IPv6 Samples use logical interface names

Signed-off-by: Tom Eastep <teastep@shorewall.net>
Use logical interface names in the samples.
2017-11-22 09:52:53 -08:00 · 2017-11-22 09:44:15 -08:00
75 changed files with 791 additions and 1138 deletions
--- a/Shorewall-core/configure
+++ b/Shorewall-core/configure
@@ -2,7 +2,7 @@
 #
 #     Shorewall Packet Filtering Firewall RPM configuration program - V4.6
 #
-#     (c) 2012,2014,2017 - Tom Eastep (teastep@shorewall.net)
+#     (c) 2012,2014 - Tom Eastep (teastep@shorewall.net)
 #
 #	Shorewall documentation is available at http://www.shorewall.net
 #
--- a/Shorewall-core/install.sh
+++ b/Shorewall-core/install.sh
@@ -2,7 +2,7 @@
 #
 # Script to install Shoreline Firewall Core Modules
 #
-#     (c) 2000-2018 - Tom Eastep (teastep@shorewall.net)
+#     (c) 2000-2016 - Tom Eastep (teastep@shorewall.net)
 #
 #       Shorewall documentation is available at http://shorewall.net
 #
@@ -335,8 +335,9 @@ for f in lib.* ; do
 done

 if [ $SHAREDIR != /usr/share ]; then
-    eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/shorewall/lib.base
-    eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/shorewall/lib.cli
+    eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/${PRODUCT}/lib.base
+    eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/${PRODUCT}/lib.core
+    eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/${PRODUCT}/lib.cli
 fi

 #
--- a/Shorewall-core/lib.cli
+++ b/Shorewall-core/lib.cli
@@ -1,7 +1,7 @@
 #
-# Shorewall 5.1 -- /usr/share/shorewall/lib.cli.
+# Shorewall 5.0 -- /usr/share/shorewall/lib.cli.
 #
-#     (c) 1999-2018 - Tom Eastep (teastep@shorewall.net)
+#     (c) 1999-2015 - Tom Eastep (teastep@shorewall.net)
 #
 #	Complete documentation is available at http://shorewall.net
 #
@@ -47,10 +47,6 @@ startup_error() {
    exit 1
 }

-only_root() {
-    [ "$(id -u)" != 0 ] && fatal_error "The '$COMMAND' command may only be run by root"
-}
-
 #
 # Display a chain if it exists
 #
@@ -1207,7 +1203,6 @@ show_command() {
    show_macro() {
 	foo=`grep 'This macro' $macro | sed 's/This macro //'`
 	if [ -n "$foo" ]; then
-	    macro=$(basename $macro)
 	    macro=${macro#*.}
 	    foo=${foo%.*}
 	    if [ ${#macro} -gt 5 ]; then
@@ -1302,47 +1297,37 @@ show_command() {

    [ -n "$g_debugging" ] && set -x

-    COMMAND="$COMMAND $1"
-
    case "$1" in
 	connections)
-	    only_root
 	    eval show_connections $@ $g_pager
 	    ;;
 	nat)
-	    only_root
 	    [ $# -gt 1 ] && too_many_arguments $2
 	    eval show_nat $g_pager
 	    ;;
 	raw)
-	    only_root
 	    [ $# -gt 1 ] && too_many_arguments $2
 	    eval show_raw $g_pager
 	    ;;
 	tos|mangle)
-	    only_root
 	    [ $# -gt 1 ] && too_many_arguments $2
 	    eval show_mangle $g_pager
 	    ;;
 	log)
 	    [ $# -gt 2 ] && too_many_arguments $2

-	    only_root
 	    setup_logread
 	    eval show_log $g_pager
 	    ;;
 	tc)
-	    only_root
 	    [ $# -gt 2 ] && too_many_arguments $2
 	    eval show_tc $@ $g_pager
 	    ;;
 	classifiers|filters)
-	    only_root
 	    [ $# -gt 1 ] && too_many_arguments $2
 	    eval show_classifiers_command $g_pager
 	    ;;
 	zones)
-	    only_root
 	    [ $# -gt 1 ] && too_many_arguments $2
 	    if [ -f ${VARDIR}/zones ]; then
 		echo "$g_product $SHOREWALL_VERSION Zones at $g_hostname - $(date)"
@@ -1366,7 +1351,6 @@ show_command() {
 	    fi
 	    ;;
 	capabilities)
-	    only_root
 	    [ $# -gt 1 ] && too_many_arguments $2
 	    determine_capabilities
 	    VERBOSITY=2
@@ -1403,7 +1387,6 @@ show_command() {
 	    fi
 	    ;;
 	chain)
-	    only_root
 	    shift
 	    eval show_chain $@ $g_pager
 	    ;;
@@ -1411,31 +1394,26 @@ show_command() {
 	    echo $VARDIR;
 	    ;;
 	policies)
-	    only_root
 	    [ $# -gt 1 ] && too_many_arguments $2
 	    eval show_policies $g_pager
 	    ;;
 	ipa)
-	    only_root
 	    [ $g_family -eq 4 ] || fatal_error "'show ipa' is now available in $g_product"
 	    [ $# -gt 1 ] && too_many_arguments $2
 	    eval show_ipa $g_pager
 	    ;;
 	marks)
 	    [ $# -gt 1 ] && too_many_arguments $2
-	    only_root
 	    echo "$g_product $SHOREWALL_VERSION Mark Layout at $g_hostname - $(date)"
 	    echo
 	    [ -f ${VARDIR}/marks ] && cat ${VARDIR}/marks;
 	    ;;
 	nfacct)
 	    [ $# -gt 1 ] && too_many_arguments $2
-	    only_root
 	    eval show_nfacct_command $g_pager
 	    ;;
 	arptables)
 	    [ $# -gt 1 ] && too_many_arguments $2
-	    only_root
 	    resolve_arptables
 	    if [ -n "$arptables" -a -x $arptables ]; then
 		eval show_arptables $g_pager
@@ -1445,7 +1423,6 @@ show_command() {
 	    ;;
 	event)
 	    [ $# -gt 1 ] || too_many_arguments $2
-	    only_root
 	    echo "$g_product $SHOREWALL_VERSION events at $g_hostname - $(date)"
 	    echo
 	    shift
@@ -1453,18 +1430,14 @@ show_command() {
 	    ;;
 	events)
 	    [ $# -gt 1 ] && too_many_arguments $2
-	    only_root
 	    eval show_events_command $g_pager
 	    ;;
 	bl|blacklists)
 	    [ $# -gt 1 ] && too_many_arguments $2
-	    only_root
-	    setup_dbl
 	    eval show_blacklists $g_pager
 	    ;;
 	opens)
 	    [ $# -gt 1 ] && too_many_arguments $2
-	    only_root
 	    echo "$g_product $SHOREWALL_VERSION Temporarily opened connections at $g_hostname - $(date)"

 	    if chain_exists dynamic; then
@@ -1475,7 +1448,6 @@ show_command() {
 	    ;;
 	ipsec)
 	    [ $# -gt 1 ] && too_many_arguments $2
-	    only_root
 	    eval show_ipsec_command $g_pager
 	    ;;
 	*)
@@ -1524,8 +1496,6 @@ show_command() {
 		    ;;
 	    esac

-	    only_root
-
 	    if [ $# -gt 0 ]; then
 		if [ $1 = dynamic -a $# -gt 1 ]; then
 		    shift
@@ -1843,7 +1813,7 @@ do_dump_command() {

    echo

-    qt mywhich ss && ss -${g_family}tunap || { qt mywhich netstat && netstat -tunap; }
+    qt mywhich ss && ss -${g_family}tunap || { qt mywhich netstat && netatat -tunap; }

    if [ -n "$TC_ENABLED" ]; then
 	heading "Traffic Control"
@@ -2575,114 +2545,109 @@ hits_command() {
    fi
 }

-#
-# Issue an error message and terminate if the firewall isn't started
-#
-require_started() {
-    if ! product_is_started; then
-	error_message "ERROR: $g_product is not started"
-	exit 2
-    fi
-}
-
 #
 # 'allow' command executor
 #
 allow_command() {

-    local allowed
-    local which
-    which='-s'
-    local range
-    range='--src-range'
-    local dynexists
-
    [ -n "$g_debugging" ] && set -x
    [ $# -eq 1 ] && missing_argument

-    if [ -n "$g_blacklistipset" ]; then
-	case ${IPSET:=ipset} in
-	    */*)
-		if [ ! -x "$IPSET" ]; then
-		    fatal_error "IPSET=$IPSET does not exist or is not executable"
-		fi
-		;;
-	    *)
-		IPSET="$(mywhich $IPSET)"
-		[ -n "$IPSET" ] || fatal_error "The ipset utility cannot be located"
-		;;
-	esac
-    fi
+    if product_is_started ; then
+	local allowed
+	local which
+	which='-s'
+	local range
+	range='--src-range'
+	local dynexists

-    if chain_exists dynamic; then
-	dynexists=Yes
-    elif [ -z "$g_blacklistipset" ]; then
-	require_started
-	fatal_error "Dynamic blacklisting is not enabled in the current $g_product configuration"
-    fi
+	if [ -n "$g_blacklistipset" ]; then

-    [ -n "$g_nolock" ] || mutex_on
-
-    while [ $# -gt 1 ]; do
-	shift
-
-	allowed=''
-
-	case $1 in
-	    from)
-		which='-s'
-		range='--src-range'
-		continue
-		;;
-	    to)
-		which='-d'
-		range='--dst-range'
-		continue
-		;;
-	    *-*)
-		if [ -n "$g_blacklistipset" ]; then
-		    if qt $IPSET -D $g_blacklistipset $1; then
-			allowed=Yes
+	    case ${IPSET:=ipset} in
+		*/*)
+		    if [ ! -x "$IPSET" ]; then
+			fatal_error "IPSET=$IPSET does not exist or is not executable"
 		    fi
-		fi
-
-		if [ -n "$dynexists" ]; then
-		    if  qt $g_tool -D dynamic -m iprange $range $1 -j reject    ||\
-			qt $g_tool -D dynamic -m iprange $range $1 -j DROP      ||\
-			qt $g_tool -D dynamic -m iprange $range $1 -j logdrop   ||\
-			qt $g_tool -D dynamic -m iprange $range $1 -j logreject
-		    then
-			allowed=Yes
-		    fi
-		fi
-		;;
-	    *)
-		if [ -n "$g_blacklistipset" ]; then
-		    if qt $IPSET -D $g_blacklistipset $1; then
-			allowed=Yes
-		    fi
-		fi
-
-		if [ -n "$dynexists" ]; then
-		    if  qt $g_tool -D dynamic $which $1 -j reject    ||\
-		        qt $g_tool -D dynamic $which $1 -j DROP      ||\
-			qt $g_tool -D dynamic $which $1 -j logdrop   ||\
-			qt $g_tool -D dynamic $which $1 -j logreject
-		    then
-			allowed=Yes
-		    fi
-		fi
-		;;
-	esac
-
-	if [ -n "$allowed" ]; then
-	    progress_message2 "$1 Allowed"
-	else
-	    error_message "WARNING: $1 already allowed (not dynamically blacklisted)"
+		    ;;
+		*)
+		    IPSET="$(mywhich $IPSET)"
+		    [ -n "$IPSET" ] || fatal_error "The ipset utility cannot be located"
+		    ;;
+	    esac
 	fi
-    done

-    [ -n "$g_nolock" ] || mutex_off
+	if chain_exists dynamic; then
+	    dynexists=Yes
+	elif [ -z "$g_blacklistipset" ]; then
+	    fatal_error "Dynamic blacklisting is not enabled in the current $g_product configuration"
+	fi
+
+	[ -n "$g_nolock" ] || mutex_on
+
+	while [ $# -gt 1 ]; do
+	    shift
+
+	    allowed=''
+
+	    case $1 in
+		from)
+		    which='-s'
+		    range='--src-range'
+		    continue
+		    ;;
+		to)
+		    which='-d'
+		    range='--dst-range'
+		    continue
+		    ;;
+		*-*)
+		    if [ -n "$g_blacklistipset" ]; then
+			if qt $IPSET -D $g_blacklistipset $1; then
+			    allowed=Yes
+			fi
+		    fi
+
+		    if [ -n "$dynexists" ]; then
+			if  qt $g_tool -D dynamic -m iprange $range $1 -j reject    ||\
+			    qt $g_tool -D dynamic -m iprange $range $1 -j DROP      ||\
+			    qt $g_tool -D dynamic -m iprange $range $1 -j logdrop   ||\
+			    qt $g_tool -D dynamic -m iprange $range $1 -j logreject
+			then
+			    allowed=Yes
+			fi
+		    fi
+		    ;;
+		*)
+		    if [ -n "$g_blacklistipset" ]; then
+			if qt $IPSET -D $g_blacklistipset $1; then
+			    allowed=Yes
+			fi
+		    fi
+
+		    if [ -n "$dynexists" ]; then
+			if  qt $g_tool -D dynamic $which $1 -j reject    ||\
+			    qt $g_tool -D dynamic $which $1 -j DROP      ||\
+			    qt $g_tool -D dynamic $which $1 -j logdrop   ||\
+			    qt $g_tool -D dynamic $which $1 -j logreject
+			then
+			    allowed=Yes
+			fi
+		    fi
+		    ;;
+	    esac
+
+	    if [ -n "$allowed" ]; then
+		progress_message2 "$1 Allowed"
+	    else
+		error_message "WARNING: $1 already allowed (not dynamically blacklisted)"
+	    fi
+	done
+
+	[ -n "$g_nolock" ] || mutex_off
+    else
+	error_message "ERROR: $g_product is not started"
+	exit 2
+    fi
 }

