Use MUTEX_TIMEOUT for ip[6]tables --wait interval

Signed-off-by: Tom Eastep <teastep@shorewall.net>

Shorewall-core/configure

@@ -190,7 +190,7 @@ for p in ${!params[@]}; do
 done
 
 echo '#'                                                                 > shorewallrc
-echo "# Created by Shorewall Core version $VERSION configure - " `date` >> shorewallrc
+echo "# Created by Shorewall Core version $VERSION configure - " `date --utc --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}"` >> shorewallrc
 echo "# rc file: $rcfile"                                               >> shorewallrc
 echo '#'                                                                >> shorewallrc
 

Shorewall-core/configure.pl

@@ -173,7 +173,12 @@ my $outfile;
 
 open $outfile, '>', 'shorewallrc' or die "Can't open 'shorewallrc' for output: $!";
 
-printf $outfile "#\n# Created by Shorewall Core version %s configure.pl - %s %2d %04d %02d:%02d:%02d\n", VERSION, $abbr[$localtime[4]], $localtime[3], 1900 + $localtime[5] , @localtime[2,1,0];
+if ( $ENV{SOURCE_DATE_EPOCH} ) {
+    printf $outfile "#\n# Created by Shorewall Core version %s configure.pl - %s\n", VERSION, `date  --utc --date=\"\@$ENV{SOURCE_DATE_EPOCH}\"`;
+} else {
+    printf $outfile "#\n# Created by Shorewall Core version %s configure.pl - %s %2d %04d %02d:%02d:%02d\n", VERSION, $abbr[$localtime[4]], $localtime[3], 1900 + $localtime[5] , @localtime[2,1,0];
+}
+
 print $outfile "# rc file: $rcfilename\n#\n";
 
 print  $outfile "# Input: @ARGV\n#\n" if @ARGV;

Shorewall-core/lib.cli

@@ -25,7 +25,7 @@
 # loaded after this one and replaces some of the functions declared here.
 #
 
-SHOREWALL_CAPVERSION=50100
+SHOREWALL_CAPVERSION=50106
 
 if [ -z "$g_basedir" ]; then
     #
@@ -2803,6 +2803,8 @@ determine_capabilities() {
     WAIT_OPTION=
     CPU_FANOUT=
     NETMAP_TARGET=
+    NFLOG_SIZE=
+    RESTORE_WAIT_OPTION=
 
     AMANDA_HELPER=
     FTP_HELPER=
@@ -2826,9 +2828,11 @@ determine_capabilities() {
 	qt $arptables -L OUT && ARPTABLESJF=Yes
     fi
 
+    [ -z "$(${g_tool}-restore --wait < /dev/null 2>&1)" ] && RESTORE_WAIT_OPTION=Yes
+
     if qt $g_tool --wait -t filter -L INPUT -n -v; then
 	WAIT_OPTION=Yes
-	tool="$tool --wait"
+	g_tool="$g_tool --wait"
     fi
 
     chain=fooX$$
@@ -3136,10 +3140,13 @@ determine_capabilities() {
     qt $g_tool -A $chain -j LOGMARK && LOGMARK_TARGET=Yes
     qt $g_tool -A $chain -j LOG || LOG_TARGET=
     qt $g_tool -A $chain -j ULOG && ULOG_TARGET=Yes
-    qt $g_tool -A $chain -j NFLOG && NFLOG_TARGET=Yes
     qt $g_tool -A $chain -j MARK --set-mark 5 && MARK_ANYWHERE=Yes
     qt $g_tool -A $chain -m statistic --mode nth --every 2 --packet 1 && STATISTIC_MATCH=Yes
     qt $g_tool -A $chain -m geoip --src-cc US && GEOIP_MATCH=Yes
+    if qt $g_tool -A $chain -j NFLOG; then
+	NFLOG_TARGET=Yes
+	qt $g_tool -A $chain -j NFLOG --nflog-size 64 && NFLOG_SIZE=Yes
+    fi
 
     if [ $g_family -eq 4 ]; then
 	qt $g_tool -A $chain -j ACCOUNT --addr 192.168.1.0/29 --tname $chain && ACCOUNT_TARGET=Yes
@@ -3295,9 +3302,11 @@ report_capabilities_unsorted() {
     if [ $g_family -eq 4 ]; then
 	report_capability "iptables -S (IPTABLES_S)" $IPTABLES_S
 	report_capability "iptables --wait option (WAIT_OPTION)" $WAIT_OPTION
+	report_capability "iptables-restore --wait option (RESTORE_WAIT_OPTION)" $RESTORE_WAIT_OPTION
     else
 	report_capability "ip6tables -S (IPTABLES_S)" $IPTABLES_S
 	report_capability "ip6tables --wait option (WAIT_OPTION)" $WAIT_OPTION
+	report_capability "ip6tables-restore --wait option (RESTORE_WAIT_OPTION)" $RESTORE_WAIT_OPTION
     fi
 
