(5)) or number
+          here.</para>
+
+          <para>Beginning with Shorewall 4.5.12, this column can accept a
+          comma-separated list of protocols.</para>
+
+          <para>Beginning with Shorewall 4.6.0, an
+          <replaceable>ipset</replaceable> name can be specified in this
+          column. This is intended to be used with
+          <firstterm>bitmap:port</firstterm> ipsets.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">DPORT</emphasis> (Optional) -
+        {-|[!]<emphasis>port-name-or-number</emphasis>[,<emphasis>port-name-or-number</emphasis>]...|+<replaceable>ipset</replaceable>}</term>
+
+        <listitem>
+          <para>If the PROTO column specifies TCP (6), UDP (17), DCCP (33),
+          SCTP (132) or UDPLITE (136) then you may list one or more port
+          numbers (or names from services(5)) or port ranges separated by
+          commas.</para>
+
+          <para>Port ranges are of the form
+          <emphasis>lowport</emphasis>:<emphasis>highport</emphasis>.</para>
+
+          <para>Beginning with Shorewall 4.6.0, an
+          <replaceable>ipset</replaceable> name can be specified in this
+          column. This is intended to be used with
+          <firstterm>bitmap:port</firstterm> ipsets.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">IPSEC</emphasis> (Optional) -
+        [<emphasis>option</emphasis>[<emphasis
+        role="bold">,</emphasis><emphasis>option</emphasis>]...]</term>
+
+        <listitem>
+          <para>If you specify a value other than "-" in this column, you must
+          be running kernel 2.6 and your kernel and iptables must include
+          policy match support.</para>
+
+          <para>Comma-separated list of options from the following. Only
+          packets that will be encrypted via an SA that matches these options
+          will have their source address changed.</para>
+
+          <variablelist>
+            <varlistentry>
+              <term><emphasis
+              role="bold">reqid=</emphasis><emphasis>number</emphasis></term>
+
+              <listitem>
+                <para>where <emphasis>number</emphasis> is specified using
+                setkey(8) using the 'unique:<emphasis>number</emphasis> option
+                for the SPD level.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">spi=</emphasis>&lt;number&gt;</term>
+
+              <listitem>
+                <para>where <emphasis>number</emphasis> is the SPI of the SA
+                used to encrypt/decrypt packets.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">proto=</emphasis><emphasis
+              role="bold">ah</emphasis>|<emphasis
+              role="bold">esp</emphasis>|<emphasis
+              role="bold">ipcomp</emphasis></term>
+
+              <listitem>
+                <para>IPSEC Encapsulation Protocol</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis
+              role="bold">mss=</emphasis><emphasis>number</emphasis></term>
+
+              <listitem>
+                <para>sets the MSS field in TCP packets</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">mode=</emphasis><emphasis
+              role="bold">transport</emphasis>|<emphasis
+              role="bold">tunnel</emphasis></term>
+
+              <listitem>
+                <para>IPSEC mode</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis
+              role="bold">tunnel-src=</emphasis><emphasis>address</emphasis>[/<emphasis>mask</emphasis>]</term>
+
+              <listitem>
+                <para>only available with mode=tunnel</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis
+              role="bold">tunnel-dst=</emphasis><emphasis>address</emphasis>[/<emphasis>mask</emphasis>]</term>
+
+              <listitem>
+                <para>only available with mode=tunnel</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">strict</emphasis></term>
+
+              <listitem>
+                <para>Means that packets must match all rules.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">next</emphasis></term>
+
+              <listitem>
+                <para>Separates rules; can only be used with strict</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">yes</emphasis></term>
+
+              <listitem>
+                <para>When used by itself, causes all traffic that will be
+                encrypted/encapsulated to match the rule.</para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">MARK</emphasis> - [<emphasis
+        role="bold">!</emphasis>]<emphasis>value</emphasis>[/<emphasis>mask</emphasis>][<emphasis
+        role="bold">:C</emphasis>]</term>
+
+        <listitem>
+          <para>Defines a test on the existing packet or connection mark. The
+          rule will match only if the test returns true.</para>
+
+          <para>If you don't want to define a test but need to specify
+          anything in the following columns, place a "-" in this field.</para>
+
+          <variablelist>
+            <varlistentry>
+              <term>!</term>
+
+              <listitem>
+                <para>Inverts the test (not equal)</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis>value</emphasis></term>
+
+              <listitem>
+                <para>Value of the packet or connection mark.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis>mask</emphasis></term>
+
+              <listitem>
+                <para>A mask to be applied to the mark before testing.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">:C</emphasis></term>
+
+              <listitem>
+                <para>Designates a connection mark. If omitted, the packet
+                mark's value is tested.</para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">USER</emphasis> (Optional) - [<emphasis
+        role="bold">!</emphasis>][<emphasis>user-name-or-number</emphasis>][<emphasis
+        role="bold">:</emphasis><emphasis>group-name-or-number</emphasis>][<emphasis
+        role="bold">+</emphasis><emphasis>program-name</emphasis>]</term>
+
+        <listitem>
+          <para>Only locally-generated connections will match if this column
+          is non-empty.</para>
+
+          <para>When this column is non-empty, the rule matches only if the
+          program generating the output is running under the effective
+          <emphasis>user</emphasis> and/or <emphasis>group</emphasis>
+          specified (or is NOT running under that id if "!" is given).</para>
+
+          <para>Examples:</para>
+
+          <variablelist>
+            <varlistentry>
+              <term>joe</term>
+
+              <listitem>
+                <para>program must be run by joe</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>:kids</term>
+
+              <listitem>
+                <para>program must be run by a member of the 'kids'
+                group</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>!:kids</term>
+
+              <listitem>
+                <para>program must not be run by a member of the 'kids'
+                group</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>+upnpd</term>
+
+              <listitem>
+                <para>#program named upnpd</para>
+
+                <important>
+                  <para>The ability to specify a program name was removed from
+                  Netfilter in kernel version 2.6.14.</para>
+                </important>
+              </listitem>
+            </varlistentry>
+          </variablelist>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">SWITCH -
+        [!]<replaceable>switch-name</replaceable>[={0|1}]</emphasis></term>
+
+        <listitem>
+          <para>Added in Shorewall 4.5.1 and allows enabling and disabling the
+          rule without requiring <command>shorewall restart</command>.</para>
+
+          <para>The rule is enabled if the value stored in
+          <filename>/proc/net/nf_condition/<replaceable>switch-name</replaceable></filename>
+          is 1. The rule is disabled if that file contains 0 (the default). If
+          '!' is supplied, the test is inverted such that the rule is enabled
+          if the file contains 0.</para>
+
+          <para>Within the <replaceable>switch-name</replaceable>, '@0' and
+          '@{0}' are replaced by the name of the chain to which the rule is a
+          added. The <replaceable>switch-name</replaceable> (after '@...'
+          expansion) must begin with a letter and be composed of letters,
+          decimal digits, underscores or hyphens. Switch names must be 30
+          characters or less in length.</para>
+
+          <para>Switches are normally <emphasis role="bold">off</emphasis>. To
+          turn a switch <emphasis role="bold">on</emphasis>:</para>
+
+          <simplelist>
+            <member><command>echo 1 &gt;
+            /proc/net/nf_condition/<replaceable>switch-name</replaceable></command></member>
+          </simplelist>
+
+          <para>To turn it <emphasis role="bold">off</emphasis> again:</para>
+
+          <simplelist>
+            <member><command>echo 0 &gt;
+            /proc/net/nf_condition/<replaceable>switch-name</replaceable></command></member>
+          </simplelist>
+
+          <para>Switch settings are retained over <command>shorewall
+          restart</command>.</para>
+
+          <para>Beginning with Shorewall 4.5.10, when the
+          <replaceable>switch-name</replaceable> is followed by
+          <option>=0</option> or <option>=1</option>, then the switch is
+          initialized to off or on respectively by the
+          <command>start</command> command. Other commands do not affect the
+          switch setting.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">ORIGDEST</emphasis> - [<emphasis
+        role="bold">-</emphasis>|<emphasis>address</emphasis>[,<emphasis>address</emphasis>]...[<emphasis>exclusion</emphasis>]|<emphasis>exclusion</emphasis>]</term>
+
+        <listitem>
+          <para>(Optional) This column may be included and may contain one or
+          more addresses (host or network) separated by commas. Address ranges
+          are not allowed. When this column is supplied, rules are generated
+          that require that the original destination address matches one of
+          the listed addresses. It is useful for specifying that SNAT should
+          occur only for connections that were acted on by a DNAT when they
+          entered the firewall.</para>
+
+          <para>This column was formerly labelled ORIGINAL DEST.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><emphasis role="bold">PROBABILITY</emphasis> -
+        [<replaceable>probability</replaceable>]</term>
+
+        <listitem>
+          <para>Added in Shorewall 5.0.0. When non-empty, requires the
+          <firstterm>Statistics Match</firstterm> capability in your kernel
+          and ip6tables and causes the rule to match randomly but with the
+          given <replaceable>probability</replaceable>. The
+          <replaceable>probability</replaceable> is a number 0 &lt;
+          <replaceable>probability</replaceable> &lt;= 1 and may be expressed
+          at up to 8 decimal points of precision.</para>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+
+  <refsect1>
+    <title>Examples</title>
+
+    <variablelist>
+      <varlistentry>
+        <term>Example 1:</term>
+
+        <listitem>
+          <para>You have a simple 'masquerading' setup where eth0 connects to
+          a DSL or cable modem and eth1 connects to your local network with
+          subnet 2001:470:b:787::0/64</para>
+
+          <para>Your entry in the file will be:</para>
+
+          <programlisting>        #ACTION      SOURCE                  DEST
+        MASQUERADE   2001:470:b:787::0/64    eth0</programlisting>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>Example 2:</term>
+
+        <listitem>
+          <para>Your sit1 interface has two public IP addresses:
+          2001:470:a:227::1 and 2001:470:b:227::1. You want to use the
+          iptables statistics match to masquerade outgoing connections evenly
+          between these two addresses.</para>
+
+          <programlisting>/etc/shorewall/snat:
+
+       #ACTION                      SOURCE     DEST
+       SNAT(2001:470:a:227::1)      ::/0       sit1              { probability=0.50 }
+       SNAT(2001:470:a:227::2)      ::/0       sit</programlisting>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+
+  <refsect1>
+    <title>FILES</title>
+
+    <para>/etc/shorewall6/snat</para>
+  </refsect1>
+</refentry>