 #
@@ -4620,14 +4585,12 @@ shorewall_cli() {

    case "$COMMAND" in
 	start)
-	    only_root
 	    get_config Yes Yes
 	    shift
 	    start_command $@
 	    ;;
 	stop|clear)
 	    [ $# -ne 1 ] && too_many_arguments $2
-	    only_root
 	    get_config
 	    [ -x $g_firewall ] || fatal_error "$g_product has never been started"
 	    [ -n "$g_nolock" ] || mutex_on
@@ -4635,7 +4598,6 @@ shorewall_cli() {
 	    [ -n "$g_nolock" ] || mutex_off
 	    ;;
 	reset)
-	    only_root
 	    get_config
 	    shift
 	    [ -n "$g_nolock" ] || mutex_on
@@ -4644,13 +4606,11 @@ shorewall_cli() {
 	    [ -n "$g_nolock" ] || mutex_off
 	    ;;
 	reload|restart)
-	    only_root
 	    get_config Yes Yes
 	    shift
 	    restart_command $@
 	    ;;
 	disable|enable|reenable)
-	    only_root
 	    get_config Yes
 	    if product_is_started; then
 		run_it ${VARDIR}/firewall $g_debugging $@
@@ -4659,7 +4619,6 @@ shorewall_cli() {
 	    fi
 	    ;;
 	blacklist)
-	    only_root
 	    get_config Yes
 	    shift
 	    [ -n "$g_nolock" ] || mutex_on
@@ -4668,7 +4627,6 @@ shorewall_cli() {
 	    ;;
 	run)
 	    [ $# -gt 1 ] || fatal_error "Missing function name"
-	    only_root
 	    get_config Yes
 	    run_command $@
 	    ;;
@@ -4678,20 +4636,18 @@ shorewall_cli() {
    	    show_command $@
 	    ;;
 	status)
-	    only_root
+	    [ "$(id -u)" != 0 ] && fatal_error "The status command may only be run by root"
 	    get_config
 	    shift
 	    status_command $@
 	    ;;
 	dump)
-	    only_root
 	    get_config Yes No Yes
    	    shift
    	    dump_command $@
 	    ;;
 	hits)
 	    [ $g_family -eq 6 ] && fatal_error "$g_product does not support the hits command"
-	    only_root
 	    get_config Yes No Yes
 	    [ -n "$g_debugging" ] && set -x
 	    shift
@@ -4702,63 +4658,53 @@ shorewall_cli() {
 	    version_command $@
 	    ;;
 	logwatch)
-	    only_root
 	    get_config Yes Yes Yes
 	    banner="${g_product}-$SHOREWALL_VERSION Logwatch at $g_hostname -"
 	    logwatch_command $@
 	    ;;
 	drop)
-	    only_root
 	    get_config
 	    [ -n "$g_debugging" ] && set -x
 	    [ $# -eq 1 ] && missing_argument
 	    drop_command $@
 	    ;;
 	logdrop)
-	    only_root
 	    get_config
 	    [ -n "$g_debugging" ] && set -x
 	    [ $# -eq 1 ] && missing_argument
 	    logdrop_command $@
 	    ;;
 	reject|logreject)
-	    only_root
 	    get_config
 	    [ -n "$g_debugging" ] && set -x
 	    [ $# -eq 1 ] && missing_argument
 	    reject_command $@
 	    ;;
 	open|close)
-	    only_root
 	    get_config
 	    shift
 	    open_close_command $@
 	    ;;
 	allow)
-	    only_root
 	    get_config
 	    allow_command $@
 	    ;;
 	add)
-	    only_root
 	    get_config
 	    shift
 	    add_command $@
 	    ;;
 	delete)
-	    only_root
 	    get_config
 	    shift
 	    delete_command $@
 	    ;;
 	save)
-	    only_root
 	    get_config
 	    [ -n "$g_debugging" ] && set -x
 	    save_command $@
 	    ;;
 	forget)
-	    only_root
 	    get_config
 	    forget_command $@
 	    ;;
@@ -4775,13 +4721,11 @@ shorewall_cli() {
 	    ipdecimal_command $@
 	    ;;
 	restore)
-	    only_root
 	    get_config
 	    shift
 	    restore_command $@
            ;;
 	call)
-	    only_root
 	    get_config
 	    [ -n "$g_debugging" ] && set -x
 	    #
@@ -4819,20 +4763,17 @@ shorewall_cli() {
 	    usage
 	    ;;
 	iptrace)
-	    only_root
 	    get_config
 	    shift
 	    iptrace_command $@
 	    ;;
 	noiptrace)
-	    only_root
 	    get_config
 	    shift
 	    noiptrace_command $@
 	    ;;
 	savesets)
 	    [ $# -eq 1 ] || too_many_arguments $2
-	    only_root
 	    get_config
 	    [ -n "$g_debugging" ] && set -x
 	    savesets1
--- a/Shorewall-init/init.debian.sh
+++ b/Shorewall-init/init.debian.sh
@@ -73,16 +73,12 @@ setstatedir() {

    [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT}

-    if [ -x ${STATEDIR}/firewall ]; then
-        return 0
+    if [ $PRODUCT = shorewall ]; then
+	${SBINDIR}/shorewall compile
+    elif [ $PRODUCT = shorewall6 ]; then
+	${SBINDIR}/shorewall -6 compile
    else
-        if [ $PRODUCT = shorewall ]; then
-            ${SBINDIR}/shorewall compile
-        elif [ $PRODUCT = shorewall6 ]; then
-            ${SBINDIR}/shorewall -6 compile
-        else
-            return 1
-        fi
+	return 0
    fi
 }

@@ -112,14 +108,16 @@ shorewall_start () {

  for PRODUCT in $PRODUCTS; do
      if setstatedir; then
-          #
-	  # Run in a sub-shell to avoid name collisions
-	  #
-	  (
-	      if ! ${STATEDIR}/firewall status > /dev/null 2>&1; then
-		  ${STATEDIR}/firewall ${OPTIONS} stop
-	      fi
-	  )
+	  if [ -x ${STATEDIR}/firewall ]; then
+              #
+	      # Run in a sub-shell to avoid name collisions
+	      #
+	      (
+		  if ! ${STATEDIR}/firewall status > /dev/null 2>&1; then
+		      ${STATEDIR}/firewall ${OPTIONS} stop
+		  fi
+	      )
+	  fi
      fi
  done

@@ -147,7 +145,9 @@ shorewall_stop () {
  printf "Clearing \"Shorewall-based firewalls\": "
  for PRODUCT in $PRODUCTS; do
      if setstatedir; then
-	  ${STATEDIR}/firewall ${OPTIONS} clear
+	  if [ -x ${STATEDIR}/firewall ]; then
+	      ${STATEDIR}/firewall ${OPTIONS} clear
+	  fi
      fi
  done

--- a/Shorewall-init/init.fedora.sh
+++ b/Shorewall-init/init.fedora.sh
@@ -44,14 +44,12 @@ setstatedir() {

    [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT}

-    if [ -x ${STATEDIR}/firewall ]; then
-	return 0
-    elif [ $PRODUCT = shorewall ]; then
+    if [ $PRODUCT = shorewall ]; then
 	${SBINDIR}/shorewall compile
    elif [ $PRODUCT = shorewall6 ]; then
 	${SBINDIR}/shorewall -6 compile
    else
-	return 1
+	return 0
    fi
 }

@@ -77,11 +75,15 @@ start () {
 	retval=$?

 	if [ $retval -eq 0 ]; then
-	    ${STATEDIR}/firewall ${OPTIONS} stop 2>&1 | $logger
-	    retval=${PIPESTATUS[0]}
-	    [ $retval -ne 0 ] && break
+	    if [ -x "${STATEDIR}/firewall" ]; then
+		${STATEDIR}/firewall ${OPTIONS} stop 2>&1 | $logger
+		retval=${PIPESTATUS[0]}
+		[ $retval -ne 0 ] && break
+	    else
+		retval=6 #Product not configured
+		break
+	    fi
 	else
-	    retval=6 #Product not configured
 	    break
 	fi
    done
@@ -108,11 +110,15 @@ stop () {
 	retval=$?

 	if [ $retval -eq 0 ]; then
-	    ${STATEDIR}/firewall ${OPTIONS} clear 2>&1 | $logger
-	    retval=${PIPESTATUS[0]}
-	    [ $retval -ne 0 ] && break
+	    if [ -x "${STATEDIR}/firewall" ]; then
+		${STATEDIR}/firewall ${OPTIONS} clear 2>&1 | $logger
+		retval=${PIPESTATUS[0]}
+		[ $retval -ne 0 ] && break
+	    else
+		retval=6 #Product not configured
+		break
+	    fi
 	else
-	    retval=6 #Product not configured
 	    break
 	fi
    done
--- a/Shorewall-init/init.openwrt.sh
+++ b/Shorewall-init/init.openwrt.sh
@@ -75,14 +75,12 @@ setstatedir() {

    [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT}

-    if [ -x ${STATEDIR}/firewall ]; then
-	return 0
-    elif [ $PRODUCT = shorewall ]; then
+    if [ $PRODUCT = shorewall ]; then
 	${SBINDIR}/shorewall compile
    elif [ $PRODUCT = shorewall6 ]; then
 	${SBINDIR}/shorewall -6 compile
    else
-	return 1
+	return 0
    fi
 }

@@ -94,8 +92,10 @@ start () {
  printf "Initializing \"Shorewall-based firewalls\": "
  for PRODUCT in $PRODUCTS; do
      if setstatedir; then
-	  if ! ${SBIN}/$PRODUCT status > /dev/null 2>&1; then
-	      ${STATEDIR}/firewall ${OPTIONS} stop
+	  if [ -x ${STATEDIR}/firewall ]; then
+	      if ! ${SBIN}/$PRODUCT status > /dev/null 2>&1; then
+		  ${STATEDIR}/firewall ${OPTIONS} stop
+	      fi
 	  fi
      fi
  done
@@ -103,8 +103,6 @@ start () {
  if [ -n "$SAVE_IPSETS" -a -f "$SAVE_IPSETS" ]; then
      ipset -R < "$SAVE_IPSETS"
  fi
-
-  return 0
 }

 boot () {
@@ -119,7 +117,9 @@ stop () {
    printf "Clearing \"Shorewall-based firewalls\": "
    for PRODUCT in $PRODUCTS; do
 	if setstatedir; then
-	    ${STATEDIR}/firewall ${OPTIONS} clear
+	    if [ -x ${STATEDIR}/firewall ]; then
+		${STATEDIR}/firewall ${OPTIONS} clear
+	    fi
 	fi
    done

@@ -131,7 +131,5 @@ stop () {
 	    rm -f "${SAVE_IPSETS}.tmp"
 	fi
    fi
-
-    return 0
 }

--- a/Shorewall-init/init.sh
+++ b/Shorewall-init/init.sh
@@ -69,12 +69,10 @@ setstatedir() {

    [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT}

-    if [ -x ${STATEDIR}/firewall ]; then
-	return 0
-    elif [ $PRODUCT = shorewall -o $PRODUCT = shorewall6 ]; then
+    if [ $PRODUCT = shorewall -o $PRODUCT = shorewall6 ]; then
 	${SBINDIR}/$PRODUCT ${OPTIONS} compile $STATEDIR/firewall
    else
-	return 1
+	return 0
    fi
 }

@@ -86,8 +84,10 @@ shorewall_start () {
  printf "Initializing \"Shorewall-based firewalls\": "
  for PRODUCT in $PRODUCTS; do
      if setstatedir; then
-	  if ! ${SBIN}/$PRODUCT status > /dev/null 2>&1; then
-	      ${STATEDIR}/firewall ${OPTIONS} stop
+	  if [ -x ${STATEDIR}/firewall ]; then
+	      if ! ${SBIN}/$PRODUCT status > /dev/null 2>&1; then
+		  ${STATEDIR}/firewall ${OPTIONS} stop
+	      fi
 	  fi
      fi
  done
@@ -107,7 +107,9 @@ shorewall_stop () {
  printf "Clearing \"Shorewall-based firewalls\": "
  for PRODUCT in $PRODUCTS; do
      if setstatedir; then
-	  ${STATEDIR}/firewall ${OPTIONS} clear
+	  if [ -x ${STATEDIR}/firewall ]; then
+	      ${STATEDIR}/firewall ${OPTIONS} clear
+	  fi
      fi
  done

--- a/Shorewall-init/init.suse.sh
+++ b/Shorewall-init/init.suse.sh
@@ -79,14 +79,12 @@ setstatedir() {

    [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT}

-    if [ -x ${STATEDIR}/firewall ]; then
-	return 0
-    elif [ $PRODUCT = shorewall ]; then
+    if [ $PRODUCT = shorewall ]; then
 	${SBINDIR}/shorewall compile
    elif [ $PRODUCT = shorewall6 ]; then
 	${SBINDIR}/shorewall -6 compile
    else
-	return 6
+	return 0
    fi
 }

@@ -98,8 +96,10 @@ shorewall_start () {
  printf "Initializing \"Shorewall-based firewalls\": "
  for PRODUCT in $PRODUCTS; do
      if setstatedir; then
-	  if ! ${SBIN}/$PRODUCT status > /dev/null 2>&1; then
-	      $STATEDIR/$PRODUCT/firewall ${OPTIONS} stop
+	  if [ -x $STATEDIR/firewall ]; then
+	      if ! ${SBIN}/$PRODUCT status > /dev/null 2>&1; then
+		  $STATEDIR/$PRODUCT/firewall ${OPTIONS} stop
+	      fi
 	  fi
      fi
  done
@@ -117,7 +117,9 @@ shorewall_stop () {
  printf "Clearing \"Shorewall-based firewalls\": "
  for PRODUCT in $PRODUCTS; do
      if setstatedir; then
-	  ${STATEDIR}/firewall ${OPTIONS} clear
+	  if [ -x ${STATEDIR}/firewall ]; then
+	      ${STATEDIR}/firewall ${OPTIONS} clear
+	  fi
      fi
  done

--- a/Shorewall-init/shorewall-init
+++ b/Shorewall-init/shorewall-init
@@ -33,12 +33,12 @@ setstatedir() {

    [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT}

-    if [ -x ${STATEDIR}/firewall ]; then
-        return 0
-    elif [ $PRODUCT = shorewall ]; then
+    if [ $PRODUCT = shorewall ]; then
 	${SBINDIR}/shorewall compile
    elif [ $PRODUCT = shorewall6 ]; then
 	${SBINDIR}/shorewall -6 compile
+    else
+	return 0
    fi
 }

@@ -67,14 +67,16 @@ shorewall_start () {
    printf "Initializing \"Shorewall-based firewalls\": "
    for PRODUCT in $PRODUCTS; do
 	if setstatedir; then
-	    #
-	    # Run in a sub-shell to avoid name collisions
-	    #
-	    (
-		if ! ${STATEDIR}/firewall status > /dev/null 2>&1; then
-		    ${STATEDIR}/firewall ${OPTIONS} stop
-		fi
-	    )
+	    if [ -x ${STATEDIR}/firewall ]; then
+		#
+		# Run in a sub-shell to avoid name collisions
+		#
+		(
+		    if ! ${STATEDIR}/firewall status > /dev/null 2>&1; then
+			${STATEDIR}/firewall ${OPTIONS} stop
+		    fi
+		)
+	    fi
 	fi
    done

@@ -93,7 +95,9 @@ shorewall_stop () {
    printf "Clearing \"Shorewall-based firewalls\": "
    for PRODUCT in $PRODUCTS; do
 	if setstatedir; then
-	    ${STATEDIR}/firewall ${OPTIONS} clear
+	    if [ -x ${STATEDIR}/firewall ]; then
+		${STATEDIR}/firewall ${OPTIONS} clear
+	    fi
 	fi
    done

--- a/Shorewall/Actions/action.A_REJECT
+++ b/Shorewall/Actions/action.A_REJECT
@@ -1,11 +1,11 @@
 #
-# Shorewall -- /usr/share/shorewall/action.A_REJECT
+# Shorewall -- /usr/share/shorewall/action.A_REJECTWITH
 #
 # A_REJECT Action.
 #
 # This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-# (c) 2012-2017 Tom Eastep (teastep@shorewall.net)
+# (c) 2012-2016 Tom Eastep (teastep@shorewall.net)
 #
 # Complete documentation is available at http://shorewall.net
 #
--- a/Shorewall/Actions/action.A_REJECT!
+++ b/Shorewall/Actions/action.A_REJECT!
@@ -5,7 +5,7 @@
 #
 # This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-# (c) 2012-2017 Tom Eastep (teastep@shorewall.net)
+# (c) 2012-2016 Tom Eastep (teastep@shorewall.net)
 #
 # Complete documentation is available at http://shorewall.net
 #
--- a/Shorewall/Actions/action.AllowICMPs
+++ b/Shorewall/Actions/action.AllowICMPs
@@ -13,6 +13,7 @@ DEFAULTS ACCEPT
    @1	-	-	icmp	time-exceeded		{comment="Needed ICMP types"}
 ?else
 ?COMMENT Needed ICMP types (RFC4890)
+
    @1	-		-	ipv6-icmp	destination-unreachable
    @1	-		-	ipv6-icmp	packet-too-big
    @1	-		-	ipv6-icmp	time-exceeded
@@ -37,7 +38,7 @@ DEFAULTS ACCEPT
    @1	-		-	ipv6-icmp	148	# Certificate path solicitation
    @1	-		-	ipv6-icmp	149	# Certificate path advertisement