     report_capability "Basic Filter (BASIC_FILTER)" $BASIC_FILTER
@@ -3305,6 +3314,7 @@ report_capabilities_unsorted() {
     report_capability "CT Target (CT_TARGET)" $CT_TARGET
     report_capability "NFQUEUE CPU Fanout (CPU_FANOUT)" $CPU_FANOUT
     report_capability "NETMAP Target (NETMAP_TARGET)" $NETMAP_TARGET
+    report_capability "--nflog-size support (NFLOG_SIZE)" $NFLOG_SIZE
 
     echo "   Kernel Version (KERNELVERSION): $KERNELVERSION"
     echo "   Capabilities Version (CAPVERSION): $CAPVERSION"
@@ -3411,6 +3421,8 @@ report_capabilities_unsorted1() {
     report_capability1 WAIT_OPTION
     report_capability1 CPU_FANOUT
     report_capability1 NETMAP_TARGET
+    report_capability1 NFLOG_SIZE
+    report_capability1 RESTORE_WAIT_OPTION
 
     report_capability1 AMANDA_HELPER
     report_capability1 FTP_HELPER

Shorewall-core/manpages/shorewall.xml

@@ -3173,6 +3173,8 @@
     <title>FILES</title>
 
     <para>/etc/shorewall/</para>
+
+    <para>/etc/shorewall6/</para>
   </refsect1>
 
   <refsect1>
@@ -3182,13 +3184,17 @@
     url="/starting_and_stopping_shorewall.htm">http://www.shorewall.net/starting_and_stopping_shorewall.htm</ulink></para>
 
     <para>shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
-    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
+    shorewall-arprules(5), shorewall-blrules(5), shorewall.conf(5),
+    shorewall-conntrack(5), shorewall-ecn(5), shorewall-exclusion(5),
+    shorewall-hosts(5), shorewall-init(5), shorewall_interfaces(5),
+    shorewall-ipsets(5), shorewall-maclist(5), shorewall-mangle(5),
+    shorewall-masq(5), shorewall-modules(5), shorewall-nat(5),
+    shorewall-nesting(5), shorewall-netmap(5), shorewall-params(5),
     shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
-    shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5),
-    shorewall.conf(5), shorewall-secmarks(5), shorewall-tcclasses(5),
-    shorewall-tcdevices(5), shorewall-tcrules(5), shorewall-tos(5),
-    shorewall-tunnels(5), shorewall-zones(5)</para>
+    shorewall6-proxyndp(5), shorewall-routes(5), shorewall-rtrules(5),
+    shorewall-rtrules(5), shorewall-rules(5), shorewall-secmarks(5),
+    shorewall-snat(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
+    shorewall-tcfilters(5), shorewall-tcinterfaces(5), shorewall-tcpri(5),
+    shorewall-tunnels(5), shorewall-vardir(5), shorewall-zones(5)</para>
   </refsect1>
 </refentry>

Shorewall/Actions/action.A_AllowICMPs.deprecated

@@ -0,0 +1,9 @@
+#
+# Shorewall6 -- /usr/share/shorewall/action.A_AllowICMPs
+#
+# This action A_ACCEPTs needed ICMP types
+#
+###############################################################################
+#ACTION		SOURCE		DEST	PROTO		DPORT
+
+AllowICMPs(A_ACCEPT)

Shorewall/Actions/action.A_Drop.deprecated

@@ -13,6 +13,7 @@
 # IF YOU ARE HAVING CONNECTION PROBLEMS, CHANGING THIS FILE WON'T HELP!!!!!!!!!
 #
 ?require AUDIT_TARGET
+?warning "You are using the deprecated A_Drop default action. Please see http://www.shorewall.net/Actions.html
 ###############################################################################
 #ACTION		SOURCE	DEST	PROTO	DPORT	SPORT
 #

Shorewall/Actions/action.A_Reject.deprecated

@@ -11,6 +11,8 @@
 #    internet operation are always ACCEPTed.
 #
 # IF YOU ARE HAVING CONNECTION PROBLEMS, CHANGING THIS FILE WON'T HELP!!!!!!!!!
+?require AUDIT_TARGET
+?warning "You are using the deprecated A_REJECT default action. Please see http://www.shorewall.net/Actions.html
 ###############################################################################
 #ACTION		SOURCE	DEST	PROTO
 #