Shorewall6/manpages/shorewall6.conf.xml

@@ -453,22 +453,6 @@
         </listitem>
       </varlistentry>
 
-      <varlistentry>
-        <term><emphasis role="bold">CHAIN_SCRIPTS=</emphasis>{<emphasis
-        role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>}</term>
-
-        <listitem>
-          <para>Added in Shorewall 4.5.16. Prior to the availability of BEGIN
-          PERL....END PERL in configuration files, the only way to execute a
-          chain-specific script was to create a script file with the same name
-          as the chain and place it in a directory on the CONFIG_PATH. That
-          facility has the drawback that the compiler will attempt to run a
-          non-script file just because it has the same name as a chain. To
-          disable this facility, set CHAIN_SCRIPTS=No. If not specified or
-          specified as the empty value, CHAIN_SCRIPTS=Yes is assumed.</para>
-        </listitem>
-      </varlistentry>
-
       <varlistentry>
         <term><emphasis role="bold">CLAMPMSS=[</emphasis><emphasis
         role="bold">Yes</emphasis>|<emphasis
@@ -647,7 +631,7 @@
           is SW_DBL6 and the default log level is <option>none</option> (no
           logging). if <option>ipset-only</option> is given, then chain-based
           dynamic blacklisting is disabled just as if DYNAMIC_BLACKLISTING=No
-          had been specified. </para>
+          had been specified.</para>
 
           <para>Possible <replaceable>option</replaceable>s are:</para>
 
@@ -781,7 +765,8 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
           an administrative system in directories containing the
           configurations of remote firewalls. The contents of the variable are
           the default value for the <replaceable>system</replaceable>
-          parameter to the <command>remote-reload</command> and
+          parameter to the <command>remote-start</command>,
+          <command>remote-reload</command> and
           <command>remote-restart</command> commands.</para>
         </listitem>
       </varlistentry>
@@ -919,13 +904,13 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
 
         <listitem>
           <para>Added in Shorewall 4.6.0. Traditionally in <ulink
-          url="/manpages6/shorewall6-rules.html">shorewall6-rules(5)</ulink>,
+          url="/manpages6/shorewall6-rules.html">shorewall6-rules</ulink>(5),
           a semicolon separates column-oriented specifications on the left
           from <ulink url="/configuration_file_basics.htm#Pairs">alternative
           specificaitons</ulink> on the right.. When INLINE_MATCHES=Yes is
           specified, the specifications on the right are interpreted as if
           INLINE had been specified in the ACTION column. This also applies to
-          <ulink url="shorewall6-masq.html">shorewall6-masq(5)</ulink> and
+          <ulink url="shorewall-masq.html">shorewall6-masq(5)</ulink> and
           <ulink url="shorewall6-mangle.html">shorewall6-mangle(5</ulink>)
           which also support INLINE. If not specified or if specified as the
           empty value, the value 'No' is assumed for backward
@@ -933,10 +918,12 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
 