-# The following should have a link local source address and a ttl of 1 and must be allowed to transit a bridge
+# The following should have a link local source address and a ttl of 1 and must be allowed to transit abridge
    @1	fe80::/10	-	ipv6-icmp	151	# Multicast router advertisement
    @1	fe80::/10	-	ipv6-icmp	152	# Multicast router solicitation
    @1	fe80::/10	-	ipv6-icmp	153	# Multicast router termination
--- a/Shorewall/Actions/action.Broadcast
+++ b/Shorewall/Actions/action.Broadcast
@@ -3,7 +3,7 @@
 #
 # This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-# (c) 2011-2017 Tom Eastep (teastep@shorewall.net)
+# (c) 2011-2016 Tom Eastep (teastep@shorewall.net)
 #
 # Complete documentation is available at http://shorewall.net
 #
--- a/Shorewall/Actions/action.DNSAmp
+++ b/Shorewall/Actions/action.DNSAmp
@@ -5,7 +5,7 @@
 #
 # This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-# (c) 2011-2017 Tom Eastep (teastep@shorewall.net)
+# (c) 2011-2016 Tom Eastep (teastep@shorewall.net)
 #
 # Complete documentation is available at http://shorewall.net
 #
--- a/Shorewall/Actions/action.Established
+++ b/Shorewall/Actions/action.Established
@@ -5,7 +5,7 @@
 #
 # This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-# (c) 2011-2017 Tom Eastep (teastep@shorewall.net)
+# (c) 2011-2016 Tom Eastep (teastep@shorewall.net)
 #
 # Complete documentation is available at http://shorewall.net
 #
--- a/Shorewall/Actions/action.FIN
+++ b/Shorewall/Actions/action.FIN
@@ -5,7 +5,7 @@
 #
 # This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-# (c) 2017 Tom Eastep (teastep@shorewall.net)
+# (c) 2012-2016 Tom Eastep (teastep@shorewall.net)
 #
 # Complete documentation is available at http://shorewall.net
 #
@@ -30,4 +30,4 @@

 DEFAULTS ACCEPT,-

-@1	 -	-	;;+ -p 6 --tcp-flags ACK,FIN ACK,FIN
+@1	 -	-	;;+ -p 6 --tcp-flags ACK,FIN,PSH ACK,FIN,PSH
--- a/Shorewall/Actions/action.Invalid
+++ b/Shorewall/Actions/action.Invalid
@@ -4,7 +4,7 @@
 # Invalid Action
 # This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-# (c) 2011-2017 Tom Eastep (teastep@shorewall.net)
+# (c) 2011-2016 Tom Eastep (teastep@shorewall.net)
 #
 # Complete documentation is available at http://shorewall.net
 #
--- a/Shorewall/Actions/action.Multicast
+++ b/Shorewall/Actions/action.Multicast
@@ -3,7 +3,7 @@
 #
 # This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-# (c) 2011-2017 Tom Eastep (teastep@shorewall.net)
+# (c) 2011-2016 Tom Eastep (teastep@shorewall.net)
 #
 # Complete documentation is available at http://shorewall.net
 #
--- a/Shorewall/Actions/action.New
+++ b/Shorewall/Actions/action.New
@@ -5,7 +5,7 @@
 #
 # This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-# (c) 2011-2017 Tom Eastep (teastep@shorewall.net)
+# (c) 2011-2016 Tom Eastep (teastep@shorewall.net)
 #
 # Complete documentation is available at http://shorewall.net
 #
--- a/Shorewall/Actions/action.NotSyn
+++ b/Shorewall/Actions/action.NotSyn
@@ -5,7 +5,7 @@
 #
 # This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-# (c) 2011-2017 Tom Eastep (teastep@shorewall.net)
+# (c) 2011-2016 Tom Eastep (teastep@shorewall.net)
 #
 # Complete documentation is available at http://shorewall.net
 #
--- a/Shorewall/Actions/action.RST
+++ b/Shorewall/Actions/action.RST
@@ -5,7 +5,7 @@
 #
 # This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-# (c) 2012-2017 Tom Eastep (teastep@shorewall.net)
+# (c) 2012-2016 Tom Eastep (teastep@shorewall.net)
 #
 # Complete documentation is available at http://shorewall.net
 #
--- a/Shorewall/Actions/action.Related
+++ b/Shorewall/Actions/action.Related
@@ -5,7 +5,7 @@
 #
 # This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-# (c) 2011-2017 Tom Eastep (teastep@shorewall.net)
+# (c) 2011-2016 Tom Eastep (teastep@shorewall.net)
 #
 # Complete documentation is available at http://shorewall.net
 #
--- a/Shorewall/Actions/action.Untracked
+++ b/Shorewall/Actions/action.Untracked
@@ -5,7 +5,7 @@
 #
 # This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-# (c) 2011-2017 Tom Eastep (teastep@shorewall.net)
+# (c) 2011-2016 Tom Eastep (teastep@shorewall.net)
 #
 # Complete documentation is available at http://shorewall.net
 #
--- a/Shorewall/Actions/action.allowInvalid
+++ b/Shorewall/Actions/action.allowInvalid
@@ -3,7 +3,7 @@
 #
 # This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-# (c) 2011-2017 Tom Eastep (teastep@shorewall.net)
+# (c) 2011-2016 Tom Eastep (teastep@shorewall.net)
 #
 # Complete documentation is available at http://shorewall.net
 #
--- a/Shorewall/Actions/action.dropInvalid
+++ b/Shorewall/Actions/action.dropInvalid
@@ -5,7 +5,7 @@
 #
 # This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-# (c) 2011-2017 Tom Eastep (teastep@shorewall.net)
+# (c) 2011-2016 Tom Eastep (teastep@shorewall.net)
 #
 # Complete documentation is available at http://shorewall.net
 #
--- a/Shorewall/Perl/Shorewall/Accounting.pm
+++ b/Shorewall/Perl/Shorewall/Accounting.pm
@@ -1,9 +1,9 @@
 #
-# Shorewall 5.1 -- /usr/share/shorewall/Shorewall/Accounting.pm
+# Shorewall 5.0 -- /usr/share/shorewall/Shorewall/Accounting.pm
 #
 #     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-#     (c) 2007-2017 - Tom Eastep (teastep@shorewall.net)
+#     (c) 2007-2016 - Tom Eastep (teastep@shorewall.net)
 #
 #       Complete documentation is available at http://shorewall.net
 #
--- a/Shorewall/Perl/Shorewall/Chains.pm
+++ b/Shorewall/Perl/Shorewall/Chains.pm
@@ -1,9 +1,9 @@
 #
-# Shorewall 5.1 -- /usr/share/shorewall/Shorewall/Chains.pm
+# Shorewall 5.0 -- /usr/share/shorewall/Shorewall/Chains.pm
 #
 #     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-#     (c) 2007-2018 - Tom Eastep (teastep@shorewall.net)
+#     (c) 2007-2016 - Tom Eastep (teastep@shorewall.net)
 #
 #       Complete documentation is available at http://shorewall.net
 #
@@ -4782,7 +4782,6 @@ sub do_proto( $$$;$ )
    if ( $proto ne '' ) {

 	my $synonly  = ( $proto =~ s/:(!)?syn$//i );
-	my $all      = ( $proto =~ s/:all$//i );
 	my $notsyn   = $1;
 	my $invert   = ( $proto =~ s/^!// ? '! ' : '' );
 	my $protonum = resolve_proto $proto;
@@ -4798,7 +4797,6 @@ sub do_proto( $$$;$ )
 	    # $proto now contains the protocol number and $pname contains the canonical name of the protocol
 	    #
 	    unless ( $synonly ) {
-		fatal_error '":all" is only allowed with tcp' if $all && $proto != TCP;
 		$output  = "${invert}-p ${proto} ";
 	    } else {
 		fatal_error '":syn" is only allowed with tcp' unless $proto == TCP && ! $invert;
@@ -4938,8 +4936,6 @@ sub do_proto( $$$;$ )
 	} else {
 	    fatal_error '":syn" is only allowed with tcp' if $synonly;

-	    $proto = $proto . ':all' if $all;
-
 	    if ( $proto =~ /^(ipp2p(:(tcp|udp|all))?)$/i ) {
 		my $p = $2 ? lc $3 : 'tcp';
 		require_capability( 'IPP2P_MATCH' , "PROTO = $proto" , 's' );
@@ -4996,7 +4992,6 @@ sub do_iproto( $$$ )
    if ( $proto ne '' ) {

 	my $synonly  = ( $proto =~ s/:syn$//i );
-	my $all      = ( $proto =~ s/:all$//i );
 	my $invert   = ( $proto =~ s/^!// ? '! ' : '' );
 	my $protonum = resolve_proto $proto;

@@ -5011,7 +5006,6 @@ sub do_iproto( $$$ )
 	    # $proto now contains the protocol number and $pname contains the canonical name of the protocol
 	    #
 	    unless ( $synonly ) {
-		fatal_error '":all" is only allowed with tcp' if $all && $proto != TCP;
 		@output = ( p => "${invert}${proto}" );
 	    } else {
 		fatal_error '":syn" is only allowed with tcp' unless $proto == TCP && ! $invert;
@@ -5146,8 +5140,6 @@ sub do_iproto( $$$ )
 	} else {
 	    fatal_error '":syn" is only allowed with tcp' if $synonly;

-	    $proto = $proto . ':all' if $all;
-
 	    if ( $proto =~ /^(ipp2p(:(tcp|udp|all))?)$/i ) {
 		my $p = $2 ? lc $3 : 'tcp';
 		require_capability( 'IPP2P_MATCH' , "PROTO = $proto" , 's' );
--- a/Shorewall/Perl/Shorewall/Compiler.pm
+++ b/Shorewall/Perl/Shorewall/Compiler.pm
@@ -4,7 +4,7 @@
 #
 #     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-#     (c) 2007-2017 - Tom Eastep (teastep@shorewall.net)
+#     (c) 2007-2016 - Tom Eastep (teastep@shorewall.net)
 #
 #	Complete documentation is available at http://shorewall.net
 #
@@ -59,7 +59,7 @@ our $have_arptables;
 # Initilize the package-globals in the other modules
 #
 sub initialize_package_globals( $$$ ) {
-    Shorewall::Config::initialize($family, $export, $_[1], $_[2]);
+    Shorewall::Config::initialize($family, $_[1], $_[2]);
    Shorewall::Chains::initialize ($family, 1, $export );
    Shorewall::Zones::initialize ($family, $_[0]);
    Shorewall::Nat::initialize($family);
--- a/Shorewall/Perl/Shorewall/Config.pm
+++ b/Shorewall/Perl/Shorewall/Config.pm
@@ -1,9 +1,9 @@
 #
-# Shorewall 5.1 -- /usr/share/shorewall/Shorewall/Config.pm
+# Shorewall 5.0 -- /usr/share/shorewall/Shorewall/Config.pm
 #
 #     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-#     (c) 2007-2018 - Tom Eastep (teastep@shorewall.net)
+#     (c) 2007-2016 - Tom Eastep (teastep@shorewall.net)
 #
 #       Complete documentation is available at http://shorewall.net
 #
@@ -675,7 +675,6 @@ our $debug;                  # Global debugging flag
 our $confess;                # If true, use Carp to report errors with stack trace.

 our $family;                 # Protocol family (4 or 6)
-our $export;                 # True when compiling for export
 our $toolname;               # Name of the tool to use (iptables or iptables6)
 our $toolNAME;               # Tool name in CAPS
 our $product;                # Name of product that will run the generated script
@@ -789,8 +788,8 @@ sub add_variables( \% );
 #   2. The compiler can run multiple times in the same process so it has to be
 #      able to re-initialize its dependent modules' state.
 #
-sub initialize( $;$$$) {
-    ( $family, $export, my ( $shorewallrc, $shorewallrc1 ) ) = @_;
+sub initialize( $;$$) {
+    ( $family, my ( $shorewallrc, $shorewallrc1 ) ) = @_;

    if ( $family == F_IPV4 ) {
 	( $product, $Product, $toolname, $toolNAME ) = qw( shorewall  Shorewall iptables  IPTABLES );
@@ -5329,13 +5328,7 @@ sub ensure_config_path() {
 	fatal_error "CONFIG_PATH not found in $f" unless $config{CONFIG_PATH};
    }

-    my $path = $config{CONFIG_PATH};
-
-    my $chop = ( $path =~ s/^:// );
-
-    @config_path = split /:/, $path;
-
-    shift @config_path if $chop && ( $export || $> != 0 );
+    @config_path = split /:/, $config{CONFIG_PATH};

    #
    # To accomodate Cygwin-based compilation, we have separate directories for files whose names
@@ -6491,7 +6484,7 @@ sub get_configuration( $$$$ ) {
    default_yes_no 'USE_DEFAULT_RT'             , '';
    default_yes_no 'RESTORE_DEFAULT_ROUTE'      , 'Yes';
    default_yes_no 'AUTOMAKE'                   , '';
-    default_yes_no 'TRACK_PROVIDERS'            , 'Yes';
+    default_yes_no 'TRACK_PROVIDERS'            , '';
    default_yes_no 'BALANCE_PROVIDERS'          , $config{USE_DEFAULT_RT} ? 'Yes' : '';
    default_yes_no 'USE_NFLOG_SIZE'             , '';

--- a/Shorewall/Perl/Shorewall/IPAddrs.pm
+++ b/Shorewall/Perl/Shorewall/IPAddrs.pm
@@ -1,9 +1,9 @@
 #
-# Shorewall 5.1 -- /usr/share/shorewall/Shorewall/IPAddrs.pm
+# Shorewall 5.0 -- /usr/share/shorewall/Shorewall/IPAddrs.pm
 #
 #     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-#     (c) 2007-2017 - Tom Eastep (teastep@shorewall.net)
+#     (c) 2007-2015 - Tom Eastep (teastep@shorewall.net)
 #
 #       Complete documentation is available at http://shorewall.net
 #
--- a/Shorewall/Perl/Shorewall/Misc.pm
+++ b/Shorewall/Perl/Shorewall/Misc.pm
@@ -1,9 +1,9 @@
 #
-# Shorewall 5.1 -- /usr/share/shorewall/Shorewall/Misc.pm
+# Shorewall 5.0 -- /usr/share/shorewall/Shorewall/Misc.pm
 #
 #     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-#     (c) 2007-2017 - Tom Eastep (teastep@shorewall.net)
+#     (c) 2007-2016 - Tom Eastep (teastep@shorewall.net)
 #
 #       Complete documentation is available at http://shorewall.net
 #
--- a/Shorewall/Perl/Shorewall/Nat.pm
+++ b/Shorewall/Perl/Shorewall/Nat.pm
@@ -1,9 +1,9 @@
 #
-# Shorewall 5.1 -- /usr/share/shorewall/Shorewall/Nat.pm
+# Shorewall 5.0 -- /usr/share/shorewall/Shorewall/Nat.pm
 #
 #     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-#     (c) 2007-2017 - Tom Eastep (teastep@shorewall.net)
+#     (c) 2007-2016 - Tom Eastep (teastep@shorewall.net)
 #
 #       Complete documentation is available at http://shorewall.net
 #
--- a/Shorewall/Perl/Shorewall/Providers.pm
+++ b/Shorewall/Perl/Shorewall/Providers.pm
@@ -1,9 +1,9 @@
 #
-# Shorewall 5.1 -- /usr/share/shorewall/Shorewall/Providers.pm
+# Shorewall 5.0 -- /usr/share/shorewall/Shorewall/Providers.pm
 #
 #     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-#     (c) 2007-2017 - Tom Eastep (teastep@shorewall.net)
+#     (c) 2007-2016 - Tom Eastep (teastep@shorewall.net)
 #
 #       Complete documentation is available at http://shorewall.net
 #
@@ -161,15 +161,6 @@ sub setup_route_marking() {
 		add_ijump_extended $mangle_table->{PREROUTING} , j => $chainref,  $origin, i => $physical,     mark => "--mark 0/$mask";
 		add_ijump_extended $mangle_table->{PREROUTING} , j => $chainref1, $origin, i => "! $physical", mark => "--mark  $mark/$mask";
 		add_ijump_extended $mangle_table->{OUTPUT}     , j => $chainref2, $origin,                     mark => "--mark  $mark/$mask";
-
-		if ( have_ipsec ) {
-		    if ( have_capability( 'MARK_ANYWHERE' ) ) {
-			add_ijump_extended $filter_table->{forward_chain($interface)}, j => 'CONNMARK', $origin, targetopts => "--set-mark 0${exmask}",               , state_imatch('NEW'), policy => '--dir in --pol ipsec';
-		    } elsif ( have_capability( 'MANGLE_FORWARD' ) ) {
-			add_ijump_extended $mangle_table->{FORWARD},                   j => 'CONNMARK', $origin, targetopts => "--set-mark 0${exmask}", i => $physical, state_imatch('NEW'), policy => '--dir in --pol ipsec';
-		    }
-		}
-
 		$marked_interfaces{$interface} = 1;
 	    }