Shorewall/Actions/action.AllowICMPs

@@ -7,5 +7,39 @@
 #ACTION	SOURCE	DEST	PROTO	DPORT	SPORT	ORIGDEST	RATE	USER
 
 DEFAULTS ACCEPT
-@1	-	-	icmp	fragmentation-needed	{comment="Needed ICMP types"}
-@1	-	-	icmp	time-exceeded		{comment="Needed ICMP types"}
+
+?if __IPV4
+    @1	-	-	icmp	fragmentation-needed	{comment="Needed ICMP types"}
+    @1	-	-	icmp	time-exceeded		{comment="Needed ICMP types"}
+?else
+?COMMENT Needed ICMP types (RFC4890)
+
+    @1	-		-	ipv6-icmp	destination-unreachable
+    @1	-		-	ipv6-icmp	packet-too-big
+    @1	-		-	ipv6-icmp	time-exceeded
+    @1	-		-	ipv6-icmp	parameter-problem
+
+# The following should have a ttl of 255 and must be allowed to transit a bridge
+    @1	-		-	ipv6-icmp	router-solicitation
+    @1	-		-	ipv6-icmp	router-advertisement
+    @1	-		-	ipv6-icmp	neighbour-solicitation
+    @1	-		-	ipv6-icmp	neighbour-advertisement
+    @1	-		-	ipv6-icmp	137	# Redirect
+    @1	-		-	ipv6-icmp	141	# Inverse neighbour discovery solicitation
+    @1	-		-	ipv6-icmp	142	# Inverse neighbour discovery advertisement
+
+# The following should have a link local source address and must be allowed to transit a bridge
+    @1	fe80::/10	-	ipv6-icmp	130	# Listener query
+    @1	fe80::/10	-	ipv6-icmp	131	# Listener report
+    @1	fe80::/10	-	ipv6-icmp	132	# Listener done
+    @1	fe80::/10	-	ipv6-icmp	143	# Listener report v2
+
+# The following should be received with a ttl of 255 and must be allowed to transit a bridge
+    @1	-		-	ipv6-icmp	148	# Certificate path solicitation
+    @1	-		-	ipv6-icmp	149	# Certificate path advertisement
+
+# The following should have a link local source address and a ttl of 1 and must be allowed to transit abridge
+    @1	fe80::/10	-	ipv6-icmp	151	# Multicast router advertisement
+    @1	fe80::/10	-	ipv6-icmp	152	# Multicast router solicitation
+    @1	fe80::/10	-	ipv6-icmp	153	# Multicast router termination
+?endif

Shorewall/Actions/action.Broadcast

@@ -20,7 +20,7 @@
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 #
-# Broadcast[([<action>|-[,{audit|-}])]
+# Broadcast[([<action>|[,{audit|-}])]
 #
 # Default action is DROP
 #
@@ -29,27 +29,37 @@
 DEFAULTS DROP,-
 
 ?if __ADDRTYPE
-@1	-	-	-	;; -m addrtype --dst-type BROADCAST
-@1	-	-	-	;; -m addrtype --dst-type ANYCAST
+    @1	-	-	-	;; -m addrtype --dst-type BROADCAST
+    @1	-	-	-	;; -m addrtype --dst-type ANYCAST
 ?else
-?begin perl;
+    ?begin perl;
 
-use Shorewall::IPAddrs;
-use Shorewall::Config;
-use Shorewall::Chains;
+    use strict;
+    use Shorewall::IPAddrs;
+    use Shorewall::Config;
+    use Shorewall::Chains;
 
-my ( $action )         = get_action_params( 1 );
-my $chainref           = get_action_chain;
-my ( $level, $tag )    = get_action_logging;
+    my ( $action, $audit ) = get_action_params( 2 );
+    my $chainref           = get_action_chain;
+    my ( $level, $tag )    = get_action_logging;
 
-add_commands $chainref, 'for address in $ALL_BCASTS; do';
-incr_cmd_level $chainref;
-log_rule_limit $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', ' -d $address ' if $level ne '';
-add_jump $chainref, $action, 0, "-d \$address ";
-decr_cmd_level $chainref;
-add_commands $chainref, 'done';
+    fatal_error "Invalid parameter to action Broadcast" if supplied $audit && $audit ne 'audit';
 
-1;
+    my $target             = require_audit ( $action , $audit );
 
-?end perl;
+    if ( $family == F_IPV4 ) {
+        add_commands $chainref, 'for address in $ALL_BCASTS; do';
+    } elsif ($family == F_IPV6 ) {
+        add_commands $chainref, 'for address in $ALL_ACASTS; do';
+    }
+
+    incr_cmd_level $chainref;
+    log_rule_limit $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', ' -d $address ' if $level ne '';
+    add_jump $chainref, $target, 0, "-d \$address ";
+    decr_cmd_level $chainref;
+    add_commands $chainref, 'done';
+
+    1;
+
+    ?end perl;
 ?endif

Shorewall/Actions/action.FIN

@@ -0,0 +1,33 @@
+#
+# Shorewall -- /usr/share/shorewall/action.FIN
+#
+# FIN Action
+#
+# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
+#
+# (c) 2012-2016 Tom Eastep (teastep@shorewall.net)
+#
+# Complete documentation is available at http://shorewall.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of Version 2 of the GNU General Public License
+# as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# FIN[([<action>])]
+#
+# Default action is ACCEPT
+#
+###############################################################################
+
+DEFAULTS ACCEPT,-
+
+@1	 -	-	;;+ -p 6 --tcp-flags ACK,FIN,PSH ACK,FIN,PSH

Shorewall/Actions/action.GlusterFS

@@ -13,9 +13,9 @@
 DEFAULTS 2,0
 
 ?if @1 !~ /^\d+/ || ! @1 || @1 > 1024
-    ?error Invalid value for Bricks (@1)
+    ?error Invalid value (@1) for the GlusterFS Bricks argument
 ?elsif @2 !~ /^[01]$/
-    ?error Invalid value for IB (@2)
+    ?error Invalid value (@2) for the GlusterFS IB argument
 ?endif
 