           <para>Beginning with Shorewall 5.0.0, it is no longer necessary to
           set INLINE_MATCHES=Yes in order to be able to specify your own
-          iptables text in a rule. You may simply preface that text with a
-          pair of semicolons (";;"). If alternate input is also specified in
-          the rule, it should appear before the semicolons and may be
-          separated from normal column input by a single semicolon.</para>
+          iptables text in a rule and INLINE_MATCHES=Yes is deprecated.
+          Beginning with 5.0.0, you may simply preface your text with a pair
+          of semicolons (";;"). If alternate input is also specified in the
+          rule, it should appear before the semicolons and may be separated
+          from normal column input by a single semicolon or enclosed in curly
+          braces ("{....}").</para>
         </listitem>
       </varlistentry>
 
@@ -1868,43 +1855,32 @@ LOG:info:,bar                        net                    fw</programlisting>
         role="bold">"</emphasis></term>
 
         <listitem>
-          <para>Earlier generations of Shorewall6 Lite required that remote
+          <para>Earlier generations of Shorewall Lite required that remote
           root login via ssh be enabled in order to use the
           <command>load</command> and <command>reload</command> commands.
           Beginning with release 3.9.5, you may define an alternative means
           for accessing the remote firewall system. In that release, two new
-          options were added to shorewall6.conf:<simplelist>
+          options were added to shorewall.conf:</para>
+
+          <simplelist>
             <member>RSH_COMMAND</member>
 
             <member>RCP_COMMAND</member>
-            </simplelist>The default values for these are as
-          follows:<simplelist>
-              <member>RSH_COMMAND: ssh ${root}@${system} ${command}</member>
+          </simplelist>
 
-              <member>RCP_COMMAND: scp ${files}
-              ${root}@${system}:${destination}</member>
-            </simplelist>Shell variables that will be set when the commands
-          are invoked are as follows:<simplelist>
-              <member><replaceable>root</replaceable> - root user. Normally
-              <option>root</option> but may be overridden using the '-r'
-              option.</member>
+          <para>The default values for these are as follows:</para>
 
-              <member><replaceable>system</replaceable> - The name/IP address
-              of the remote firewall system.</member>
+          <programlisting>RSH_COMMAND: ssh ${root}@${system} ${command}
+RCP_COMMAND: scp ${files} ${root}@${system}:${destination}</programlisting>
 
-              <member><replaceable>command</replaceable> - For RSH_COMMAND,
-              the command to be executed on the firewall system.</member>
+          <para>Shell variables that will be set when the commands are invoked
+          are as follows:</para>
 
-              <member><replaceable>files</replaceable> - For RCP_COMMAND, a
-              space-separated list of files to be copied to the remote
-              firewall system.</member>
-
-              <member><replaceable>destination</replaceable> - The directory
-              on the remote system that the files are to be copied
-              into.</member>
-            </simplelist></para>
-
-          <programlisting/>
+          <programlisting><replaceable>root</replaceable>        - root user. Normally <option>root</option> but may be overridden using the '-r' option.
+<replaceable>system</replaceable>      - The name/IP address of the remote firewall system.
+<replaceable>command</replaceable>     - For RSH_COMMAND, the command to be executed on the firewall system.
+<replaceable>files</replaceable>       - For RCP_COMMAND, a space-separated list of files to be copied to the remote firewall system.
+<replaceable>destination</replaceable> - The directory on the remote system that the files are to be copied into.</programlisting>
         </listitem>
       </varlistentry>
 

Shorewall6/shorewall6

@@ -1,42 +0,0 @@
-#!/bin/sh
-#
-#     Shorewall6 Packet Filtering Firewall Control Program - V4.5
-#
-#     (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2014 -
-#         Tom Eastep (teastep@shorewall.net)
-#
-#	Shorewall documentation is available at http://www.shorewall.net
-#
-#       This program is part of Shorewall.
-#
-#	This program is free software; you can redistribute it and/or modify
-#	it under the terms of the GNU General Public License as published by the
-#       Free Software Foundation, either version 2 of the license or, at your
-#       option, any later version.
-#
-#	This program is distributed in the hope that it will be useful,
-#	but WITHOUT ANY WARRANTY; without even the implied warranty of
-#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-#	GNU General Public License for more details.
-#
-#	You should have received a copy of the GNU General Public License
-#	along with this program; if not, see <http://www.gnu.org/licenses/>.
-#
-#       For a list of supported commands, type 'shorewall help' or 'shorewall6 help'
-#
-################################################################################################
-PRODUCT=shorewall6
-
-#
-# This is modified by the installer when ${SHAREDIR} != /usr/share
-#
-. /usr/share/shorewall/shorewallrc
-
-g_program=$PRODUCT
-g_sharedir="$SHAREDIR"/shorewall6
-g_confdir="$CONFDIR"/shorewall6
-g_readrc=1
-
-. ${SHAREDIR}/shorewall/lib.cli
-
-shorewall_cli $@

Shorewall6/shorewall6.service

@@ -14,9 +14,9 @@ Type=oneshot
 RemainAfterExit=yes
 EnvironmentFile=-/etc/sysconfig/shorewall6
 StandardOutput=syslog
-ExecStart=/sbin/shorewall6 $OPTIONS start $STARTOPTIONS
-ExecStop=/sbin/shorewall6 $OPTIONS stop
-ExecReload=/sbin/shorewall6 $OPTIONS reload $RELOADOPTIONS
+ExecStart=/sbin/shorewall -6 $OPTIONS start $STARTOPTIONS
+ExecStop=/sbin/shorewall -6 $OPTIONS stop
+ExecReload=/sbin/shorewall -6 $OPTIONS reload $RELOADOPTIONS
 
 [Install]
 WantedBy=basic.target

Shorewall6/shorewall6.service.debian

@@ -15,9 +15,9 @@ Type=oneshot
 RemainAfterExit=yes
 EnvironmentFile=-/etc/default/shorewall6
 StandardOutput=syslog
-ExecStart=/sbin/shorewall6 $OPTIONS start $STARTOPTIONS
-ExecStop=/sbin/shorewall6 $OPTIONS stop
-ExecReload=/sbin/shorewall6 $OPTIONS reload $RELOADOPTIONS
+ExecStart=/sbin/shorewall -6 $OPTIONS start $STARTOPTIONS
+ExecStop=/sbin/shorewall -6 $OPTIONS stop
+ExecReload=/sbin/shorewall -6 $OPTIONS reload $RELOADOPTIONS
 
 [Install]
 WantedBy=basic.target

docs/Actions.xml

@@ -417,8 +417,8 @@ REDIRECT       net     -       tcp     80      -       1.2.3.4</programlisting>
 
       <para>To create a mangle action, follow the steps in the preceding
       section, but use the
-      <filename>/usr/share/shorewall/action.mangletemplate</filename> file.
-      </para>
+      <filename>/usr/share/shorewall/action.mangletemplate</filename>
+      file.</para>
     </section>
   </section>
 