@@ -1584,7 +1575,7 @@ sub finish_providers() {
 	    emit  ( "    run_ip route replace default scope global table $table \$DEFAULT_ROUTE" );
 	} else {
 	    emit  ( "    if echo \$DEFAULT_ROUTE | grep -q 'nexthop.+nexthop'; then",
-		    "        while qt \$IP -6 route delete default table $table; do true; done",
+		    "        qt \$IP -6 route delete default scope global table $table \$DEFAULT_ROUTE",
 		    "        run_ip route add default scope global table $table \$DEFAULT_ROUTE",
 		    '    else',
 		    "        run_ip route replace default scope global table $table \$DEFAULT_ROUTE",
@@ -1647,7 +1638,7 @@ sub finish_providers() {
 	if ( $family == F_IPV4 ) {
 	    emit( "    run_ip route replace default scope global table $default \$FALLBACK_ROUTE" );
 	} else {
-	    emit( "    while qt \$IP -6 route delete default table $default; do true; done" );
+	    emit( "    run_ip route delete default scope global table $default \$FALLBACK_ROUTE" );
 	    emit( "    run_ip route add default scope global table $default \$FALLBACK_ROUTE" );
 	}

--- a/Shorewall/Perl/Shorewall/Proxyarp.pm
+++ b/Shorewall/Perl/Shorewall/Proxyarp.pm
@@ -1,9 +1,9 @@
 #
-# Shorewall 5.1 -- /usr/share/shorewall/Shorewall/Proxyarp.pm
+# Shorewall 5.0 -- /usr/share/shorewall/Shorewall/Proxyarp.pm
 #
 #     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-#     (c) 2007-2017 - Tom Eastep (teastep@shorewall.net)
+#     (c) 2007-2016 - Tom Eastep (teastep@shorewall.net)
 #
 #       Complete documentation is available at http://shorewall.net
 #
--- a/Shorewall/Perl/Shorewall/Raw.pm
+++ b/Shorewall/Perl/Shorewall/Raw.pm
@@ -1,9 +1,9 @@
 #
-# Shorewall 5.1 -- /usr/share/shorewall/Shorewall/Raw.pm
+# Shorewall 5.0 -- /usr/share/shorewall/Shorewall/Raw.pm
 #
 #     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-#     (c) 2009-2018 - Tom Eastep (teastep@shorewall.net)
+#     (c) 2009-2016 - Tom Eastep (teastep@shorewall.net)
 #
 #       Complete documentation is available at http://shorewall.net
 #
@@ -91,7 +91,7 @@ sub process_conntrack_rule( $$$$$$$$$$ ) {

    my $disposition = $action;
    my $exception_rule = '';
-
+    my $rule = do_proto( $proto, $ports, $sports ) . do_user ( $user ) . do_condition( $switch , $chainref->{name} );
    my $level = '';

    if ( $action =~ /^(?:NFLOG|ULOG)/ ) {
@@ -138,14 +138,6 @@ sub process_conntrack_rule( $$$$$$$$$$ ) {

 	require_capability 'CT_TARGET', 'CT entries in the conntrack file', '';

-	if ( $proto ne '-' ) {
-	    if ( $proto =~ s/:all$// ) {
-		fatal_error '":all" may only be used with TCP' unless resolve_proto( $proto ) == TCP;
-	    } else {
-		$proto = TCP . ':syn' if $proto !~ /:syn/ && resolve_proto( $proto ) == TCP;
-	    }
-	}
-
 	if ( $option eq 'notrack' ) {
 	    fatal_error "Invalid conntrack ACTION ( $action )" if supplied $args;
 	    $action = 'CT --notrack';
@@ -207,9 +199,7 @@ sub process_conntrack_rule( $$$$$$$$$$ ) {
    expand_rule( $chainref ,
 		 $restriction ,
 		 '',
-		 do_proto( $proto, $ports, $sports ) . 
-		 do_user ( $user ) . 
-		 do_condition( $switch , $chainref->{name} ),
+		 $rule,
 		 $source ,
 		 $dest ,
 		 '' ,
--- a/Shorewall/Perl/Shorewall/Rules.pm
+++ b/Shorewall/Perl/Shorewall/Rules.pm
@@ -1,9 +1,9 @@
 #
-# Shorewall 5.1 -- /usr/share/shorewall/Shorewall/Rules.pm
+# Shorewall 5.0 -- /usr/share/shorewall/Shorewall/Rules.pm
 #
 #     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-#     (c) 2007-2017 - Tom Eastep (teastep@shorewall.net)
+#     (c) 2007-2016 - Tom Eastep (teastep@shorewall.net)
 #
 #       Complete documentation is available at http://shorewall.net
 #
@@ -96,7 +96,7 @@ use constant { NULL_SECTION          => 0x00,
 	       INVALID_SECTION       => 0x10,
 	       UNTRACKED_SECTION     => 0x20,
 	       NEW_SECTION           => 0x40,
-	       POLICYACTION_SECTION  => 0x80 };
+	       DEFAULTACTION_SECTION => 0x80 };
 #
 # Number of elements in the action tuple
 #
@@ -927,28 +927,6 @@ sub process_policies()
 #
 sub process_inline ($$$$$$$$$$$$$$$$$$$$$$);

-#
-# Determine the protocol to be used in the jump to the passed action
-#
-sub determine_action_protocol( $$ ) {
-    my ( $action, $proto ) = @_;
-
-    if ( my $actionproto = $actions{$action}{proto} ) {
-	if ( $proto eq '-' ) {
-	    $proto = $actionproto;
-	} else {
-	    if ( defined( my $protonum = resolve_proto( $proto ) ) ) {
-		fatal_error( "The $action action is only usable with " . proto_name( $actionproto ) ) unless $actionproto == $protonum;
-		$proto = $protonum;
-	    } else {
-		fatal_error( "Unknown protocol ($proto)" );
-	    }
-	}
-    }
-
-    $proto;
-}
-
 sub add_policy_rules( $$$$$ ) {
    my ( $chainref , $target, $loglevel, $pactions, $dropmulticast ) = @_;

@@ -964,16 +942,12 @@ sub add_policy_rules( $$$$$ ) {

 	    if ( ( $targets{$action} || 0 ) & ACTION ) {
 		#
-		# Policy action is a regular action -- jump to the action chain
+		# Default action is a regular action -- jump to the action chain
 		#
-		if ( ( my $proto = determine_action_protocol( $action, '-' ) ) ne '-' ) {
-		    add_ijump( $chainref, j => use_policy_action( $paction, $chainref->{name} ), p => $proto );
-		} else {
-		    add_ijump $chainref, j => use_policy_action( $paction, $chainref->{name} );
-		}
+		add_ijump $chainref, j => use_policy_action( $paction, $chainref->{name} );
 	    } else {
 		#
-		# Policy action is an inline 
+		# Default action is an inline 
 		#
 		( undef, my $level )   = split /:/, $paction, 2;
 		( $action, my $param ) = get_target_param( $action );
@@ -1159,7 +1133,7 @@ sub setup_syn_flood_chains() {
 	    add_rule $synchainref , "${limit}-j RETURN";
 	    log_irule_limit( $level ,
 			     $synchainref ,
-			     $synchainref->{name} ,
+			     $chainref->{name} ,
 			     'DROP',
 			     @{$globals{LOGILIMIT}} ? $globals{LOGILIMIT} : [ limit => "--limit 5/min --limit-burst 5" ] ,
 			    '' ,
@@ -1288,7 +1262,7 @@ sub finish_chain_section ($$$) {
 	if ( $chain1ref->{is_policy} ) {
 	    if ( $chain1ref->{synparams} ) {
 		my $synchainref = ensure_chain 'filter', syn_flood_chain $chain1ref;
-		if ( $section == POLICYACTION_SECTION ) {
+		if ( $section == DEFAULTACTION_SECTION ) {
 		    if ( $chain1ref->{policy} =~ /^(ACCEPT|CONTINUE|QUEUE|NFQUEUE)/ ) {
 			add_ijump $chain1ref, j => $synchainref, p => 'tcp --syn';
 		    }
@@ -1324,7 +1298,7 @@ sub ensure_rules_chain( $ )
    $chainref = new_rules_chain( $chain ) unless $chainref;

    unless ( $chainref->{referenced} ) {
-	if ( $section & ( NEW_SECTION | POLICYACTION_SECTION ) ) {
+	if ( $section & ( NEW_SECTION | DEFAULTACTION_SECTION ) ) {
 	    finish_chain_section $chainref , $chainref, 'ESTABLISHED,RELATED,INVALID,UNTRACKED';
 	} elsif ( $section == UNTRACKED_SECTION ) {
 	    finish_chain_section $chainref , $chainref, 'ESTABLISHED,RELATED,INVALID';
@@ -1443,13 +1417,13 @@ sub external_name( $ ) {
 #
 # Define an Action
 #
-sub new_action( $$$$$$ ) {
+sub new_action( $$$$$ ) {

-    my ( $action , $type, $options , $actionfile , $state, $proto ) = @_;
+    my ( $action , $type, $options , $actionfile , $state ) = @_;

-    fatal_error "Reserved action name ($action)" if reserved_name( $action );
+    fatal_error "Invalid action name($action)" if reserved_name( $action );

-    $actions{$action} = { file => $actionfile, actchain => '' , type => $type, options => $options , state => $state, proto => $proto };
+    $actions{$action} = { file => $actionfile, actchain => '' , type => $type, options => $options , state => $state };

    $targets{$action} = $type;
 }
@@ -1457,7 +1431,11 @@ sub new_action( $$$$$$ ) {
 #
 # Create and record a log action chain -- Log action chains have names
 # that are formed from the action name by prepending a "%" and appending
-# a 1- or 2-digit sequence number.
+# a 1- or 2-digit sequence number. In the functions that follow,
+# the $chain, $level and $tag variables serve as arguments to the user's
+# exit. We call the exit corresponding to the name of the action but we
+# set $chain to the name of the iptables chain where rules are to be added.
+# Similarly, $level and $tag contain the log level and log tag respectively.
 #
 # The maximum length of a chain name is 30 characters -- since the log
 # action chain name is 2-3 characters longer than the base chain name,
@@ -2071,10 +2049,9 @@ sub process_actions() {
 	    my $opts = $type == INLINE ? NOLOG_OPT : 0;

 	    my $state = '';
-	    my $proto = 0;

 	    if ( $action =~ /:/ ) {
-		warning_message 'Policy Actions are now specified in /etc/shorewall/shorewall.conf';
+		warning_message 'Default Actions are now specified in /etc/shorewall/shorewall.conf';
 		$action =~ s/:.*$//;
 	    }

@@ -2088,9 +2065,6 @@ sub process_actions() {
 			} else {
 			    fatal_error( q(The 'state' option is reserved for use in the actions.std file) );
 			}
-		    } elsif ( /^proto=(.+)$/ ) {
-			fatal_error "Unknown Protocol ($1)" unless defined( $proto = resolve_proto( $1 ) );
-			fatal_error "A protocol may not be specified on the REJECT_ACTION ($action)" if $action eq $config{REJECT_ACTION};
 		    } else {
 			fatal_error "Invalid option ($_)" unless $options{$_};
 			$opts |= $options{$_};
@@ -2111,11 +2085,9 @@ sub process_actions() {
 			next;
 		    }

-		    $proto = $actions{$action}{proto} unless $proto;
 		    delete $actions{$action};
 		    delete $targets{$action};
 		} elsif ( ( $actiontype & INLINE ) && ( $type == ACTION ) && $opts & NOINLINE_OPT ) {
-		    $proto = $actions{$action}{proto} unless $proto;
 		    delete $actions{$action};
 		    delete $targets{$action};
 		} else {
@@ -2125,8 +2097,6 @@ sub process_actions() {
 	    }

 	    if ( $opts & BUILTIN_OPT ) {
-		warning_message( "The 'proto' option has no effect when specified on a builtin action" ) if $proto;
-
 		my $actiontype = USERBUILTIN | OPTIONS;
 		$actiontype   |= MANGLE_TABLE if $opts & MANGLE_OPT;
 		$actiontype   |= RAW_TABLE    if $opts & RAW_OPT;
@@ -2159,7 +2129,7 @@ sub process_actions() {

 		fatal_error "Missing Action File ($actionfile)" unless -f $actionfile;

-		new_action ( $action, $type, $opts, $actionfile , $state , $proto );
+		new_action ( $action, $type, $opts, $actionfile , $state );
 	    }
 	}
    }
@@ -2197,7 +2167,7 @@ sub process_reject_action() {
    #
    # This gets called very early in the compilation process so we fake the section
    #
-    $section = POLICYACTION_SECTION;
+    $section = DEFAULTACTION_SECTION;

    if ( ( $targets{$action} || 0 ) == ACTION ) {
 	add_ijump $rejectref, j => use_policy_action( $action, $rejectref->{name} );
@@ -2531,7 +2501,7 @@ sub verify_audit($;$$) {
 # the target is a macro, the macro is expanded and this function is called recursively for each rule in the expansion.
 # Similarly, if a new action tuple is encountered, this function is called recursively for each rule in the action
 # body. In this latter case, a reference to the tuple's chain is passed in the first ($chainref) argument. A chain
-# reference is also passed when rules are being generated during processing of a macro used as a policy action.
+# reference is also passed when rules are being generated during processing of a macro used as a default action.
 #

 sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
@@ -3042,10 +3012,6 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
    my $actionchain; # Name of the action chain

    if ( $actiontype & ACTION ) {
-	#
-	# Verify action 'proto', if any
-	#
-	$proto = determine_action_protocol( $basictarget, $proto );
 	#
 	# Save NAT-oriented column contents
 	#
@@ -3196,7 +3162,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
 		     );
    }

-    unless ( $section & ( NEW_SECTION | POLICYACTION_SECTION ) ||
+    unless ( $section & ( NEW_SECTION | DEFAULTACTION_SECTION ) ||
 	     $inaction ||
 	     $blacklist ||
 	     $basictarget eq 'dropInvalid' ) {
@@ -3332,7 +3298,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
 		     $log_action ,
 		     $exceptionrule ,
 		     $usergenerated && ! $loglevel )
-	    unless unreachable_warning( $wildcard || $section == POLICYACTION_SECTION, $chainref );
+	    unless unreachable_warning( $wildcard || $section == DEFAULTACTION_SECTION, $chainref );
    }