 #ACTION		SOURCE		DEST		PROTO	DPORT

Shorewall/Actions/action.Multicast

@@ -29,22 +29,28 @@
 DEFAULTS DROP,-
 
 ?if __ADDRTYPE
-@1	-	-	-	;; -m addrtype --dst-type MULTICAST
+    @1	-	-	-	;; -m addrtype --dst-type MULTICAST
 ?else
-?begin perl;
+    ?begin perl;
 
-use Shorewall::IPAddrs;
-use Shorewall::Config;
-use Shorewall::Chains;
+    use strict;
+    use Shorewall::IPAddrs;
+    use Shorewall::Config;
+    use Shorewall::Chains;
 
-my ( $action )         = get_action_params( 1 );
-my $chainref           = get_action_chain;
-my ( $level, $tag )    = get_action_logging;
+    my ( $action, $audit ) = get_action_params( 2 );
+    my $chainref           = get_action_chain;
+    my ( $level, $tag )    = get_action_logging;
 
-log_rule_limit $level, $chainref, 'Multicast' , $action, '', $tag, 'add', ' -d 224.0.0.0/4 ' if $level ne '';
-add_jump $chainref, $action, 0, '-d 224.0.0.0/4 ';
+    fatal_error "Invalid parameter to action Multicast" if supplied $audit && $audit ne 'audit';
 
-1;
+    my $target = require_audit ( $action , $audit );
+    my $dest   = ( $family == F_IPV4 ) ? join( ' ', '-d', IPv4_MULTICAST . ' ' ) : join( ' ', '-d', IPv6_MULTICAST . ' ' );
 
-?end perl;
+    log_rule_limit( $level, $chainref, 'Multicast' , $action, '', $tag, 'add', $dest ) if $level ne '';
+    add_jump $chainref, $target, 0, $dest;
+
+    1;
+
+    ?end perl;
 ?endif

Shorewall/Actions/action.dropBcasts

@@ -0,0 +1,39 @@
+#
+# Shorewall -- /usr/share/shorewall/action.dropBcasts
+#
+# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
+#
+# (c) 2017 Tom Eastep (teastep@shorewall.net)
+#
+# Complete documentation is available at http://shorewall.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of Version 2 of the GNU General Public License
+# as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# dropBcasts[([audit])]
+#
+###############################################################################
+
+DEFAULTS -
+
+?if passed(@1)
+    ?if @1 eq 'audit'
+	?require AUDIT_TARGET
+	Broadcast(A_DROP)
+    ?else
+	?error "Invalid argument (@1) to dropBcasts"
+    ?endif
+?else
+    Broadcast(DROP)
+?endif
+

Shorewall/Perl/Shorewall/Accounting.pm

@@ -195,7 +195,7 @@ sub process_accounting_rule1( $$$$$$$$$$$ ) {
     $ports  = ''    if $ports  eq 'any' || $ports  eq 'all';
     $sports = ''    if $sports eq 'any' || $sports eq 'all';
 
-    fatal_error "USER/GROUP may only be specified in the OUTPUT section" unless $user eq '-' || $asection == OUTPUT;
+    fatal_error "USER/GROUP may only be specified in the OUTPUT section" unless $user eq '-' || $asection == OUTPUT_SECTION;
 
     my $rule = do_proto( $proto, $ports, $sports ) . do_user ( $user ) . do_test ( $mark, $globals{TC_MASK} ) . do_headers( $headers );
     my $prerule = '';
@@ -266,7 +266,7 @@ sub process_accounting_rule1( $$$$$$$$$$$ ) {
     if ( $source eq 'any' || $source eq 'all' ) {
         $source = ALLIP;
     } else {
-	fatal_error "MAC addresses only allowed in the INPUT and FORWARD sections" if $source =~ /~/ && ( $asection == OUTPUT || ! $asection );
+	fatal_error "MAC addresses only allowed in the INPUT and FORWARD sections" if $source =~ /~/ && ( $asection == OUTPUT_SECTION || ! $asection );
     }
 
     if ( have_bridges && ! $asection ) {

Shorewall/Perl/Shorewall/Chains.pm

@@ -32,6 +32,7 @@ require Exporter;
 use Scalar::Util 'reftype';
 use Digest::SHA qw(sha1_hex);
 use File::Basename;
+use Socket;
 use Shorewall::Config qw(:DEFAULT :internal);
 use Shorewall::Zones;
 use Shorewall::IPAddrs;
@@ -137,6 +138,12 @@ our %EXPORT_TAGS = (
 				       ALL_COMMANDS
 				       NOT_RESTORE
 