@@ -1011,4 +1011,145 @@ add_rule $chainref, '-j ACCEPT';
 1; </programlisting>
     </section>
   </section>
+
+  <section>
+    <title>Mangle Actions</title>
+
+    <para>Beginning with Shorewall 5.0.7, actions are supported in <ulink
+    url="manpages/shorewall-mangle.html">shorewall-mangle(5)</ulink>. Like
+    actions used out of <ulink
+    url="manpages/shorewall-rules.html">shorewall-rules(5)</ulink>, they must
+    be declared in <ulink
+    url="manpages/shorewall-actions.html">shorewall-actions(5)</ulink>. These
+    <firstterm>mangle actions</firstterm> must have the
+    <option>mangle</option> option specified on <ulink
+    url="manpages/shorewall-actions.html">shorewall-actions(5)</ulink>. Like
+    the actions described in the preceding sections, mangle actions are
+    defined in a files with names of the form
+    action.<replaceable>action</replaceable>. Rules in those files have the
+    same format as those in <ulink
+    url="manpages/shorewall-mangle.html">shorewall-mangle(5)</ulink> with the
+    restriction that chain designators (:P, :F, etc.) are not permitted in the
+    ACTION column. Both regular and inline actions are supported.</para>
+
+    <para>Inline Example</para>
+
+    <para><filename>/etc/shorewall/actions</filename>:</para>
+
+    <programlisting>#ACTION     OPTIONS
+Divert	     inline,mangle      # TProxy Rules
+</programlisting>
+
+    <para><filename>/etc/shorewall/action.Divert</filename>:</para>
+
+    <programlisting>#ACTION         SOURCE          DEST            PROTO   DPORT   SPORT
+DIVERT          COMB_IF         -               tcp     -       80
+DIVERT          COMC_IF         -               tcp     -       80
+DIVERT          DMZ_IF          172.20.1.0/24   tcp     -       80
+</programlisting>
+
+    <para><filename>/etc/shorewall/mangle</filename>:</para>
+
+    <programlisting>#ACTION         SOURCE          DEST            PROTO   DPORT   SPORT
+Divert</programlisting>
+
+    <para>More efficient way to do this:</para>
+
+    <para><filename>/etc/shorewall/actions</filename>:</para>
+
+    <programlisting>#ACTION     OPTIONS
+Divert	     inline             # TProxy Rules
+</programlisting>
+
+    <para><filename>/etc/shorewall/action.Divert</filename>:</para>
+
+    <programlisting>#ACTION         SOURCE          DEST            PROTO   DPORT   SPORT
+DIVERT          COMB_IF         -               
+DIVERT          COMC_IF         -               
+DIVERT          DMZ_IF          172.20.1.0/24
+</programlisting>
+
+    <para><filename>/etc/shorewall/mangle</filename>:</para>
+
+    <programlisting>#ACTION         SOURCE          DEST            PROTO   DPORT   SPORT
+Divert          -               -               tcp     -       80</programlisting>
+  </section>
+
+  <section>
+    <title>SNAT Actions</title>
+
+    <para>Beginning with Shorewall 5.0.14, actions are supported in <ulink
+    url="manpages/shorewall-snat.html">shorewall-snat(5</ulink>); that file
+    supercedes <ulink
+    url="manpages/shorewall-masq.html">shorewall-masq(5)</ulink> which is
+    still supported. The shorewall update command will convert a
+    <filename>masq</filename> file into the equivalent
+    <filename>snat</filename> file. Like actions used out of <ulink
+    url="manpages/shorewall-rules.html">shorewall-rules(5)</ulink>,
+    <firstterm>SNAT actions</firstterm> must be declared in <ulink
+    url="manpages/shorewall-actions.html">shorewall-actions(5)</ulink>. These
+    <firstterm>mangle actions</firstterm> must have the <option>nat</option>
+    option specified on <ulink
+    url="manpages/shorewall-actions.html">shorewall-actions(5)</ulink>. Like
+    the actions described in the preceding sections, SNAT actions are defined
+    in a files with names of the form
+    action.<replaceable>action</replaceable>. Rules in those files have the
+    same format as those in <ulink
+    url="manpages/shorewall-snat.html">shorewall-snat(5)</ulink> with two
+    restrictions:</para>
+
+    <orderedlist>
+      <listitem>
+        <para>The plus sign ("+") is not allowed in the ACTION column, so all
+        rules in the action will either be pre-nat or post-nat depending on
+        whether '+' was present in the action's invocation.</para>
+      </listitem>
+
+      <listitem>
+        <para>Interface names are not allowed in the DEST column, so all rules
+        in the action will apply to the interface specified in the action's
+        invocation.</para>
+      </listitem>
+    </orderedlist>
+
+    <para>Both regular and inline actions are supported.</para>
+
+    <para>Example:</para>
+
+    <para><filename>/etc/shorewall/actions</filename>:</para>
+
+    <programlisting>#ACTION     OPTIONS
+custEPTs    nat,inline</programlisting>
+
+    <para><filename>/etc/shorewall/action.custEPTs</filename>:</para>
+
+    <programlisting>#ACTION         SOURCE          DEST            PROTO   PORT
+SNAT($GW_IP)    { proto=udp port=1146 }
+SNAT($GW_IP)    { proto=tcp port=1156,7221,21000 }
+</programlisting>
+
+    <para><filename>/etc/shorewall/snat</filename>:</para>
+
+    <programlisting>ACTION          SOURCE          DEST            PROTO   PORT
+custEPTs  { source=$EPT_LIST dest=$IF_NET:$EPT_SERVERS }</programlisting>
+
+    <para>More effeciently:</para>
+
+    <para><filename>/etc/shorewall/actions</filename>:</para>
+
+    <programlisting>#ACTION     OPTIONS
+custEPTs    nat</programlisting>
+
+    <para><filename>/etc/shorewall/action.custEPTs</filename>:</para>
+
+    <programlisting>#ACTION         SOURCE          DEST            PROTO   PORT
+SNAT($GW_IP)    { proto=udp port=1146 }
+SNAT($GW_IP)    { proto=tcp port=1156,7221,21000 }
+</programlisting>
+
+    <para><filename>/etc/shorewall/snat</filename>:</para>
+
+    <programlisting>ACTION          SOURCE          DEST            PROTO   PORT
+custEPT  { source=$EPT_LIST dest=$IF_NET:$EPT_SERVERS }</programlisting>
+  </section>
 </article>

docs/Anatomy.xml

@@ -106,8 +106,17 @@
     url="Install.htm#idp8774904608">configure scripts included with Shorewall
     Core</ulink>.</para>
 
+    <important>
+      <para>Since Shorewall 4.5.2, each of these directories is now
+      relocatable using the <ulink url="Install.htm#idp8774904608">configure
+      scripts included with Shorewall Core</ulink>. These scripts set shell
+      variables in the shorewallrc file which is normally installed in
+      /usr/share/shorewall/. The name of the variable is included in
+      parentheses in the section headings below.</para>
+    </important>
+
     <section id="sbin">
-      <title>/sbin</title>
+      <title>/sbin ($SBINDIR)</title>
 