    $generated = 1;
@@ -3410,7 +3376,7 @@ sub check_state( $ ) {
 	}
    }

-    if ( $section & ( NEW_SECTION | POLICYACTION_SECTION ) ) {
+    if ( $section & ( NEW_SECTION | DEFAULTACTION_SECTION ) ) {
 	if ( $state eq 'NEW' ) {
 	    #
 	    # If an INVALID or UNTRACKED rule would be emitted then we must include the state match
@@ -3951,7 +3917,7 @@ sub process_rules() {
    #
    # No need to finish the NEW section since no rules need to be generated
    #
-    $section = $next_section = POLICYACTION_SECTION;
+    $section = $next_section = DEFAULTACTION_SECTION;
 }

 sub process_mangle_inline( $$$$$$$$$$$$$$$$$$$$ ) {
@@ -4770,10 +4736,6 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$$$ ) {
 	function          => sub() {
 	    fatal_error( qq(Action $cmd may not be used in the mangle file) ) unless $actiontype & MANGLE_TABLE;
 	    #
-	    # Verify action 'proto', if any
-	    #
-	    $proto = determine_action_protocol( $cmd, $proto );
-	    #
 	    # Create the action:level:tag:param tuple.
 	    #
 	    my $normalized_target = normalize_action( $cmd, '', $params );
@@ -5732,10 +5694,6 @@ sub process_snat1( $$$$$$$$$$$$ ) {
 	    if ( $actiontype & ACTION ) {
 		fatal_error( qq(Action $target may not be used in the snat file) ) unless $actiontype & NAT_TABLE;
 		#
-		# Verify action 'proto', if any
-		#
-		$proto = determine_action_protocol( $target, $proto );
-		#
 		# Create the action:level:tag:param tuple. Since we don't allow logging out of nat POSTROUTING, we store
 		# the interface name in the log tag
 		#
--- a/Shorewall/Perl/Shorewall/Tc.pm
+++ b/Shorewall/Perl/Shorewall/Tc.pm
@@ -1,9 +1,9 @@
 #
-# Shorewall 5.1 -- /usr/share/shorewall/Shorewall/Tc.pm
+# Shorewall 5.0 -- /usr/share/shorewall/Shorewall/Tc.pm
 #
 #     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-#     (c) 2007-2017 - Tom Eastep (teastep@shorewall.net)
+#     (c) 2007-2016 - Tom Eastep (teastep@shorewall.net)
 #
 #     Traffic Control is from tc4shorewall Version 0.5
 #     (c) 2005 Arne Bernin <arne@ucbering.de>
@@ -225,11 +225,11 @@ sub handle_in_bandwidth( $$$ ) {
    if ( have_capability 'BASIC_FILTER' ) {
 	if ( $in_rate ) {
 	    emit( "run_tc filter add dev $physical parent ffff: protocol all prio 10 basic \\",
-		  "    police mpu 64 rate ${in_rate}kbit burst $in_burst drop\n" );
+		  "    police mpu 64 drop rate ${in_rate}kbit burst $in_burst\n" );
 	} else {
 	    emit( "run_tc filter add dev $physical parent ffff: protocol all prio 10 \\",
 		  "    estimator $in_interval $in_decay basic \\",
-		  "    police avrate ${in_avrate}kbit drop\n" );
+		  "    police drop avrate ${in_avrate}kbit\n" );
 	}
    } else {
 	emit( "run_tc filter add dev $physical parent ffff: protocol all prio 10 \\" ,
--- a/Shorewall/Perl/Shorewall/Zones.pm
+++ b/Shorewall/Perl/Shorewall/Zones.pm
@@ -1,9 +1,9 @@
 #
-# Shorewall 5.1 -- /usr/share/shorewall/Shorewall/Zones.pm
+# Shorewall 4.4 -- /usr/share/shorewall/Shorewall/Zones.pm
 #
 #     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
 #
-#     (c) 2007,2008,2009,2010,2011-2017 - Tom Eastep (teastep@shorewall.net)
+#     (c) 2007,2008,2009,2010,2011 - Tom Eastep (teastep@shorewall.net)
 #
 #       Complete documentation is available at http://shorewall.net
 #
@@ -90,6 +90,7 @@ our @EXPORT = ( qw( NOTHING
 		    interface_is_optional
 		    interface_is_required
 		    find_interfaces_by_option
+		    find_interfaces_by_option1
 		    get_interface_option
 		    get_interface_origin
 		    interface_has_option
@@ -252,17 +253,6 @@ use constant { NO_UPDOWN   => 1,

 our %validinterfaceoptions;

-our %procinterfaceoptions=( accept_ra   => 1,
-			    arp_filter  => 1,
-			    arp_ignore  => 1,
-			    forward     => 1,
-			    logmartians => 1,
-			    proxyarp    => 1,
-			    proxyndp    => 1,
-			    routefilter => 1,
-			    sourceroute => 1,
-			  );
-
 our %prohibitunmanaged = (
 			  blacklist      => 1,
 			  bridge         => 1,
@@ -327,7 +317,7 @@ sub initialize( $$ ) {
    %mapbase = ();
    %mapbase1 = ();
    $baseseq = 0;
-    $minroot = undef;
+    $minroot = 0;
    $loopback_interface = '';

    %validzoneoptions = ( mss            => NUMERIC,
@@ -349,7 +339,7 @@ sub initialize( $$ ) {
 				  arp_ignore  => ENUM_IF_OPTION,
 				  blacklist   => SIMPLE_IF_OPTION + IF_OPTION_HOST,
 				  bridge      => SIMPLE_IF_OPTION,
-				  dbl         => ENUM_IF_OPTION   + IF_OPTION_WILDOK,
+				  dbl         => ENUM_IF_OPTION,
 				  destonly    => SIMPLE_IF_OPTION + IF_OPTION_HOST,
 				  detectnets  => OBSOLETE_IF_OPTION,
 				  dhcp        => SIMPLE_IF_OPTION,
@@ -373,9 +363,9 @@ sub initialize( $$ ) {
 				  upnp        => SIMPLE_IF_OPTION,
 				  upnpclient  => SIMPLE_IF_OPTION,
 				  mss         => NUMERIC_IF_OPTION + IF_OPTION_WILDOK,
-				  physical    => STRING_IF_OPTION  + IF_OPTION_HOST + IF_OPTION_WILDOK,
+				  physical    => STRING_IF_OPTION  + IF_OPTION_HOST,
 				  unmanaged   => SIMPLE_IF_OPTION,
-				  wait        => NUMERIC_IF_OPTION,
+				  wait        => NUMERIC_IF_OPTION + IF_OPTION_WILDOK,
 				 );
 	%validhostoptions = (
 			     blacklist => 1,
@@ -400,7 +390,7 @@ sub initialize( $$ ) {
 	%validinterfaceoptions = (  accept_ra   => NUMERIC_IF_OPTION,
 				    blacklist   => SIMPLE_IF_OPTION + IF_OPTION_HOST,
 				    bridge      => SIMPLE_IF_OPTION,
-				    dbl         => ENUM_IF_OPTION   + IF_OPTION_WILDOK,
+				    dbl         => ENUM_IF_OPTION,
 				    destonly    => SIMPLE_IF_OPTION + IF_OPTION_HOST,
 				    dhcp        => SIMPLE_IF_OPTION,
 				    ignore      => NUMERIC_IF_OPTION + IF_OPTION_WILDOK,
@@ -412,18 +402,18 @@ sub initialize( $$ ) {
 				    optional    => SIMPLE_IF_OPTION,
 				    proxyndp    => BINARY_IF_OPTION,
 				    required    => SIMPLE_IF_OPTION,
-				    routeback   => BINARY_IF_OPTION + IF_OPTION_ZONEONLY + IF_OPTION_HOST + IF_OPTION_VSERVER + IF_OPTION_WILDOK,
+				    routeback   => BINARY_IF_OPTION + IF_OPTION_ZONEONLY + IF_OPTION_HOST + IF_OPTION_VSERVER,
 				    rpfilter    => SIMPLE_IF_OPTION,
 				    sfilter     => IPLIST_IF_OPTION,
 				    sourceroute => BINARY_IF_OPTION,
 				    tcpflags    => BINARY_IF_OPTION + IF_OPTION_HOST,
 				    mss         => NUMERIC_IF_OPTION + IF_OPTION_WILDOK,
 				    forward     => BINARY_IF_OPTION,
-				    physical    => STRING_IF_OPTION + IF_OPTION_HOST + IF_OPTION_WILDOK,
+				    physical    => STRING_IF_OPTION + IF_OPTION_HOST,
 				    unmanaged   => SIMPLE_IF_OPTION,
 				    upnp        => SIMPLE_IF_OPTION,
 				    upnpclient  => SIMPLE_IF_OPTION,
-				    wait        => NUMERIC_IF_OPTION,
+				    wait        => NUMERIC_IF_OPTION + IF_OPTION_WILDOK,
 				 );
 	%validhostoptions = (
 			     blacklist => 1,
@@ -724,7 +714,7 @@ sub interface_match( $$ ) {
    return 1 if $piface eq $cifaceref->{bridge};
    return 1 if $ciface eq $pifaceref->{bridge};

-    if ( defined $minroot ) {
+    if ( $minroot ) {
 	if ( $piface =~ /\+$/ ) {
 	    my $root    = $pifaceref->{root};
 	    my $rlength = length( $root );
@@ -1214,16 +1204,15 @@ sub process_interface( $$ ) {
    }

    my $wildcard = 0;
-    my $physwild = 0;
    my $root;

    if ( $interface =~ /\+$/ ) {
-	$wildcard = $physwild = 1; # Default physical name is the logical name
+	$wildcard = 1;
 	$root = substr( $interface, 0, -1 );
 	$roots{$root} = $interface;
 	my $len = length $root;

-	if ( defined $minroot ) {
+	if ( $minroot ) {
 	    $minroot = $len if $minroot > $len;
 	} else {
 	    $minroot = $len;
@@ -1269,6 +1258,8 @@ sub process_interface( $$ ) {
 	my %hostoptions = ( dynamic => 0 );

 	for my $option (split_list1 $options, 'option' ) {
+	    next if $option eq '-';
+
 	    ( $option, my $value ) = split /=/, $option;

 	    fatal_error "Invalid Interface option ($option)" unless my $type = $validinterfaceoptions{$option};
@@ -1305,6 +1296,7 @@ sub process_interface( $$ ) {
 	    } elsif ( $type == BINARY_IF_OPTION ) {
 		$value = 1 unless defined $value;
 		fatal_error "Option value for '$option' must be 0 or 1" unless ( $value eq '0' || $value eq '1' );
+		fatal_error "The '$option' option may not be used with a wild-card interface name" if $wildcard && ! $type && IF_OPTION_WILDOK;
 		$options{$option} = $value;
 		$hostoptions{$option} = $value if $hostopt;
 	    } elsif ( $type == ENUM_IF_OPTION ) {
@@ -1328,6 +1320,7 @@ sub process_interface( $$ ) {
 		    assert( 0 );
 		}
 	    } elsif ( $type == NUMERIC_IF_OPTION ) {
+		fatal_error "The '$option' option may not be specified on a wildcard interface" if $wildcard && ! $type && IF_OPTION_WILDOK;
 		$value = $defaultinterfaceoptions{$option} unless defined $value;
 		fatal_error "The '$option' option requires a value" unless defined $value;
 		my $numval = numeric_value $value;
@@ -1379,9 +1372,7 @@ sub process_interface( $$ ) {

 		    fatal_error "Duplicate physical interface name ($value)" if ( $interfaces{$value} && ! $port );

-		    $physwild = ( $value =~ /\+$/ );
-		    fatal_error "The type of 'physical' name ($value) doesn't match the type of interface name ($interface)" if $wildcard && ! $physwild;
-
+		    fatal_error "The type of 'physical' name ($value) doesn't match the type of interface name ($interface)" if $wildcard && ! $value =~ /\+$/;
 		    $physical = $value;
 		} else {
 		    assert(0);
@@ -1409,14 +1400,6 @@ sub process_interface( $$ ) {
 	    $options{ignore} = 0;
 	}

-	for my $option ( keys %options ) {
-	    if ( $root ) {
-		warning_message( "The '$option' option is ignored when used with a wildcard physical name" ) if $physwild && $procinterfaceoptions{$option};
-	    } else {
-		warning_message( "The '$option' option is ignored when used with interface name '+'" ) unless $validinterfaceoptions{$option} & IF_OPTION_WILDOK;
-	    }
-	}
-
 	if ( $netsref eq 'dynamic' ) {
 	    my $ipset = $family == F_IPV4 ? "${zone}" : "6_${zone}";
 	    $ipset = join( '_', $ipset, var_base1( $physical ) ) unless $zoneref->{options}{in_out}{dynamic_shared};	    
@@ -1475,7 +1458,6 @@ sub process_interface( $$ ) {
 						   zones      => {},
 						   origin     => shortlineinfo( '' ),
 						   wildcard   => $wildcard,
-						   physwild   => $physwild, # Currently unused
 					         };

    $interfaces{$physical} = $interfaceref if $physical ne $interface;
@@ -1634,7 +1616,7 @@ sub known_interface($)

    my $iface = $interface;

-    if ( defined $minroot ) {
+    if ( $minroot ) {
 	#
 	# We have wildcard interfaces -- see if this interface matches one of their roots
 	#
@@ -1875,8 +1857,7 @@ sub find_interfaces_by_option( $;$ ) {
    for my $interface ( @interfaces ) {
 	my $interfaceref = $interfaces{$interface};

-	next unless $interfaceref->{root};                                   # Don't return '+' interface
-	next if $procinterfaceoptions{$option} && $interfaceref->{physwild}; # Ignore /proc options on wildcard interface
+	next unless $interfaceref->{root};

 	my $optionsref = $interfaceref->{options};
 	if ( $nonzero ) {
@@ -1891,6 +1872,35 @@ sub find_interfaces_by_option( $;$ ) {
    \@ints;
 }

+#
+# Returns reference to array of interfaces with the passed option. Unlike the preceding function, this one:
+#
+# - All entries in %interfaces are searched.
+# - Returns a two-element list; the second element indicates whether any members of the list have wildcard physical names
+#
+sub find_interfaces_by_option1( $ ) {
+    my $option = $_[0];
+    my @ints = ();
+    my $wild = 0;
+
+    for my $interface ( @interfaces ) {
+	my $interfaceref = $interfaces{$interface};
+
+	next unless defined $interfaceref->{physical};
+
+	my $optionsref = $interfaceref->{options};
+
+	if ( $optionsref && defined $optionsref->{$option} ) {
+	    $wild ||= $interfaceref->{wildcard};
+	    push @ints , $interface
+	}
+    }
+
+    return unless defined wantarray;
+
+    wantarray ? ( \@ints, $wild ) : \@ints;
+}
+
 #
 # Return the value of an option for an interface
 #
--- a/Shorewall/Perl/lib.runtime
+++ b/Shorewall/Perl/lib.runtime
@@ -1,4 +1,4 @@
-#   (c) 1999-2018 - Tom Eastep (teastep@shorewall.net)
+#   (c) 1999-2017 - Tom Eastep (teastep@shorewall.net)
 #
 #	This program is part of Shorewall.
 #
@@ -1065,6 +1065,8 @@ clear_firewall() {
    run_iptables -F
    qt $IPTABLES -t raw -F

+    echo 1 > /proc/sys/net/ipv4/ip_forward
+
    if [ -n "$DISABLE_IPV6" ]; then
 	if [ -x $IP6TABLES ]; then
    	    $IP6TABLES -P INPUT   ACCEPT 2> /dev/null
@@ -1373,6 +1375,8 @@ clear_firewall() {
    run_iptables -F
    qt $IP6TABLES -t raw -F