+				       validate_port
+				       validate_portpair
+				       validate_portpair1
+				       validate_port_list
+				       expand_port_range
+
 				       PREROUTING
 				       INPUT
 				       FORWARD
@@ -405,14 +412,14 @@ our $VERSION = 'MODULEVERSION';
 #   Provider Chains for provider <p>
 #      Load Balance    - ~<p>
 #
-#   Zone-pair chains for rules chain <z12z2>
+#   Zone-pair chains for rules chain <z1-z2>
 #
-#      Syn Flood       - @<z12z2>
-#      Blacklist       - <z12z2>~
-#      Established     - ^<z12z2>
-#      Related         - +<z12z2>
-#      Invalid         - _<z12z2>
-#      Untracked       - &<z12z2>
+#      Syn Flood       - @<z1-z2>
+#      Blacklist       - <z1-z2>~
+#      Established     - ^<z1-z2>
+#      Related         - +<z1-z2>
+#      Invalid         - _<z1-z2>
+#      Untracked       - &<z1-z2>
 #
 our %chain_table;
 our $raw_table;
@@ -434,7 +441,7 @@ use constant { STANDARD     =>      0x1,       #defined by Netfilter
 	       REDIRECT     =>     0x20,       #'REDIRECT'
 	       ACTION       =>     0x40,       #An action (may be built-in)
 	       MACRO        =>     0x80,       #A Macro
-	       LOGRULE      =>    0x100,       #'LOG','NFLOG'
+	       LOGRULE      =>    0x100,       #'LOG','ULOG','NFLOG'
 	       NFQ          =>    0x200,       #'NFQUEUE'
 	       CHAIN        =>    0x400,       #Manual Chain
 	       SET          =>    0x800,       #SET
@@ -509,6 +516,7 @@ our $idiotcount1;
 our $hashlimitset;
 our $global_variables;
 our %address_variables;
+our %port_variables;
 our $ipset_rules;
 
 #
@@ -784,6 +792,7 @@ sub initialize( $$$ ) {
     %interfaceacasts    = ();
     %interfacegateways  = ();
     %address_variables  = ();
+    %port_variables     = ();
 
     $global_variables   = 0;
     $idiotcount         = 0;
@@ -819,6 +828,211 @@ sub initialize( $$$ ) {
     #
 }
 