       <para>The <filename>/sbin/shorewall</filename> shell program is used to
       interact with Shorewall. See <ulink
@@ -115,7 +124,7 @@
     </section>
 
     <section id="share-shorewall">
-      <title>/usr/share/shorewall</title>
+      <title>/usr/share/shorewall (${SHAREDIR}/shorewall)</title>
 
       <para>The bulk of Shorewall is installed here.</para>
 
@@ -220,22 +229,28 @@
     </section>
 
     <section id="shorewall">
-      <title>/etc/shorewall</title>
+      <title>/etc/shorewall (${CONFDIR}/shorewall)</title>
 
       <para>This is where the modifiable IPv4 configuration files are
       installed.</para>
     </section>
 
     <section id="init">
-      <title>/etc/init.d or /etc/rc.d (depends on distribution)</title>
+      <title>/etc/init.d or /etc/rc.d (depends on distribution)
+      ($INITDIR)</title>
 
       <para>An init script is installed here. Depending on the distribution,
       it is named <filename>shorewall</filename> or
-      <filename>rc.firewall</filename>.</para>
+      <filename>rc.firewall</filename>. Only installed on systems where
+      systemd is not installed.</para>
+
+      <para>When systemd is installed, the Shorewall .service files are
+      installed in the directory specified by the SERVICEDIR variable in
+      <filename>/usr/share/shorewall/shorewallrc</filename>.</para>
     </section>
 
     <section id="var">
-      <title>/var/lib/shorewall</title>
+      <title>/var/lib/shorewall (${VARLIB}/shorewall)</title>
 
       <para>Shorewall doesn't install any files in this directory but rather
       uses the directory for storing state information. This directory may be
@@ -332,7 +347,7 @@
     <para>Shorewall6 installs its files in a number of directories:</para>
 
     <section id="sbin6">
-      <title>/sbin</title>
+      <title>/sbin ($SBINDIR)</title>
 
       <para>The <filename>/sbin/shorewall6</filename> shell program is used to
       interact with Shorewall6. See <ulink
@@ -340,7 +355,7 @@
     </section>
 
     <section id="share-shorewall6">
-      <title>/usr/share/shorewall6</title>
+      <title>/usr/share/shorewall6 (${SHAREDIR}/shorewall6)</title>
 
       <para>The bulk of Shorewall6 is installed here.</para>
 
@@ -417,14 +432,28 @@
     </section>
 
     <section id="etc-shorewall6">
-      <title>/etc/shorewall6</title>
+      <title>/etc/shorewall6 (${CONFDIR}/</title>
 
       <para>This is where the modifiable IPv6 configuration files are
       installed.</para>
     </section>
 
+    <section id="init">
+      <title>/etc/init.d or /etc/rc.d (depends on distribution)
+      ($INITDIR)</title>
+
+      <para>An init script is installed here. Depending on the distribution,
+      it is named <filename>shorewall6</filename> or
+      <filename>rc.firewall</filename>. Only installed on systems where
+      systemd is not installed.</para>
+
+      <para>When systemd is installed, the Shorewall .service files are
+      installed in the directory specified by the SERVICEDIR variable in
+      <filename>/usr/share/shorewall/shorewallrc</filename>.</para>
+    </section>
+
     <section id="var-shorewall6">
-      <title>/var/lib/shorewall6</title>
+      <title>/var/lib/shorewall6 (${VARLIB}/shorewall6)</title>
 
       <para>Shorewall6 doesn't install any files in this directory but rather
       uses the directory for storing state information. This directory may be
@@ -514,7 +543,7 @@
     in the sub-sections that follow.</para>
 
     <section id="sbin-lite">
-      <title>/sbin</title>
+      <title>/sbin ($SBINDIR_</title>
 
       <para>The <filename>/sbin/shorewall-lite</filename> shell program is
       used to interact with Shorewall lite. See <ulink
@@ -522,22 +551,28 @@
     </section>
 
     <section id="init-lite">
-      <title>/etc/init.d or /etc/rc.d (depends on distribution)</title>
+      <title>/etc/init.d or /etc/rc.d (depends on distribution)
+      ($INITDIR)</title>
 
       <para>An init script is installed here. Depending on the distribution,
       it is named <filename>shorewall-lite</filename> or
-      <filename>rc.firewall</filename>.</para>
+      <filename>rc.firewall</filename>. Only installed on systems where
+      systemd is not installed.</para>
+
+      <para>When systemd is installed, the Shorewall .service files are
+      installed in the directory specified by the SERVICEDIR variable in
+      <filename>/usr/share/shorewall/shorewallrc</filename>.</para>
     </section>
 
     <section id="shorewall-lite">
-      <title>/etc/shorewall-lite</title>
+      <title>/etc/shorewall-lite (${CONFDIR}/shorewall-lite)</title>
 
       <para>This is where the modifiable configuration files are
       installed.</para>
     </section>
 
     <section id="share-lite">
-      <title>/usr/share/shorewall-lite</title>
+      <title>/usr/share/shorewall-lite (${SHAREDIR}/shorewall-lite)</title>
 
       <para>The bulk of Shorewall-lite is installed here.</para>
 
@@ -586,7 +621,7 @@
     </section>
 
     <section id="var-lite">
-      <title>/var/lib/shorewall-lite</title>
+      <title>/var/lib/shorewall-lite (${VARLIB}/shorewall-lite)</title>
 
       <para>Shorewall-lite doesn't install any files in this directory but
       rather uses the directory for storing state information. This directory
@@ -719,15 +754,29 @@
       <filename>rc.firewall</filename>.</para>
     </section>
 
+    <section id="init">
+      <title>/etc/init.d or /etc/rc.d (depends on distribution)
+      ($INITDIR)</title>
+
+      <para>An init script is installed here. Depending on the distribution,
+      it is named <filename>shorewall</filename>6-lite or
+      <filename>rc.firewall</filename>. Only installed on systems where
+      systemd is not installed.</para>
+
+      <para>When systemd is installed, the Shorewall .service files are
+      installed in the directory specified by the SERVICEDIR variable in
+      <filename>/usr/share/shorewall/shorewallrc</filename>.</para>
+    </section>
+
     <section id="etc-shorewall6-lite">
-      <title>/etc/shorewall6-lite</title>
+      <title>/etc/shorewall6-lite (${CONFDIR}/shorewall6-lite)</title>
 
       <para>This is where the modifiable configuration files are
       installed.</para>
     </section>
 
     <section id="share-lite6">
-      <title>/usr/share/shorewall6-lite</title>
+      <title>/usr/share/shorewall6-lite (${SHAREDIR}/shorewall6-lite)</title>
 