+    echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
+
    run_clear_exit

    set_state "Cleared"
--- a/Shorewall/Perl/prog.footer
+++ b/Shorewall/Perl/prog.footer
@@ -1,23 +1,5 @@
 ###############################################################################
 # Code imported from /usr/share/shorewall/prog.footer
-#
-#   (c) 1999-2018 - Tom Eastep (teastep@shorewall.net)
-#
-#	This program is part of Shorewall.
-#
-#	This program is free software; you can redistribute it and/or modify
-#	it under the terms of the GNU General Public License as published by the
-#	Free Software Foundation, either version 2 of the license or, at your
-#	option, any later version.
-#
-#	This program is distributed in the hope that it will be useful,
-#	but WITHOUT ANY WARRANTY; without even the implied warranty of
-#	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-#	GNU General Public License for more details.
-#
-#	You should have received a copy of the GNU General Public License
-#	along with this program; if not, see <http://www.gnu.org/licenses/>.
-#
 ###############################################################################
 #
 # Give Usage Information
@@ -286,10 +268,8 @@ case "$COMMAND" in
 	    error_message "$g_product is not running"
 	    status=2
 	elif [ $# -eq 1 ]; then
-	    for table in raw mangle nat filter; do
-		qt $g_tool -t $table -Z
-	    done
-
+	    $g_tool -Z
+	    $g_tool -t mangle -Z
 	    date > ${VARDIR}/restarted
 	    status=0
 	    progress_message3 "$g_product Counters Reset"
@@ -373,7 +353,6 @@ case "$COMMAND" in
    clear)
 	[ $# -ne 1 ] && usage 2
 	progress_message3 "Clearing $g_product...."
-	detect_configuration
 	clear_firewall
 	status=0
 	if [ -n "$SUBSYSLOCK" ]; then
--- a/Shorewall/Samples/Universal/shorewall.conf
+++ b/Shorewall/Samples/Universal/shorewall.conf
@@ -77,7 +77,7 @@ UNTRACKED_LOG_LEVEL=

 ARPTABLES=

-CONFIG_PATH=":${CONFDIR}/shorewall:${SHAREDIR}/shorewall"
+CONFIG_PATH="${CONFDIR}/shorewall:${SHAREDIR}/shorewall"

 GEOIPDIR=/usr/share/xt_geoip/LE

--- a/Shorewall/Samples/one-interface/shorewall.conf
+++ b/Shorewall/Samples/one-interface/shorewall.conf
@@ -88,7 +88,7 @@ UNTRACKED_LOG_LEVEL=

 ARPTABLES=

-CONFIG_PATH=":${CONFDIR}/shorewall:${SHAREDIR}/shorewall"
+CONFIG_PATH="${CONFDIR}/shorewall:${SHAREDIR}/shorewall"

 GEOIPDIR=/usr/share/xt_geoip/LE

--- a/Shorewall/Samples/three-interfaces/shorewall.conf
+++ b/Shorewall/Samples/three-interfaces/shorewall.conf
@@ -85,7 +85,7 @@ UNTRACKED_LOG_LEVEL=

 ARPTABLES=

-CONFIG_PATH=":${CONFDIR}/shorewall:${SHAREDIR}/shorewall"
+CONFIG_PATH="${CONFDIR}/shorewall:${SHAREDIR}/shorewall"

 GEOIPDIR=/usr/share/xt_geoip/LE

--- a/Shorewall/Samples/two-interfaces/shorewall.conf
+++ b/Shorewall/Samples/two-interfaces/shorewall.conf
@@ -88,7 +88,7 @@ UNTRACKED_LOG_LEVEL=

 ARPTABLES=

-CONFIG_PATH=":${CONFDIR}/shorewall:${SHAREDIR}/shorewall"
+CONFIG_PATH="${CONFDIR}/shorewall:${SHAREDIR}/shorewall"

 GEOIPDIR=/usr/share/xt_geoip/LE

--- a/Shorewall/actions.std
+++ b/Shorewall/actions.std
@@ -26,19 +26,18 @@ Broadcast    inline,audit	# Handles Broadcast/Anycast
 ?else
 Broadcast    noinline,audit	# Handles Broadcast/Anycast
 ?endif
-DNSAmp	     proto=17		# Matches one-question recursive DNS queries
+DNSAmp				# Matches one-question recursive DNS queries
 Drop				# Default Action for DROP policy (deprecated)
 dropBcast    inline		# Silently Drop Broadcast
 dropBcasts   inline		# Silently Drop Broadcast
 dropInvalid  inline		# Drops packets in the INVALID conntrack state
 dropMcast    inline		# Silently Drop Multicast
-dropNotSyn   noinline,proto=6	# Silently Drop Non-syn TCP packets
-DropDNSrep   inline,proto=17	# Drops DNS replies
+dropNotSyn   noinline		# Silently Drop Non-syn TCP packets
+DropDNSrep   inline		# Drops DNS replies
 DropSmurfs   noinline		# Drop smurf packets
 Established  inline,\		# Handles packets in the ESTABLISHED state
 	     state=ESTABLISHED	#
-FIN	     inline,audit,\	# Handles ACK,FIN packets
-	     proto=6
+FIN	     inline,audit	# Handles ACK,FIN,PSH packets
 forwardUPnP  noinline		# Allow traffic that upnpd has redirected from 'upnp' interfaces.
 GlusterFS    inline		# Handles GlusterFS
 IfEvent	     noinline		# Perform an action based on an event
@@ -51,16 +50,14 @@ Multicast    inline,audit	# Handles Multicast
 Multicast    noinline,audit	# Handles Multicast
 ?endif
 New	     inline,state=NEW	# Handles packets in the NEW conntrack state
-NotSyn	     inline,audit,\	# Handles TCP packets which do not have SYN=1 and ACK=0
-	     proto=6
-rejNotSyn    noinline,proto=6	# Silently Reject Non-syn TCP packets
+NotSyn	     inline,audit	# Handles TCP packets which do not have SYN=1 and ACK=0
+rejNotSyn    noinline		# Silently Reject Non-syn TCP packets
 Reject				# Default Action for REJECT policy (deprecated)
 Related	     inline,\		# Handles packets in the RELATED conntrack state
 	     state=RELATED	#
 ResetEvent   inline		# Reset an Event
-RST	     inline,audit,\	# Handle packets with RST set
-	     proto=6
+RST	     inline,audit	# Handle packets with RST set
 SetEvent     inline		# Initialize an event
-TCPFlags     proto=6		# Handle bad flag combinations.
+TCPFlags			# Handle bad flag combinations.
 Untracked    inline,\		# Handles packets in the UNTRACKED conntrack state
 	     state=UNTRACKED	#
--- a/Shorewall/configfiles/shorewall.conf
+++ b/Shorewall/configfiles/shorewall.conf
@@ -77,7 +77,7 @@ UNTRACKED_LOG_LEVEL=

 ARPTABLES=

-CONFIG_PATH=":${CONFDIR}/shorewall:${SHAREDIR}/shorewall"
+CONFIG_PATH="${CONFDIR}/shorewall:${SHAREDIR}/shorewall"

 GEOIPDIR=/usr/share/xt_geoip/LE

@@ -241,7 +241,7 @@ TC_EXPERT=No

 TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"

-TRACK_PROVIDERS=Yes
+TRACK_PROVIDERS=No

 TRACK_RULES=No

--- a/Shorewall/configpath
+++ b/Shorewall/configpath
@@ -3,4 +3,4 @@
 #
 # /usr/share/shorewall/configpath
 #
-CONFIG_PATH=":${CONFDIR}/shorewall:${SHAREDIR}/shorewall"
+CONFIG_PATH=${CONFDIR}/shorewall:${SHAREDIR}/shorewall
--- a/Shorewall/install.sh
+++ b/Shorewall/install.sh
--- a/Shorewall/lib.cli-std
+++ b/Shorewall/lib.cli-std
@@ -1,7 +1,7 @@
 #
-# Shorewall 5.1 -- /usr/share/shorewall/lib.cli-std.
+# Shorewall 5.0 -- /usr/share/shorewall/lib.cli-std.
 #
-#     (c) 1999-2018 - Tom Eastep (teastep@shorewall.net)
+#     (c) 1999-2015 - Tom Eastep (teastep@shorewall.net)
 #
 #	Complete documentation is available at http://shorewall.net
 #
@@ -47,10 +47,11 @@ get_config() {
 	fi
    fi

-    if [ -n "$g_shorewalldir" ]; then
-	config="$g_shorewalldir/$PRODUCT.conf"
-    else
+    if [ "$(id -u)" -eq 0 ]; then
 	config=$(find_file ${PRODUCT}.conf)
+    else
+	[ -n "$g_shorewalldir" ] || fatal_error "Ordinary users may not $COMMAND the $CONFDIR/$PRODUCT configuration"
+	config="$g_shorewalldir/$PRODUCT.conf"
    fi

    if [ -f $config ]; then
@@ -341,12 +342,8 @@ get_config() {
 	fi
    fi

-    if [ -n "$DYNAMIC_BLACKLIST" -a "$(id -u)" = 0 ]; then
-	case $COMMAND in
-	    blacklist|allow|drop|logdrop|reject)
-		setup_dbl
-		;;
-	esac
+    if [ -n "$DYNAMIC_BLACKLIST" ]; then
+	setup_dbl
    fi

    if [ -z "$PERL_HASH_SEED" ]; then
@@ -366,17 +363,6 @@ get_config() {
    [ -f $lib ] && . $lib
 }

-#
-# Ensure that the effective UID is 0 or that we are dealing with a private configuration
-#
-ensure_root() {
-    if [ $(id -u) -ne 0 ]; then
-	if [ -z "$g_shorewalldir" -o "$g_shorewalldir" = $CONFDIR/$PRODUCT ]; then
-	    startup_error "Ordinary users may not $COMMAND the default $PRODUCT configuration"
-	fi
-    fi
-}
-
 #
 # Determine if there are config files newer than the passed object
 #
@@ -384,27 +370,20 @@ uptodate() {
    [ -x $1 ] || return 1

    local dir
-    local busybox
-    local find
+    local ifs

-    find=$(mywhich find)
+    ifs="$IFS"
+    IFS=':'

-    [ -n "${find}" ] || return 1
-    [ -h "${find}" ] && busybox=Yes
-
-    for dir in $g_shorewalldir $(split $CONFIG_PATH); do
-	if [ -n "${busybox}" ]; then
-	    #
-	    # Busybox 'find' doesn't support -quit.
-	    #
-	    if [ -n "$(${find} ${dir} -maxdepth 1 -type f -newer $1 -print)" ]; then
-		return 1;
-	    fi
-	elif [ -n "$(${find} ${dir} -maxdepth 1 -type f -newer $1 -print -quit)" ]; then
+    for dir in $g_shorewalldir $CONFIG_PATH; do
+	if [ -n "$(find ${dir} -newer $1)" ]; then
+	    IFS="$ifs"
 	    return 1;
 	fi
    done

+    IFS="$ifs"
+
    return 0
 }

@@ -434,7 +413,11 @@ compiler() {

    pc=${LIBEXECDIR}/shorewall/compiler.pl

-    ensure_root
+    if [ $(id -u) -ne 0 ]; then
+	if [ -z "$g_shorewalldir" -o "$g_shorewalldir" = $CONFDIR/$PRODUCT ]; then
+	    startup_error "Ordinary users may not $COMMAND the $CONFDIR/$PRODUCT configuration"
+	fi
+    fi
    #
    # We've now set g_shorewalldir so recalculate CONFIG_PATH
    #
@@ -1758,7 +1741,6 @@ compiler_command() {
 	    compile_command $@
 	    ;;
 	refresh)
-	    only_root
 	    get_config Yes Yes
 	    shift
 	    refresh_command $@
@@ -1780,13 +1762,11 @@ compiler_command() {
 	    export_command $@
 	    ;;
 	try)
-	    only_root
 	    get_config Yes
 	    shift
 	    try_command $@
 	    ;;
 	safe-reload|safe-restart|safe-start)
-	    only_root
 	    get_config Yes
 	    shift
 	    safe_commands $@
--- a/Shorewall/manpages/shorewall-actions.xml
+++ b/Shorewall/manpages/shorewall-actions.xml
@@ -191,27 +191,6 @@
              </listitem>
            </varlistentry>

-            <varlistentry>
-              <term><option>proto</option>=<replaceable>protocol</replaceable></term>
-
-              <listitem>
-                <para>Added in Shorewall 5.1.10. Specifies that the action is
-                only usable with the specified
-                <replaceable>protocol</replaceable> (name or number). When the
-                action is invoked with no protocol specified in the PROTO
-                column, or if the action is used as a Policy Action, the named
-                <replaceable>protocol</replaceable> will be assumed. If a
-                protocol is specified in the PROTO column of an invocation,
-                then it must match the named
-                <replaceable>protocol</replaceable>.</para>
-
-                <para>The <option>proto</option> option has no effect if the
-                <option>inline</option> or <option>builtin</option> option is
-                specified. A warning is issued if <option>proto</option> is
-                specified along with <option>builtin</option>.</para>
-              </listitem>
-            </varlistentry>
-
            <varlistentry>
              <term><option>section</option></term>

--- a/Shorewall/manpages/shorewall-conntrack.xml
+++ b/Shorewall/manpages/shorewall-conntrack.xml
@@ -447,7 +447,7 @@

              <listitem>
                <para>This form combines the preceding two and requires that
-                both the incoming interface and source address match.</para>
+                both the incoming interace and source address match.</para>
              </listitem>
            </varlistentry>

@@ -543,7 +543,7 @@

              <listitem>
                <para>This form combines the preceding two and requires that
-                both the outgoing interface and destination address
+                both the outgoing interace and destination address
                match.</para>
              </listitem>
            </varlistentry>
@@ -579,23 +579,14 @@

        <listitem>
          <para>A protocol name from <filename>/etc/protocols</filename> or a
-          protocol number. tcp and 6 may be optionally followed by <emphasis
-          role="bold">:syn </emphasis>to match only the SYN packet (first
-          packet in the three-way handshake).</para>
+          protocol number.</para>

-          <para>Beginning with Shorewall 4.5.12, this column can accept a
-          comma-separated list of protocols and either <emphasis
+          <para>Beginning with Shorewall 4.5.12, this column is labeled
+          <emphasis role="bold">PROTOS</emphasis> and can accept a
+          comma-separated list of protocols. Either <emphasis
          role="bold">proto</emphasis> or <emphasis
          role="bold">protos</emphasis> is accepted in the alternate input
          format.</para>
-
-          <para>Beginning with Shorewall 5.1.11, when <emphasis
-          role="bold">tcp</emphasis> or <emphasis role="bold">6</emphasis> is
-          specified and the ACTION is <emphasis role="bold">CT</emphasis>, the
-          compiler will default to <emphasis role="bold">:syn</emphasis>. If
-          you wish the rule to match packets with any valid combination of TCP
-          flags, you may specify <emphasis role="bold">tcp:all</emphasis> or
-          <emphasis role="bold">6:all</emphasis>.</para>
        </listitem>
      </varlistentry>

--- a/Shorewall/manpages/shorewall-interfaces.xml
+++ b/Shorewall/manpages/shorewall-interfaces.xml
@@ -112,10 +112,7 @@ loc     eth2            -</programlisting>
          url="/manpages/shorewall-nesting.html">shorewall-nesting</ulink>(5)
          for a discussion of this problem.</para>

-          <para>Shorewall allows '+' as an interface name, but that usage is
-          deprecated. A better approach is to specify
-          '<option>physical</option>=+' in the OPTIONS column (see
-          below).</para>
+          <para>Shorewall allows '+' as an interface name.</para>

          <para>There is no need to define the loopback interface (lo) in this
          file.</para>
@@ -196,54 +193,6 @@ loc     eth2            -</programlisting>
          should have no embedded white-space.</para>