+sub record_runtime_port( $ ) {
+    my ( $variable ) = @_;
+
+    if ( $variable =~ /^{([a-zA-Z_]\w*)}$/ ) {
+	fatal_error "Variable %variable is already used as an address variable" if $address_variables{$1};
+	$port_variables{$1} = 1;
+    } else {
+	fatal_error( "Invalid port variable (%$variable)" );
+    }
+
+    "\$$variable";
+}
+
+################################################################################
+# Functions moved from IPAddrs.pm in 5.1.5				       #
+################################################################################
+
+sub validate_port( $$ ) {
+    my ($proto, $port) = @_;
+
+    my $value;
+
+    if ( $port =~ /^(\d+)$/ || $port =~ /^0x/ ) {
+	$value = numeric_value $port;
+
+	if ( defined $value ) {
+	    if ( $value && $value <= 65535 ) {
+		return $value;
+	    } else {
+		$value = undef;
+	    }
+	}
+    } elsif ( $port =~ /^%(.*)/ ) {
+	$value = record_runtime_port( $1 );
+    } else {
+	$proto = proto_name $proto if $proto =~ /^(\d+)$/;
+	$value = getservbyname( $port, $proto );
+    }
+
+    return $value if defined $value;
+
+    fatal_error "The separator for a port range is ':', not '-' ($port)" if $port =~ /^\d+-\d+$/;
+
+    fatal_error "Invalid/Unknown $proto port/service ($_[1])" unless defined $value;
+}
+
+sub validate_portpair( $$ ) {
+    my ($proto, $portpair) = @_;
+    my $what;
+    my $pair = $portpair;
+    #
+    # Accept '-' as a port-range separator
+    #
+    $pair =~ tr/-/:/ if $pair =~ /^[-0-9]+$/;
+
+    fatal_error "Invalid port range ($portpair)" if $pair =~ tr/:/:/ > 1;
+
+    $pair = "0$pair"       if substr( $pair,  0, 1 ) eq ':';
+    $pair = "${pair}65535" if substr( $pair, -1, 1 ) eq ':';
+
+    my @ports = split /:/, $pair, 2;
+
+    my $protonum = resolve_proto( $proto ) || 0;
+
+    $_ = validate_port( $protonum, $_) for grep $_, @ports;
+
+    if ( @ports == 2 ) {
+	$what = 'port range';
+
+	unless ($ports[0] =~ /^\$/ || $ports[1] =~ /^\$/ ) {
+	    fatal_error "Invalid port range ($_[1])" unless $ports[0] < $ports[1];
+	}
+    } else {
+	$what = 'port';
+    }
+
+    fatal_error "Using a $what ( $_[1] ) requires PROTO TCP, UDP, UDPLITE, SCTP or DCCP" unless
+	defined $protonum && ( $protonum == TCP     ||
+			       $protonum == UDP     ||
+			       $protonum == UDPLITE ||
+			       $protonum == SCTP    ||
+			       $protonum == DCCP );
+    join ':', @ports;
+
+}
+
+sub validate_portpair1( $$ ) {
+    my ($proto, $portpair) = @_;
+    my $what;
+
+    fatal_error "Invalid port range ($portpair)" if $portpair =~ tr/-/-/ > 1;
+
+    $portpair = "1$portpair"       if substr( $portpair,  0, 1 ) eq ':';
+    $portpair = "${portpair}65535" if substr( $portpair, -1, 1 ) eq ':';
+
+    my @ports = split /-/, $portpair, 2;
+
+    my $protonum = resolve_proto( $proto ) || 0;
+
+    $_ = validate_port( $protonum, $_) for grep $_, @ports;
+
+    if ( @ports == 2 ) {
+	$what = 'port range';
+
+	unless ($ports[0] =~ /^\$/ || $ports[1] =~ /^\$/ ) {
+	    fatal_error "Invalid port range ($portpair)" unless $ports[0] && $ports[0] < $ports[1];
+	}
+    } else {
+	$what = 'port';
+	fatal_error 'Invalid port number (0)' unless $portpair;
+    }
+
+    fatal_error "Using a $what ( $portpair ) requires PROTO TCP, UDP, SCTP or DCCP" unless
+	defined $protonum && ( $protonum == TCP  ||
+			       $protonum == UDP  ||
+			       $protonum == SCTP ||
+			       $protonum == DCCP );
+    join '-', @ports;
+
+}
+
+sub validate_port_list( $$ ) {
+    my $result = '';
+    my ( $proto, $list ) = @_;
+    my @list   = split_list( $list, 'port' );
+
+    if ( @list > 1 && $list =~ /[:-]/ ) {
+	require_capability( 'XMULTIPORT' , 'Port ranges in a port list', '' );
+    }
+
+    $proto = proto_name $proto;
+
+    for ( @list ) {
+	my $value = validate_portpair( $proto , $_ );
+	$result = $result ? join ',', $result, $value : $value;
+    }
+
+    $result;
+}
+
+#
+# Expands a port range into a minimal list of ( port, mask ) pairs.
+# Each port and mask are expressed as 4 hex nibbles without a leading '0x'.
+#
+# Example:
+#
+#       DB<3> @foo = Shorewall::IPAddrs::expand_port_range( 6, '110:' ); print "@foo\n"
+#       006e fffe 0070 fff0 0080 ff80 0100 ff00 0200 fe00 0400 fc00 0800 f800 1000 f000 2000 e000 4000 c000 8000 8000
+#
+sub expand_port_range( $$ ) {
+    my ( $proto, $range ) = @_;
+
+    if ( $range =~ /^(.*):(.*)$/ ) {
+	my ( $first, $last ) = ( $1, $2);
+	my @result;
+
+	fatal_error "Invalid port range ($range)" unless $first ne '' or $last ne '';
+	#
+	# Supply missing first/last port number
+	#
+	$first = 0     if $first eq '';
+	$last  = 65535 if $last eq '';
+	#
+	# Validate the ports
+	#
+	( $first , $last ) = ( validate_port( $proto, $first || 1 ) , validate_port( $proto, $last ) );
+
+	$last++; #Increment last address for limit testing.
+	#
+	# Break the range into groups:
+	#
+	#      - If the first port in the remaining range is odd, then the next group is ( <first>, ffff ).
+	#      - Otherwise, find the largest power of two P that divides the first address such that
+	#        the remaining range has less than or equal to P ports. The next group is
+	#        ( <first> , ~( P-1 ) ).
+	#
+	while ( ( my $ports = ( $last - $first ) ) > 0 ) {
+	    my $mask = 0xffff;         #Mask for current ports in group.
+	    my $y    = 2;              #Next power of two to test
+	    my $z    = 1;              #Number of ports in current group (Previous value of $y).
+
+	    while ( ( ! ( $first % $y ) ) && ( $y <= $ports ) ) {
+		$mask <<= 1;
+		$z  = $y;
+		$y <<= 1;
+	    }
+	    #
+	    #
+	    push @result, sprintf( '%04x', $first ) , sprintf( '%04x' , $mask & 0xffff );
+	    $first += $z;
+	}
+
+	fatal_error "Invalid port range ($range)" unless @result; # first port > last port
+
+	@result;
+
+    } else {
+	( sprintf( '%04x' , validate_port( $proto, $range ) ) , 'ffff' );
+    }
+}
+
+################################################################################
+# End functions moved from IPAddrs.pm in 5.1.5				       #
+################################################################################
+
 #
 # Functions to manipulate cmdlevel
 #
@@ -1081,11 +1295,11 @@ sub format_option( $$ ) {
 
     assert( ! reftype $value );
 
-    my $rule = '';
+    my $rule;
 
     $value =~ s/\s*$//;
 
-    $rule .= join( ' ' , ' -m', $option, $value );
+    $rule = join( ' ' , ' -m', $option, $value );
 