       <para>The bulk of Shorewall-lite is installed here.</para>
 
@@ -776,7 +825,7 @@
     </section>
 
     <section id="var-lite6">
-      <title>/var/lib/shorewall6-lite</title>
+      <title>/var/lib/shorewall6-lite (${VARLIB}/shorewall6-lite)</title>
 
       <para>Shorewall6-lite doesn't install any files in this directory but
       rather uses the directory for storing state information. This directory

docs/FAQ.xml

@@ -494,6 +494,12 @@ DNAT       net           loc:192.168.1.4    tcp      21          -         206.1
         <filename>/etc/shorewall/masq</filename>:<programlisting>#INTERFACE              SOURCE             ADDRESS         PROTO   PORT
 eth1:192.168.1.4        0.0.0.0/0          192.168.1.1     tcp     21</programlisting></para>
 
+        <para>When running Shorewall 5.0.14 or later, the eqivalent
+        <filename>/etc/shorewall/snat</filename> file is:</para>
+
+        <programlisting>#ACTION                 SOURCE              DEST              PROTO  PORT
+SNAT(192.168.1.1)       0.0.0.0/0           eth1:192.168.1.4  tcp    21</programlisting>
+
         <para>This rule has the undesirable side effect of making all FTP
         connections from the net appear to the FTP server as if they
         originated on the Shorewall system. But it will force the FTP server
@@ -531,6 +537,12 @@ net             eth0                    <emphasis role="bold">routeback</emphasi
         <para><filename>/etc/shorewall/masq</filename>;<programlisting>#INTERFACE              SOURCE          ADDRESS         PROTO   PORT
 eth0:66.249.93.111      0.0.0.0/0       206.124.146.176 tcp     993</programlisting></para>
 
+        <para>When running Shorewall 5.0.14 or later, the equivalent
+        /etc/shorewall/snat file is:</para>
+
+        <programlisting>#ACTION                 SOURCE          DEST                PROTO   PORT
+SNAT(206.124.146.176)   0.0.0.0/0       eth0:66.249.93.111  tcp     993</programlisting>
+
         <para>and in
         <filename>/etc/shorewall/shorewall.conf</filename>:</para>
 
@@ -718,6 +730,12 @@ loc             eth1                    <emphasis role="bold">routeback</emphasi
           <programlisting>#INTERFACE              SOURCE          ADDRESS         PROTO   PORT
 <emphasis role="bold">eth1:192.168.1.5        192.168.1.0/24  192.168.1.254   tcp     www</emphasis></programlisting>
 
+          <para>When running Shorewall 5.0.14 or later, the corresponding
+          <filename>/etc/shorewall/snat</filename> file is:</para>
+
+          <programlisting>#ACTION                 SOURCE          DEST                PROTO   PORT
+<emphasis role="bold">SNAT(192.168.1.254)     192.168.1.0/24  eth1:192.168.1.5    tcp     www</emphasis></programlisting>
+
           <para>Note: The technique described here is known as
           <firstterm>hairpinning NAT</firstterm> and is described in section 6
           of <ulink url="http://www.faqs.org/rfcs/rfc4787.html">RFC
@@ -727,6 +745,11 @@ loc             eth1                    <emphasis role="bold">routeback</emphasi
 
           <programlisting>#INTERFACE              SOURCE          ADDRESS         PROTO   PORT
 eth1:192.168.1.5        192.168.1.0/24  <emphasis role="bold">130.151.100.69</emphasis>  tcp     www</programlisting>
+
+          <para>Equivalent <filename>/etc/shorewall/snat</filename>:</para>
+
+          <programlisting>#ACTION                 SOURCE          DEST                PROTO   PORT
+SNAT(<emphasis role="bold">130.151.100.69</emphasis>)    192.168.1.0/24  eth1:192.168.1.5    tcp     www</programlisting>
         </listitem>
 
         <listitem>
@@ -852,6 +875,12 @@ dmz             eth2                    <emphasis role="bold">routeback</emphasi
           <programlisting>#INTERFACE              SOURCE
 eth2:192.168.1.2        192.168.2.0/24</programlisting>
 
+          <para>When running Shorewall 5.0.14 or later, the equivalent
+          <filename>/etc/shorewall/snat</filename> is:</para>
+
+          <programlisting>#ACTION        SOURCE          DEST                PROTO   PORT
+MASQUERADE     192.168.1.0/24  eth2:192.168.1.2    tcp     www</programlisting>
+
           <para>In <filename>/etc/shorewall/nat</filename>, be sure that you
           have <quote>Yes</quote> in the ALL INTERFACES column.</para>
         </example>
@@ -3191,11 +3220,17 @@ loc             $FW             ACCEPT</programlisting>
 
           <programlisting>#INTERFACE              SOURCE          ADDRESS
 
-COMMENT DSL Modem
+?COMMENT DSL Modem
 
 EXT_IF:172.20.1.2       0.0.0.0/0       172.20.1.254
 </programlisting>
 
+          <para>When running Shorewall 5.0.14 or later, the equivalent
+          <filename>/etc/shorewall/snat</filename> is:</para>
+
+          <programlisting>#ACTION                SOURCE          DEST                PROTO   PORT
+SNAT(172.20.1.254)     0.0.0.0/0       EXT_IF:192.168.1.2  tcp     www</programlisting>
+
           <para><filename>/etc/shorewall/proxyarp</filename>:</para>
 
           <programlisting>#ADDRESS        INTERFACE       EXTERNAL        HAVEROUTE       PERSISTENT
@@ -3233,6 +3268,12 @@ COMMENT DSL Modem
 
 EXT_IF:192.168.1.1      0.0.0.0/0       192.168.1.254
 </programlisting>
+
+          <para>When running Shorewall 5.0.14 or later, the equivalent
+          <filename>/etc/shorewall/snat</filename> is:</para>
+
+          <programlisting>#ACTION                SOURCE          DEST                PROTO   PORT
+SNAT(192.168.1.254)    0.0.0.0/0       EXT_IF:192.168.1.1  tcp     www</programlisting>
         </listitem>
       </itemizedlist>
     </section>

docs/IPSEC-2.6.xml

@@ -152,11 +152,13 @@
 
     <orderedlist>
       <listitem>
-        <para>In <filename>/etc/shorewall/masq</filename>, traffic that will
-        later be encrypted is exempted from MASQUERADE/SNAT using existing
-        entries. If you want to MASQUERADE/SNAT outgoing traffic that will
-        later be encrypted, you must include the appropriate indication in the
-        new IPSEC column in that file.</para>
+        <para>In <filename>/etc/shorewall/masq</filename>
+        (<filename>/etc/shorewall/snat</filename> when running Shorewall
+        5.0.14 or later), traffic that will later be encrypted is exempted
+        from MASQUERADE/SNAT using existing entries. If you want to
+        MASQUERADE/SNAT outgoing traffic that will later be encrypted, you
+        must include the appropriate indication in the IPSEC column in that
+        file. </para>
       </listitem>
 