          <variablelist>
-            <varlistentry>
-              <term><emphasis
-              role="bold">accept_ra</emphasis>[={0|1|2}]</term>
-
-              <listitem>
-                <para>IPv6 only; added in Shorewall 4.5.16. Values are:</para>
-
-                <variablelist>
-                  <varlistentry>
-                    <term>0</term>
-
-                    <listitem>
-                      <para>Do not accept Router Advertisements.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term>1</term>
-
-                    <listitem>
-                      <para>Accept Route Advertisements if forwarding is
-                      disabled.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term>2</term>
-
-                    <listitem>
-                      <para>Overrule forwarding behavior. Accept Route
-                      Advertisements even if forwarding is enabled.</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-
-                <para>If the option is specified without a value, then the
-                value 1 is assumed.</para>
-
-                <note>
-                  <para>This option does not work with a wild-card <emphasis
-                  role="bold">physical</emphasis> name (e.g., eth0.+).
-                  Beginning with Shorewall 5.1.10, If this option is
-                  specified, a warning is issued and the option is
-                  ignored.</para>
-                </note>
-              </listitem>
-            </varlistentry>
-
            <varlistentry>
              <term><emphasis role="bold">arp_filter[={0|1}]</emphasis></term>

@@ -260,12 +209,12 @@ loc     eth2            -</programlisting>
                changed; the value assigned to the setting will be the value
                specified (if any) or 1 if no value is given.</para>

+                <para/>
+
                <note>
-                  <para>This option does not work with a wild-card <emphasis
-                  role="bold">physical</emphasis> name (e.g., eth0.+).
-                  Beginning with Shorewall 5.1.10, If this option is
-                  specified, a warning is issued and the option is
-                  ignored.</para>
+                  <para>This option does not work with a wild-card
+                  <replaceable>interface</replaceable> name (e.g., eth0.+) in
+                  the INTERFACE column.</para>
                </note>
              </listitem>
            </varlistentry>
@@ -294,14 +243,16 @@ loc     eth2            -</programlisting>

                <para>8 - do not reply for all local addresses</para>

+                <para/>
+
                <note>
-                  <para>This option does not work with a wild-card <emphasis
-                  role="bold">physical</emphasis> name (e.g., eth0.+).
-                  Beginning with Shorewall 5.1.10, If this option is
-                  specified, a warning is issued and the option is
-                  ignored.</para>
+                  <para>This option does not work with a wild-card
+                  <replaceable>interface</replaceable> name (e.g., eth0.+) in
+                  the INTERFACE column.</para>
                </note>

+                <para/>
+
                <warning>
                  <para>Do not specify <emphasis
                  role="bold">arp_ignore</emphasis> for any interface involved
@@ -479,25 +430,6 @@ loc     eth2            -</programlisting>
              </listitem>
            </varlistentry>

-            <varlistentry>
-              <term><emphasis role="bold">forward</emphasis>[={0|1}]</term>
-
-              <listitem>
-                <para>IPv6 only Sets the
-                /proc/sys/net/ipv6/conf/interface/forwarding option to the
-                specified value. If no value is supplied, then 1 is
-                assumed.</para>
-
-                <note>
-                  <para>This option does not work with a wild-card <emphasis
-                  role="bold">physical</emphasis> name (e.g., eth0.+).
-                  Beginning with Shorewall 5.1.10, If this option is
-                  specified, a warning is issued and the option is
-                  ignored.</para>
-                </note>
-              </listitem>
-            </varlistentry>
-
            <varlistentry>
              <term><emphasis role="bold">ignore[=1]</emphasis></term>

@@ -564,11 +496,9 @@ loc     eth2            -</programlisting>
                <para/>

                <note>
-                  <para>This option does not work with a wild-card <emphasis
-                  role="bold">physical</emphasis> name (e.g., eth0.+).
-                  Beginning with Shorewall 5.1.10, If this option is
-                  specified, a warning is issued and the option is
-                  ignored.</para>
+                  <para>This option does not work with a wild-card
+                  <replaceable>interface</replaceable> name (e.g., eth0.+) in
+                  the INTERFACE column.</para>
                </note>

                <blockquote>
@@ -695,10 +625,7 @@ loc     eth2            -</programlisting>

                <para>If the <emphasis>interface</emphasis> name is a wildcard
                name (ends with '+'), then the physical
-                <emphasis>name</emphasis> must also end in '+'. The physical
-                <replaceable>name</replaceable> may end in '+' (or be exactly
-                '+') when the <replaceable>interface</replaceable> name is not
-                a wildcard name.</para>
+                <emphasis>name</emphasis> must also end in '+'.</para>

                <para>If <option>physical</option> is not specified, then it's
                value defaults to the <emphasis>interface</emphasis>
@@ -720,13 +647,9 @@ loc     eth2            -</programlisting>
                url="http://tldp.org/HOWTO/Proxy-ARP-Subnet/index.html">http://tldp.org/HOWTO/Proxy-ARP-Subnet/index.html.
                </ulink></para>

-                <note>
-                  <para>This option does not work with a wild-card <emphasis
-                  role="bold">physical</emphasis> name (e.g., eth0.+).
-                  Beginning with Shorewall 5.1.10, If this option is
-                  specified, a warning is issued and the option is
-                  ignored.</para>
-                </note>
+                <para><emphasis role="bold">Note</emphasis>: This option does
+                not work with a wild-card <replaceable>interface</replaceable>
+                name (e.g., eth0.+) in the INTERFACE column.</para>

                <para>Only those interfaces with the <option>proxyarp</option>
                option will have their setting changed; the value assigned to
@@ -742,13 +665,9 @@ loc     eth2            -</programlisting>
                <para>IPv6 only. Sets
                /proc/sys/net/ipv6/conf/<emphasis>interface</emphasis>/proxy_ndp.</para>

-                <note>
-                  <para>This option does not work with a wild-card <emphasis
-                  role="bold">physical</emphasis> name (e.g., eth0.+).
-                  Beginning with Shorewall 5.1.10, If this option is
-                  specified, a warning is issued and the option is
-                  ignored.</para>
-                </note>
+                <para><emphasis role="bold">Note</emphasis>: This option does
+                not work with a wild-card <replaceable>interface</replaceable>
+                name (e.g., eth0.+) in the INTERFACE column.</para>

                <para>Only those interfaces with the <option>proxyndp</option>
                option will have their setting changed; the value assigned to
@@ -812,11 +731,9 @@ loc     eth2            -</programlisting>
                filtering.</para>

                <note>
-                  <para>This option does not work with a wild-card <emphasis
-                  role="bold">physical</emphasis> name (e.g., eth0.+).
-                  Beginning with Shorewall 5.1.10, If this option is
-                  specified, a warning is issued and the option is
-                  ignored.</para>
+                  <para>This option does not work with a wild-card
+                  <replaceable>interface</replaceable> name (e.g., eth0.+) in
+                  the INTERFACE column.</para>
                </note>

                <para>This option can also be enabled globally via the
@@ -925,11 +842,9 @@ loc     eth2            -</programlisting>
                specified (if any) or 1 if no value is given.</para>

                <note>
-                  <para>This option does not work with a wild-card <emphasis
-                  role="bold">physical</emphasis> name (e.g., eth0.+).
-                  Beginning with Shorewall 5.1.10, If this option is
-                  specified, a warning is issued and the option is
-                  ignored.</para>
+                  <para>This option does not work with a wild-card
+                  <replaceable>interface</replaceable> name (e.g., eth0.+) in
+                  the INTERFACE column.</para>
                </note>
              </listitem>
            </varlistentry>
--- a/Shorewall/manpages/shorewall-logging.xml
+++ b/Shorewall/manpages/shorewall-logging.xml
@@ -362,7 +362,7 @@ REJECT(icmp-proto-unreachable):notice:IPv6,tunneling loc             net
    is 2 and AF_INET6 is 10).</para>

    <para>The name immediately following the number is the currently-selected
-    backend, and the ones in parentheses are the ones that are available. You
+    backend, and the ones in parantheses are the ones that are available. You
    can change the currently selected backend by echoing it's name into
    /proc/net/netfilter/nf_log.<replaceable>number</replaceable>.</para>

--- a/Shorewall/manpages/shorewall-mangle.xml
+++ b/Shorewall/manpages/shorewall-mangle.xml
@@ -681,7 +681,7 @@ SAME              $FW            0.0.0.0/0    tcp        80,443</programlisting>
              <listitem>
                <para>Added in Shorewall 5.1.9. This target only applies to
                TCP traffic and alters the MSS value in SYN packets. It may be
-                used in the FORWARD and POSTROUTING chains; the default is
+                used in the FOWARD and POSTROUTING chains; the default is
                FORWARD.</para>

                <para>The <replaceable>mss</replaceable> parameter may be
--- a/Shorewall/manpages/shorewall-providers.xml
+++ b/Shorewall/manpages/shorewall-providers.xml
@@ -84,7 +84,7 @@

          <para>If PROVIDER_OFFSET is non-zero in <ulink
          url="/manpages/shorewall.conf.html">shorewall.conf(5)</ulink>, then
-          the value must be a multiple of 2^^PROVIDER_OFFSET. In all cases, the
+          the value must be a mutiple of 2^^PROVIDER_OFFSET. In all cases, the
          number of significant bits may not exceed PROVIDER_OFFSET +
          PROVIDER_BITS.</para>
        </listitem>
--- a/Shorewall/manpages/shorewall-snat.xml
+++ b/Shorewall/manpages/shorewall-snat.xml
@@ -97,7 +97,7 @@

            <varlistentry>
              <term><emphasis
-              role="bold">MASQUERADE[+]</emphasis>[([<replaceable>lowport</replaceable>[-<replaceable>highport</replaceable>]][<option>random</option>])][:<replaceable>level</replaceable>]</term>
+              role="bold">MASQUERADE[+]</emphasis>[([<replaceable>lowport</replaceable>-<replaceable>highport</replaceable>][<option>random</option>])][:<replaceable>level</replaceable>]</term>

              <listitem>
                <para>Causes matching outgoing packages to have their source
@@ -105,12 +105,11 @@
                specified in the DEST column. if
                <replaceable>lowport</replaceable>-<replaceable>highport</replaceable>
                is given, that port range will be used to assign a source
-                port. If only <replaceable>lowport</replaceable> is given,
-                that port will be assigned, if possible. If option
-                <option>random</option> is used then port mapping will be
-                randomized. MASQUERADE should only be used when the DEST
-                interface has a dynamic IP address. Otherwise, SNAT should be
-                used and should specify the interface's static address.</para>
+                port. If option <option>random</option> is used then port
+                mapping will be randomized. MASQUERADE should only be used
+                when the DEST interface has a dynamic IP address. Otherwise,
+                SNAT should be used and should specify the interface's static
+                address.</para>
              </listitem>
            </varlistentry>

@@ -157,7 +156,7 @@
            <varlistentry>
              <term><emphasis
              role="bold">SNAT[+]</emphasis>([<emphasis>address-or-address-range</emphasis>][:<emphasis>lowport</emphasis><emphasis
-              role="bold">[-</emphasis><emphasis>highport</emphasis>]][<emphasis
+              role="bold">-</emphasis><emphasis>highport</emphasis>][<emphasis
              role="bold">:random</emphasis>][:<option>persistent</option>]|<emphasis
              role="bold">detect</emphasis>)[:<replaceable>level</replaceable>]</term>

@@ -210,9 +209,6 @@

                <programlisting>        192.0.2.4:5000-6000
        :4000-5000</programlisting>
-
-                <para>You may also specify a single port number, which will be
-                assigned to the outgoing connection, if possible.</para>
              </listitem>
            </varlistentry>

--- a/Shorewall/manpages/shorewall-tcdevices.xml
+++ b/Shorewall/manpages/shorewall-tcdevices.xml
@@ -160,9 +160,7 @@
          how often the rate is estimated and how many samples are retained
          for estimating. Please see <ulink
          url="http://ace-host.stuart.id.au/russell/files/tc/doc/estimators.txt">http://ace-host.stuart.id.au/russell/files/tc/doc/estimators.txt</ulink>
-          for details. If not specified, the default
-          <replaceable>interval</replaceable> is 250ms and the default
-          <replaceable>decay_interval</replaceable> is 4sec.</para>
+          for details.</para>
        </listitem>
      </varlistentry>

--- a/Shorewall/manpages/shorewall-tcinterfaces.xml
+++ b/Shorewall/manpages/shorewall-tcinterfaces.xml
@@ -172,9 +172,7 @@
          how often the rate is estimated and how many samples are retained
          for estimating. Please see <ulink
          url="http://ace-host.stuart.id.au/russell/files/tc/doc/estimators.txt">http://ace-host.stuart.id.au/russell/files/tc/doc/estimators.txt</ulink>
-          for details. If not specified, the default
-          <replaceable>interval</replaceable> is 250ms and the default
-          <replaceable>decay_interval</replaceable> is 4sec.</para>
+          for details.</para>
        </listitem>
      </varlistentry>

--- a/Shorewall/manpages/shorewall.conf.xml
+++ b/Shorewall/manpages/shorewall.conf.xml
@@ -673,7 +673,7 @@

      <varlistentry>
        <term><emphasis
-        role="bold">CONFIG_PATH</emphasis>=[[:]<emphasis>directory</emphasis>[:<emphasis>directory</emphasis>]...]</term>
+        role="bold">CONFIG_PATH</emphasis>=[<emphasis>directory</emphasis>[:<emphasis>directory</emphasis>]...]</term>

        <listitem>
          <para>Specifies where configuration files other than
@@ -701,16 +701,6 @@
          /etc/shorewall:/usr/share/shorewall but your particular distribution
          may set it differently. See the output of shorewall show config for
          the default on your system.</para>
-
-          <para>Beginning with Shorewall 5.1.10, the CONFIG_PATH setting may
-          begin with a colon (":"), to signal that the first
-          <replaceable>directory</replaceable> listed will be skipped if the
-          user performing a compilation is not root or if the configuration is
-          being compiled for export (-e option specified or if running one of
-          the remote-* commands) . This prevents the compiler from looking in
-          <filename>/etc/shorewall[6]</filename>/ when compilation is being
-          done by a non-root user or if the generated script is to be sent to
-          a remote firewall system.</para>
        </listitem>
      </varlistentry>

@@ -730,14 +720,6 @@
          and <command>restart</command> commands will succeed even if no DNS
          server is reachable (assuming that the configuration hasn't changed
          since the compiled script was last generated).</para>
-
-          <important>
-            <para>When DEFER_DNS_RESOLUTION=No and AUTOMAKE=Yes and a DNS
-            change makes it necessary to recompile an existing firewall
-            script, the <option>-c</option> option must be used with the
-            <command>reload</command> or <command>restart</command> command to
-            force recompilation.</para>
-          </important>
        </listitem>
      </varlistentry>

--- a/Shorewall/uninstall.sh
+++ b/Shorewall/uninstall.sh
@@ -2,7 +2,7 @@
 #
 # Script to back uninstall Shoreline Firewall
 #
-#     (c) 2000-2017 - Tom Eastep (teastep@shorewall.net)
+#     (c) 2000-2016 - Tom Eastep (teastep@shorewall.net)
 #
 #       Shorewall documentation is available at http://www.shorewall.net
 #
--- a/Shorewall6/Samples6/Universal/interfaces
+++ b/Shorewall6/Samples6/Universal/interfaces
@@ -11,5 +11,5 @@
 ###############################################################################
 #ZONE	INTERFACE	OPTIONS
 -	lo		ignore
-net	all		dhcp,physical=+,routeback
+net	all		dhcp,physical=+,routeback,sourceroute=0

--- a/Shorewall6/Samples6/Universal/shorewall6.conf
+++ b/Shorewall6/Samples6/Universal/shorewall6.conf
@@ -74,7 +74,7 @@ UNTRACKED_LOG_LEVEL=
 #	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
 ###############################################################################