     $rule;
 }
@@ -3686,6 +3900,12 @@ sub optimize_level8( $$$ ) {
 		    }
 
 		    $combined{ $chainref1->{name} } = $chainref->{name};
+
+		    if ( $chainref->{policychain} ) {
+			@{$chainref1}{qw(policychain policy)} = @{$chainref}{qw(policychain policy)} unless $chainref1->{policychain};
+		    } elsif ( $chainref1->{policychain} ) {
+			@{$chainref}{qw(policychain policy)} = @{$chainref1}{qw(policychain policy)} unless $chainref->{policychain};
+		    }
 		}
 	    }
 	}
@@ -5758,6 +5978,7 @@ sub record_runtime_address( $$;$$ ) {
 
     if ( $interface =~ /^{([a-zA-Z_]\w*)}$/ ) {
 	fatal_error "Mixed required/optional usage of address variable $1" if ( $address_variables{$1} || $addrtype ) ne $addrtype;
+	fatal_error "Variable %variable is already used as a port variable" if $port_variables{$1};
 	$address_variables{$1} = $addrtype;
 	return '$' . "$1 ";
     }
@@ -6103,7 +6324,7 @@ sub match_dest_net( $;$ ) {
 	return '-d ' . record_runtime_address $1, $2;
     }
 
-    $net = validate_net $net, 1;
+    $net = validate_net $net, 1 unless $net =~ /^\$/; # Don't validate if runtime address variable
     $net eq ALLIP ? '' : "-d $net ";
 }
 
@@ -6184,7 +6405,7 @@ sub imatch_dest_net( $;$ ) {
 	return ( d => record_runtime_address( $1, $2, 1 ) );
     }
 
-    $net = validate_net $net, 1;
+    $net = validate_net $net, 1 unless $net =~ /^\$/; # Don't validate if runtime address variable
     $net eq ALLIP ? () : ( d =>  $net );
 }
 
@@ -7045,6 +7266,19 @@ sub verify_address_variables() {
 	      qq(    startup_error "Invalid value ($address) for address variable $variable"),
 	      qq(fi\n) );
     }
+
+    for my $variable( keys %port_variables ) {
+	my $port = "\$$variable";
+	my $type = $port_variables{$variable};
+
+	emit( qq(if [ -z "$port" ]; then) ,
+	      qq(    $variable=255) ,
+	      qq(elif qt \$g_tool -A INPUT -p 6 --dport $port; then) ,
+	      qq(    qt \$g_tool -D INPUT -p 6 --dport $variable) ,
+	      qq(else) ,
+	      qq(    startup_error "Invalid valid ($port) for port variable $variable") ,
+	      qq(fi\n) );
+    }
 }
 
 #
@@ -7294,6 +7528,11 @@ sub isolate_dest_interface( $$$$ ) {
 
 	    $rule .= "-d $variable ";
 	}
+    } elsif ( $dest =~ /^\$/ ) {
+	#
+	# Runtime address variable
+	#
+	$dnets  = $dest;
     } elsif ( $family == F_IPV4 ) {
 	if ( $dest =~ /^(.+?):(.+)$/ ) {
 	    $diface = $1;
@@ -8674,9 +8913,15 @@ sub create_netfilter_load( $ ) {
     my $UTILITY = $family == F_IPV4 ? 'IPTABLES_RESTORE' : 'IP6TABLES_RESTORE';
 
     emit( '',
-	  'if [ "$COMMAND" = reload -a -n "$g_counters" ] && chain_exists $g_sha1sum1 && chain_exists $g_sha1sum2 ; then',
-	  '    option="--counters"',
-	  '',
+	  'if [ "$COMMAND" = reload -a -n "$g_counters" ] && chain_exists $g_sha1sum1 && chain_exists $g_sha1sum2 ; then' );
+
+    if ( have_capability( 'RESTORE_WAIT_OPTION' ) ) {
+	emit( '    option="--counters --wait "' . $config{MUTEX_TIMEOUT} );
+    } else {
+	emit( '    option="--counters"' );
+    }
+
+    emit( '',
 	  '    progress_message "Reusing existing ruleset..."',
 	  '',
 	  'else'
@@ -8684,7 +8929,11 @@ sub create_netfilter_load( $ ) {
 
     push_indent;
 
-    emit 'option=';
+    if ( have_capability( 'RESTORE_WAIT_OPTION' ) ) {
+	emit 'option="--wait "' . $config{MUTEX_TIMEOUT};
+    } else {
+	emit 'option=';
+    }
 
     save_progress_message "Preparing $utility input...";
 
@@ -9099,7 +9348,11 @@ sub create_stop_load( $ ) {
 
     enter_cmd_mode;
 
-    emit( '[ -n "$g_debug_iptables" ] && command=debug_restore_input || command=$' . $UTILITY );
+    if ( have_capability( 'RESTORE_WAIT_OPTION' ) ) {
+	emit( '[ -n "$g_debug_iptables" ] && command=debug_restore_input || command="$' . $UTILITY . ' --wait ' . $config{MUTEX_TIMEOUT} . '"' );
+    } else {
+	emit( '[ -n "$g_debug_iptables" ] && command=debug_restore_input || command=$' . $UTILITY );
+    }
 
     emit( '',
 	  'progress_message2 "Running $command..."',

Shorewall/Perl/Shorewall/Compiler.pm

@@ -109,7 +109,7 @@ sub generate_script_1( $ ) {
 ################################################################################
 EOF
 