       <listitem>

docs/MultiISP.xml

@@ -774,7 +774,7 @@ fi</programlisting>
     </section>
 
     <section id="masq">
-      <title>./etc/shorewall/masq and Multi-ISP</title>
+      <title>./etc/shorewall/masq (/etc/shorewall/snat) and Multi-ISP</title>
 
       <para>If you masquerade a local network, you will need to add masquerade
       rules for both external interfaces. Referring to the diagram above, if
@@ -786,6 +786,13 @@ fi</programlisting>
 eth0             0.0.0.0/0         206.124.146.176
 eth1             0.0.0.0/0         130.252.99.27</programlisting>
 
+      <para>When running Shorewall 5.0.14 or later, the equivalent
+      <filename>/etc/shorewall/snat</filename> is:</para>
+
+      <programlisting>#ACTION                SOURCE          DEST                PROTO   PORT
+SNAT(206.124.146.176)  0.0.0.0/0       eth0
+SNAT(130252.99.27)     0.0.0.0/0       eth1</programlisting>
+
       <para>If you have a public subnet (for example 206.124.146.176/30)
       behind your firewall, then use exclusion:</para>
 
@@ -793,6 +800,12 @@ eth1             0.0.0.0/0         130.252.99.27</programlisting>
 eth0             !206.124.146.176/29  206.124.146.176
 eth1             0.0.0.0/0            130.252.99.27</programlisting>
 
+      <para>The equivalent <filename>/etc/shorewall/snat</filename> is:</para>
+
+      <programlisting>#ACTION                SOURCE              DEST                PROTO   PORT
+SNAT(206.124.146.176)  !206.124.146.176/29 eth0
+SNAT(130.252.99.27)    0.0.0.0/0           eth1</programlisting>
+
       <para>Note that exclusion is only used on the interface corresponding to
       internal subnetwork.</para>
 
@@ -801,10 +814,10 @@ eth1             0.0.0.0/0            130.252.99.27</programlisting>
       contains all of those addresses from being masqueraded.</para>
 
       <warning>
-        <para>Entries in <filename>/etc/shorewall/masq</filename> have no
-        effect on which ISP a particular connection will be sent through. That
-        is rather the purpose of entries in
-        <filename>/etc/shorewall/mangle</filename> and
+        <para>Entries in <filename>/etc/shorewall/masq</filename>
+        (<filename>/etc/shorewall/snat</filename>) have no effect on which ISP
+        a particular connection will be sent through. That is rather the
+        purpose of entries in <filename>/etc/shorewall/mangle</filename> and
         <filename>/etc/shorewall/rtrules</filename>.</para>
       </warning>
     </section>
@@ -830,7 +843,8 @@ Feb  9 17:23:45 gw.ilinx kernel: ll header: 00:a0:24:2a:1f:72:00:13:5f:07:97:05:
       206.124.146.176. Another gotcha is that the incoming packet has already
       had the destination IP address changed for DNAT or because the original
       outgoing connection was altered by an entry in
-      <filename>/etc/shorewall/masq</filename> (SNAT or Masquerade). So the
+      <filename>/etc/shorewall/masq</filename> or
+      <filename>/etc/shorewall/snat</filename> (SNAT or Masquerade). So the
       destination IP address (206.124.146.176) may not have been the
       destination IP address in the packet as it was initially
       received.</para>
@@ -960,6 +974,13 @@ net        net            DROP</programlisting>
       <programlisting>#INTERFACE       SOURCE            ADDRESS
 eth0             0.0.0.0/0         206.124.146.176
 eth1             0.0.0.0/0         130.252.99.27</programlisting>
+
+      <para>When running Shorewall 5.0.14 or later, the equivalent
+      <filename>/etc/shorewall/snat</filename> is:</para>
+
+      <programlisting>#ACTION                SOURCE          DEST                PROTO   PORT
+SNAT(206.124.146.176)  0.0.0.0/0       eth0
+SNAT(130.252.99.27)    0.0.0.0/0       eth1</programlisting>
     </section>
 
     <section id="Applications">
@@ -1050,7 +1071,8 @@ DNAT           net                loc:192.168.1.3   tcp       25               <
 
         <listitem>
           <para>For each external interface, you need to add an entry to
-          <filename>/etc/shorewall/masq</filename>.</para>
+          <filename>/etc/shorewall/masq</filename>
+          (<filename>/etc/shorewall/snat</filename>).</para>
         </listitem>
       </orderedlist>
 
@@ -1066,6 +1088,14 @@ ISP3    3       3       main            eth3            16.105.78.254   track,ba
 eth0             0.0.0.0/0         206.124.146.176
 eth1             0.0.0.0/0         130.252.99.27
 eth3             0.0.0.0/0         16.105.78.4</programlisting></para>
+
+      <para>When running Shorewall 5.0.14 or later, the equivalent
+      <filename>/etc/shorewall/snat</filename> is:</para>
+
+      <programlisting>#ACTION                SOURCE          DEST                PROTO   PORT
+SNAT(206.124.146.176)  0.0.0.0/0       eth0
+SNAT(130.252.99.27)    0.0.0.0/0       eth1
+SNAT(16.105.78.4)      0.0.0.0/0       eth2</programlisting>
     </section>
 
     <section id="rtrules">
@@ -2498,8 +2528,9 @@ exit 0
         </listitem>
 
         <listitem>
-          <para>Entries in <filename>/etc/shorewall/masq</filename> must be
-          qualified by the provider name (or number).</para>
+          <para>Entries in <filename>/etc/shorewall/masq</filename> and
+          <filename>/etc/shorewall/snat</filename> must be qualified by the
+          provider name (or number).</para>
         </listitem>
 
         <listitem>

docs/Multiple_Zones.xml

@@ -349,6 +349,12 @@ loc                 eth0:192.168.1.0/24                maclist</programlisting>
     <programlisting>#INTERFACE              SOURCE          ADDRESS
 eth0:!192.168.1.0/24    192.168.1.0/24</programlisting>
 
+    <para>When running Shorewall 5.0.14 or later, the equivalent
+    <filename>/etc/shorewall/snat</filename> is:</para>
+
+    <programlisting>#ACTION                SOURCE          DEST                PROTO   PORT
+MASQUERADE             0.0.0.0/0       eth0:!192.168.1.0/24</programlisting>
+
     <para>Note that the <emphasis role="bold">maclist</emphasis> option is
     specified in <filename>/etc/shorewall/interfaces</filename>. This is to
     help protect your router from unauthorized access by your friends and

docs/NAT.xml

@@ -79,7 +79,8 @@
 
     <para>Be sure that the internal system(s) (10.1.1.2 and 10.1.1.3 in the
     above example) is (are) not included in any specification in
-    <filename>/etc/shorewall/masq</filename> or
+    <filename>/etc/shorewall/masq</filename>
+    (<filename>/etc/shorewall/snat</filename>) or
     <filename>/etc/shorewall/proxyarp</filename>.</para>
 