-CONFIG_PATH=":${CONFDIR}/shorewall6:${SHAREDIR}/shorewall6:${SHAREDIR}/shorewall"
+CONFIG_PATH=${CONFDIR}/shorewall6:${SHAREDIR}/shorewall6:${SHAREDIR}/shorewall

 GEOIPDIR=/usr/share/xt_geoip/LE

--- a/Shorewall6/Samples6/one-interface/shorewall6.conf
+++ b/Shorewall6/Samples6/one-interface/shorewall6.conf
@@ -75,7 +75,7 @@ UNTRACKED_LOG_LEVEL=
 #	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
 ###############################################################################

-CONFIG_PATH=":${CONFDIR}/shorewall6:/usr/share/shorewall6:${SHAREDIR}/shorewall"
+CONFIG_PATH="${CONFDIR}/shorewall6:/usr/share/shorewall6:${SHAREDIR}/shorewall"

 GEOIPDIR=/usr/share/xt_geoip/LE

--- a/Shorewall6/Samples6/three-interfaces/shorewall6.conf
+++ b/Shorewall6/Samples6/three-interfaces/shorewall6.conf
@@ -74,7 +74,7 @@ UNTRACKED_LOG_LEVEL=
 #	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
 ###############################################################################

-CONFIG_PATH=":${CONFDIR}/shorewall6:${SHAREDIR}/shorewall6:${SHAREDIR}/shorewall"
+CONFIG_PATH=${CONFDIR}/shorewall6:${SHAREDIR}/shorewall6:${SHAREDIR}/shorewall

 GEOIPDIR=/usr/share/xt_geoip/LE

--- a/Shorewall6/Samples6/two-interfaces/shorewall6.conf
+++ b/Shorewall6/Samples6/two-interfaces/shorewall6.conf
@@ -74,7 +74,7 @@ UNTRACKED_LOG_LEVEL=
 #	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
 ###############################################################################

-CONFIG_PATH=":${CONFDIR}/shorewall6:${SHAREDIR}/shorewall6:${SHAREDIR}/shorewall"
+CONFIG_PATH=${CONFDIR}/shorewall6:${SHAREDIR}/shorewall6:${SHAREDIR}/shorewall

 GEOIPDIR=/usr/share/xt_geoip/LE

--- a/Shorewall6/actions.std
+++ b/Shorewall6/actions.std
@@ -8,43 +8,42 @@
 #
 ###############################################################################
 #ACTION
-A_Drop				# Audited Default Action for DROP policy
-A_Reject			# Audited Default Action for REJECT policy
-A_AllowICMPs proto=58		# Audited Accept needed ICMP6 types
-AllowICMPs   proto=58		# Accept needed ICMP6 types
+A_Drop	                        # Audited Default Action for DROP policy
+A_Reject	                # Audited Default Action for REJECT policy
+A_AllowICMPs	                # Audited Accept needed ICMP6 types
+AllowICMPs   	                # Accept needed ICMP6 types
 allowBcast   inline		# Silently Allow Broadcast
 allowInvalid inline		# Accepts packets in the INVALID conntrack state
 allowMcast   inline		# Silently Allow Multicast
-AutoBL	     noinline		# Auto-blacklist IPs that exceed thesholds
-AutoBLL	     noinline		# Helper for AutoBL
+AutoBL       noinline           # Auto-blacklist IPs that exceed thesholds
+AutoBLL      noinline           # Helper for AutoBL
 BLACKLIST    logjump,section	# Add sender to the dynamic blacklist
-Broadcast    noinline		# Handles Broadcast/Anycast
-Drop				# Default Action for DROP policy (deprecated)
+Broadcast    noinline      	# Handles Broadcast/Anycast
+Drop		        	# Default Action for DROP policy (deprecated)
 dropBcast    inline		# Silently Drop Broadcast
 dropBcasts   inline		# Silently Drop Broadcast
 dropInvalid  inline		# Drops packets in the INVALID conntrack state
 dropMcast    inline		# Silently Drop Multicast
-dropNotSyn   noinline,proto=6	# Silently Drop Non-syn TCP packets
-DropDNSrep   inline,proto=17	# Drops DNS replies
-DropSmurfs   noinline		# Handles packets with a broadcast source address
+dropNotSyn   noinline		# Silently Drop Non-syn TCP packets
+DropDNSrep   inline		# Drops DNS replies
+DropSmurfs   noinline     	# Handles packets with a broadcast source address
 Established  inline,\		# Handles packets in the ESTABLISHED state
 	     state=ESTABLISHED
-FIN	     inline,audit,\	# Handles ACK,FIN,PSH packets
-	     proto=6
+FIN	     inline,audit	# Handles ACK,FIN,PSH packets
 forwardUPnP  noinline		# Allow traffic that upnpd has redirected from 'upnp' interfaces.
-IfEvent	     noinline		# Perform an action based on an event
-Invalid	     inline,audit,\	# Handles packets in the INVALID conntrack state
-	     state=INVALID
-Multicast    noinline		# Handles Multicast
+IfEvent      noinline           # Perform an action based on an event
+Invalid      inline,audit,\     # Handles packets in the INVALID conntrack state
+             state=INVALID
+Multicast    noinline      	# Handles Multicast
 New	     inline,state=NEW	# Handles packets in the NEW conntrack state
-NotSyn	     inline,proto=6	# Handles TCP packets that do not have SYN=1 and ACK=0
-Reject				# Default Action for REJECT policy (deprecated)
-rejNotSyn    noinline,proto=6	# Silently Reject Non-syn TCP packets
-Related	     inline,\		# Handles packets in the RELATED conntrack state
-	     state=RELATED
+NotSyn	     inline 		# Handles TCP packets that do not have SYN=1 and ACK=0
+Reject		        	# Default Action for REJECT policy (deprecated)
+rejNotSyn    noinline		# Silently Reject Non-syn TCP packets
+Related      inline,\		# Handles packets in the RELATED conntrack state
+             state=RELATED
 ResetEvent   inline		# Reset an Event
-RST	     inline,proto=6	# Handle packets with RST set
+RST	     inline             # Handle packets with RST set
 SetEvent     inline		# Initialize an event
-TCPFlags     proto=6		# Handles bad flags combinations
-Untracked    inline,\		# Handles packets in the UNTRACKED conntrack state
+TCPFlags    			# Handles bad flags combinations
+Untracked    inline,\           # Handles packets in the UNTRACKED conntrack state
 	     state=UNTRACKED
--- a/Shorewall6/configfiles/shorewall6.conf
+++ b/Shorewall6/configfiles/shorewall6.conf
@@ -74,7 +74,7 @@ UNTRACKED_LOG_LEVEL=
 #	L O C A T I O N	  O F	F I L E S   A N D   D I R E C T O R I E S
 ###############################################################################

-CONFIG_PATH=":${CONFDIR}/shorewall6:/usr/share/shorewall6:${SHAREDIR}/shorewall"
+CONFIG_PATH="${CONFDIR}/shorewall6:/usr/share/shorewall6:${SHAREDIR}/shorewall"

 GEOIPDIR=/usr/share/xt_geoip/LE

@@ -216,7 +216,7 @@ TC_EXPERT=No

 TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"

-TRACK_PROVIDERS=Yes
+TRACK_PROVIDERS=No

 TRACK_RULES=No

--- a/Shorewall6/configpath
+++ b/Shorewall6/configpath
@@ -3,4 +3,4 @@
 #
 # /usr/share/shorewall6/configpath
 #
-CONFIG_PATH=":${CONFDIR}/shorewall6:${SHAREDIR}/shorewall6:${SHAREDIR}/shorewall"
+CONFIG_PATH=${CONFDIR}/shorewall6:${SHAREDIR}/shorewall6:${SHAREDIR}/shorewall
--- a/docs/FAQ.xml
+++ b/docs/FAQ.xml
@@ -2340,15 +2340,6 @@ gateway:~# </programlisting>
          option 8 combines identical chains which can result in a smaller
          ruleset, but it slows down the compilation of large rulesets.</para>
        </listitem>
-
-        <listitem>
-          <para>Rather than <command>restart</command>, use
-          <command>reload</command>. With the default setting of
-          RESTART=restart, <command>restart</command> performs
-          <command>stop</command> then <command>start</command>, while
-          <command>reload</command> avoids the <command>stop</command>
-          part.</para>
-        </listitem>
      </orderedlist>
    </section>

@@ -2376,14 +2367,6 @@ gateway:~# </programlisting>
      capabiities of your system. If you system doesn't support a command, it
      will generally issue a kernel log message.</para>
    </section>
-
-    <section>
-      <title id="faq106">(FAQ 106) Shorewall is not starting at boot on Debian
-      with systemd</title>
-
-      <para><emphasis role="bold">Answer:</emphasis> To enable start at boot,
-      run <command>systemctl enable shorewall.service</command></para>
-    </section>
  </section>

  <section id="MultiISP">
--- a/docs/Helpers.xml
+++ b/docs/Helpers.xml
@@ -71,7 +71,7 @@
      </listitem>

      <listitem>
-        <para>PPTP (TCP 1723)</para>
+        <para>PPTP (TCP 1729)</para>
      </listitem>

      <listitem>
@@ -121,10 +121,9 @@
      of your system.</para>

      <para>Many of the modules allow parameters to be specified when the
-      module is loaded. Among the common parameters is the
-      <option>ports</option> parameter that lists one or more ports that the
-      module is to monitor. This allows running the application on a
-      non-standard port.</para>
+      module is loaded. Among the common parameters is the ports parameter
+      that lists one or more ports that the module is to monitor. This allows
+      running the application on a non-standard port.</para>
    </section>

    <section>
--- a/docs/SharedConfig.xml
+++ b/docs/SharedConfig.xml
@@ -963,7 +963,7 @@ SMBBI(ACCEPT)	    { SOURCE=vpn, DEST=$FW }
 ######################################################################################################
 # IRC
 #
-IRC(ACCEPT)	    { SOURCE=loc,apps, DEST=net }
+IRC(ACCEPT)	    { SOURCE=loc,vpn,apps:IRC_IF, DEST=net }
 ######################################################################################################
 # Rsync
 #
--- a/docs/blacklisting_support.xml
+++ b/docs/blacklisting_support.xml
@@ -85,7 +85,7 @@
    url="manpages/shorewall-blrules.html">shorewall-blrules</ulink> (5)).
    There you have access to the DROP, ACCEPT, REJECT and WHITELIST actions,
    standard and custom macros as well as standard and custom actions. See
-    <ulink url="manpages/shorewall-blrules.html">shorewall-blrules</ulink> (5)
+    <ulink url="manpages/shorewall-rules.html">shorewall-blrules</ulink> (5)
    for details.</para>

    <para>Example:</para>
@@ -265,7 +265,7 @@ DROP            net:200.55.14.18        all

    <para>Beginning with Shorewall 5.1.1, it is possible to specify BLACKLIST
    in the POLICY column of <ulink
-    url="manpages/shorewall-policy.html">shorewall-policy</ulink>(5) when
+    url="manpages/shorewall-policies.html">shorewall-policies</ulink>(5) when
    ipset-based dynamic blacklisting is being used. When a packet is disposed
    of via the BLACKLIST policy, the packet's sender is added to the dynamic
    blacklist ipset and the packet is dropped.</para>
--- a/docs/configuration_file_basics.xml
+++ b/docs/configuration_file_basics.xml
@@ -2498,63 +2498,27 @@ gmail-pop.l.google.com. <emphasis role="bold">300</emphasis>   IN A     209.85.2
    <programlisting>#ACTION        SOURCE               DEST              PROTO             DPORT
 POP(ACCEPT)     loc                  net:pop.gmail.com</programlisting>

-    <para>There are two options in <ulink
-    url="manpages/shorewall.conf.html">shorewall[6].conf(5)</ulink> that
-    affect the use of DNS names in Shorewall[6] config files:</para>
-
-    <itemizedlist>
-      <listitem>
-        <para>DEFER_DNS_RESOLUTION - When set to No, DNS names are resolved at
-        compile time; when set to Yes, DNS Names are resolved at
-        runtime.</para>
-      </listitem>
-
-      <listitem>
-        <para>AUTOMAKE - When set to Yes, <command>start</command>,
-        <command>restart</command> and <command>reload</command> only result
-        in compilation if one of the files on the CONFIG_PATH has changed
-        since the the last compilation.</para>
-      </listitem>
-    </itemizedlist>
-
-    <para>So by setting AUTOMAKE=Yes, and DEFER_DNS_RESOLUTION=No, compilation
-    will only take place at boot time if a change had been make to the config
-    but no <command>restart</command> or <command>reload</command> had taken
-    place. This is clearly spelled out in the shorewall.conf manpage. So with
-    these settings, so long as a 'reload' or 'restart' takes place after the
-    Shorewall configuration is changes, there should be no DNS-related
-    problems at boot time.</para>
-
-    <important>
-      <para>When DEFER_DNS_RESOLUTION=No and AUTOMAKE=Yes and a DNS change
-      makes it necessary to recompile an existing firewall script, the
-      <option>-c</option> option must be used with the
-      <command>reload</command> or <command>restart</command> command to force
-      recompilation.</para>
-    </important>
-
-    <para>If your firewall rules include DNS names then, even if
-    DEFER_DNS_RESOLUTION=No and AUTOMAKE=Yes:</para>
+    <para>If your firewall rules include DNS names then:</para>

    <itemizedlist>
      <listitem>
        <para>If your <filename>/etc/resolv.conf </filename>is wrong then your
-        firewall may not start.</para>
+        firewall won't start.</para>
      </listitem>

      <listitem>
        <para>If your <filename>/etc/nsswitch.conf</filename> is wrong then
-        your firewall may not start.</para>
+        your firewall won't start.</para>
      </listitem>

      <listitem>
-        <para>If your Name Server(s) is(are) down then your firewall may not
+        <para>If your Name Server(s) is(are) down then your firewall won't
        start.</para>
      </listitem>

      <listitem>
        <para>If your startup scripts try to start your firewall before
-        starting your DNS server then your firewall may not start.</para>
+        starting your DNS server then your firewall won't start.</para>
      </listitem>

      <listitem>
@@ -2564,7 +2528,7 @@ POP(ACCEPT)     loc                  net:pop.gmail.com</programlisting>

      <listitem>
        <para>You must bring up your network interfaces prior to starting your
-        firewall, or the firewall may not start.</para>
+        firewall.</para>
      </listitem>
    </itemizedlist>

--- a/docs/shorewall_logging.xml
+++ b/docs/shorewall_logging.xml
@@ -278,7 +278,7 @@
      time:</para>

      <programlisting>gateway:/etc/shorewall# grep -v ^\# * | egrep '\$LOG|ULOG|LOGFILE'
-params:LOG=NFLOG
+params:LOG=NFOG
 policy:loc              $FW             REJECT          $LOG
 policy:net              all             DROP            $LOG            10/sec:40
 policy:all              all             REJECT          $LOG
--- a/docs/support.xml
+++ b/docs/support.xml
@@ -42,10 +42,10 @@
    <itemizedlist>
      <listitem>
        <para>The currently-supported Shorewall <ulink
-        url="ReleaseModel.html">major release</ulink>s are 5.0 and 5.1.</para>
+        url="ReleaseModel.html">major release</ulink>s are 4.5 and 4.6.</para>

        <note>
-          <para>Shorewall versions earlier than 5.0.0 are no longer supported;
+          <para>Shorewall versions earlier than 4.5.0 are no longer supported;
          we will try to help but we will not spend time reading earlier code
          to try to help you solve a problem and we will not release a patch
          to correct any defect found.</para>
Author	SHA1	Message	Date
Tom Eastep	670e3a0c6a	IPv6 Samples use logical interface names Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-11-22 09:52:53 -08:00
Tom Eastep	cc02d2bb64	Use logical interface names in the samples. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-11-22 09:44:15 -08:00