     <note>

docs/PacketHandling.xml

@@ -311,9 +311,10 @@
 
       <listitem>
         <para>The source IP address may be rewritten according to an entry in
-        the <filename>/etc/shorewall/masq</filename> file. If this is a new
-        connection request, then the rewriting occurs in a
-        <emphasis>nat</emphasis> table chain called <emphasis
+        the <filename>/etc/shorewall/masq</filename> or
+        <filename>/etc/shorewall/snat</filename> file (Shorewall 5.0.14 or
+        later). If this is a new connection request, then the rewriting occurs
+        in a <emphasis>nat</emphasis> table chain called <emphasis
         role="bold"><emphasis>interface</emphasis>_masq</emphasis> where
         <emphasis>interface</emphasis> is the interface on which the packet
         will be sent. For packets that are part of an already established

docs/PacketMarking.xml

@@ -44,7 +44,7 @@
   </caution>
 
   <important>
-    <para>/etc/shorewall/mangle superseded /etc/shorewall/tcruels in Shorewall
+    <para>/etc/shorewall/mangle superseded /etc/shorewall/tcrules in Shorewall
     4.6.0. /etc/shorwall/tcrules is still supported but its use is
     deprecated.</para>
   </important>

docs/ProxyARP.xml

@@ -98,7 +98,8 @@
 
     <para><emphasis role="bold">Be sure that the internal systems
     (130.242.100.18 and 130.252.100.19 in the above example) are not included
-    in any specification in <filename>/etc/shorewall/masq</filename> or
+    in any specification in <filename>/etc/shorewall/masq</filename>
+    (/etc/shorewall/snat on Shorewall 5.0.14 or later) or
     <filename>/etc/shorewall/nat</filename>.</emphasis></para>
 
     <note>

docs/QOSExample.xml

@@ -76,7 +76,11 @@
     <para>The shell variables set in the OpenWRT script are set in the
     Shorewall params file:</para>
 
-    <programlisting>DOWNLOAD=40000 #download speed in kbit. set xx% of real download speed
+    <programlisting># local network
+
+MYNET=192.168.0.0/24
+
+DOWNLOAD=40000 #download speed in kbit. set xx% of real download speed
 UPLOAD=7000 # set xx% of real upload speed
 
 # multiports = up to 15 ports

docs/Shorewall_and_Aliased_Interfaces.xml

@@ -200,10 +200,22 @@ DNAT      net        loc:192.168.1.3:22   tcp        10000          -         20
       <programlisting>#INTERFACE             SUBNET          ADDRESS
 eth0                   192.168.1.0/24  206.124.146.178</programlisting>
 
+      <para>When running Shorewall 5.0.14 or later, the equivalent
+      <filename>/etc/shorewall/snat</filename> is:</para>
+
+      <programlisting>#ACTION                SOURCE          DEST                PROTO   PORT
+SNAT(206.124.146.178)  0.0.0.0/0       eth0</programlisting>
+
       <para>Similarly, you want SMTP traffic from local system 192.168.1.22 to
       have source IP 206.124.146.178:<programlisting>#INTERFACE             SUBNET          ADDRESS             PROTO      DPORT
 eth0                   192.168.1.22    206.124.146.178     tcp        25</programlisting></para>
 
+      <para>When running Shorewall 5.0.14 or later, the equivalent
+      <filename>/etc/shorewall/snat</filename> is:</para>
+
+      <programlisting>#ACTION                SOURCE          DEST                PROTO   PORT
+SNAT(206.124.146.178)  0.0.0.0/0       eth0                tcp     25</programlisting>
+
       <para>Shorewall can create the alias (additional address) for you if you
       set ADD_SNAT_ALIASES=Yes in
       <filename>/etc/shorewall/shorewall.con</filename>f.</para>
@@ -220,16 +232,29 @@ eth0                   192.168.1.22    206.124.146.178     tcp        25</progra
       the INTERFACE column as follows.</para>
 
       <para><filename>/etc/shorewall/masq</filename><programlisting>#INTERFACE              SUBNET         ADDRESS
-eth0:0                  192.168.1.0/24 206.124.146.178</programlisting>Shorewall
-      can also set up SNAT to round-robin over a range of IP addresses. To do
-      that, you specify a range of IP addresses in the ADDRESS column. If you
-      specify a label in the INTERFACE column, Shorewall will use that label
-      for the first address of the range and will increment the label by one
-      for each subsequent label.</para>
+eth0:0                  192.168.1.0/24 206.124.146.178</programlisting></para>
 
-      <para><filename>/etc/shorewall/masq</filename><programlisting>#INTERFACE               SUBNET         ADDRESS
+      <para>When running Shorewall 5.0.14 or later, the equivalent
+      <filename>/etc/shorewall/snat</filename> is:</para>
+
+      <programlisting>#ACTION                SOURCE          DEST                PROTO   PORT
+SNAT(206.124.146.178)  192.168.1.0/24  eth0</programlisting>
+
+      <para>Shorewall can also set up SNAT to round-robin over a range of IP
+      addresses. To do that, you specify a range of IP addresses in the
+      ADDRESS column. If you specify a label in the INTERFACE column,
+      Shorewall will use that label for the first address of the range and
+      will increment the label by one for each subsequent label.</para>
+
+      <para><filename>/etc/shorewall/masq</filename><programlisting>#INTERFACE               SOURCE         ADDRESS
 eth0:0                   192.168.1.0/24 206.124.146.178-206.124.146.180</programlisting></para>
 
+      <para>When running Shorewall 5.0.14 or later, the equivalent
+      <filename>/etc/shorewall/snat</filename> is:</para>
+
+      <programlisting>#ACTION                              SOURCE          DEST                PROTO   PORT
+SNAT(206.124.146.178-206.24.146.80)  192.168.1.0/24  eth0</programlisting>
+
       <para>The above would create three IP addresses:</para>
 
       <programlisting>eth0:0 = 206.124.146.178

docs/SimpleBridge.xml

@@ -145,5 +145,11 @@ loc            <emphasis role="bold">br0</emphasis>             <emphasis
 
     <programlisting>#INTERFACE     SOURCE          ADDRESS
 eth0           10.0.1.0/24     ...            # 10.0.1.0/24 is the local network on LAN A and LAN B</programlisting>
+
+    <para>When running Shorewall 5.0.14 or later, the equivalent
+    <filename>/etc/shorewall/snat</filename> is:</para>
+
+    <programlisting>#ACTION                SOURCE          DEST                PROTO   PORT
+MASQUERADE             10.0.1.0/24     eth0</programlisting>
   </section>
 </article>