-    for my $exit ( qw/init start tcclear started stop stopped clear refresh refreshed restored/ ) {
+    for my $exit ( qw/init start tcclear started stop stopped clear refresh refreshed restored enabled disabled/ ) {
 	emit "\nrun_${exit}_exit() {";
 	push_indent;
 	append_file $exit or emit 'true';
@@ -209,6 +209,8 @@ sub generate_script_2() {
     emit (   '[ -f ${g_confdir}/vardir ] && . ${g_confdir}/vardir' );
     emit ( qq([ -n "\${VARDIR:=$shorewallrc1{VARDIR}}" ]) );
     emit ( qq([ -n "\${VARLIB:=$shorewallrc1{VARLIB}}" ]) );
+    emit ( qq([ -n "\${CONFDIR:=$shorewallrc1{CONFDIR}}" ]) );
+    emit ( qq([ -n "\${SHAREDIR:=$shorewallrc1{SHAREDIR}}" ]) );
 
     emit 'TEMPFILE=';
 

Shorewall/Perl/Shorewall/Config.pm

@@ -86,6 +86,9 @@ our @EXPORT = qw(
 		 kernel_version
 
                  compiletime
+				       
+		 F_IPV4
+		 F_IPV6
                 );
 
 our @EXPORT_OK = qw( $shorewall_dir initialize shorewall);
@@ -196,9 +199,6 @@ our %EXPORT_TAGS = ( internal => [ qw( create_temp_script
 
                                        PARMSMODIFIED
                                        USEDCALLER
-				       
-		                       F_IPV4
-		                       F_IPV6
 
 				       TCP
 				       UDP
@@ -413,7 +413,9 @@ our %capdesc = ( NAT_ENABLED     => 'NAT',
                  WAIT_OPTION     => 'iptables --wait option',
                  CPU_FANOUT      => 'NFQUEUE CPU Fanout',
                  NETMAP_TARGET   => 'NETMAP Target',
-
+                 NFLOG_SIZE      => '--nflog-size support',
+		 RESTORE_WAIT_OPTION
+				 => 'iptables-restore --wait option',
 		 AMANDA_HELPER   => 'Amanda Helper',
 		 FTP_HELPER      => 'FTP Helper',
 		 FTP0_HELPER     => 'FTP-0 Helper',
@@ -488,53 +490,55 @@ our %helpers_aliases;
 our %helpers_enabled;
 
 our %config_files = ( #accounting      => 1,
-		      actions          => 1,
-		      blacklist        => 1,
-		      clear            => 1,
-		      conntrack        => 1,
-		      ecn              => 1,
-		      findgw           => 1,
-		      hosts            => 1,
-		      init             => 1,
-		      initdone         => 1,
+		      actions	       => 1,
+		      blacklist	       => 1,
+		      clear	       => 1,
+		      conntrack	       => 1,
+		      ecn	       => 1,
+		      findgw	       => 1,
+		      hosts	       => 1,
+		      init	       => 1,
+		      initdone	       => 1,
 		      interfaces       => 1,
-		      isusable         => 1,
-		      maclist          => 1,
-		      masq             => 1,
-		      nat              => 1,
-		      netmap           => 1,
-		      params           => 1,
-		      policy           => 1,
-		      providers        => 1,
-		      proxyarp         => 1,
-		      refresh          => 1,
-		      refreshed        => 1,
-		      restored         => 1,
-		      rawnat           => 1,
+		      isusable	       => 1,
+		      maclist	       => 1,
+		      mangle	       => 1,
+		      masq	       => 1,
+		      nat	       => 1,
+		      netmap	       => 1,
+		      params	       => 1,
+		      policy	       => 1,
+		      providers	       => 1,
+		      proxyarp	       => 1,
+		      refresh	       => 1,
+		      refreshed	       => 1,
+		      restored	       => 1,
+		      rawnat	       => 1,
 		      route_rules      => 1,
-		      routes           => 1,
+		      routes	       => 1,
 		      routestopped     => 1,
-		      rtrules          => 1,
-		      rules            => 1,
-		      scfilter         => 1,
-		      secmarks         => 1,
-		      start            => 1,
-		      started          => 1,
-		      stop             => 1,
-		      stopped          => 1,
+		      rtrules	       => 1,
+		      rules	       => 1,
+		      scfilter	       => 1,
+		      secmarks	       => 1,
+		      snat	       => 1,
+		      start	       => 1,
+		      started	       => 1,
+		      stop	       => 1,
+		      stopped	       => 1,
 		      stoppedrules     => 1,
-		      tcclasses        => 1,
-		      tcclear          => 1,
-		      tcdevices        => 1,
-		      tcfilters        => 1,
+		      tcclasses	       => 1,
+		      tcclear	       => 1,
+		      tcdevices	       => 1,
+		      tcfilters	       => 1,
 		      tcinterfaces     => 1,
-		      tcpri            => 1,
-		      tcrules          => 1,
-		      tos              => 1,
-		      tunnels          => 1,
-		      zones            => 1 );
+		      tcpri	       => 1,
+		      tcrules	       => 1,
+		      tos	       => 1,
+		      tunnels	       => 1,
+		      zones	       => 1 );
 #
-# Options that involve the the AUDIT target
+# Options that involve the AUDIT target
 #
 our @auditoptions = qw( BLACKLIST_DISPOSITION MACLIST_DISPOSITION TCP_FLAGS_DISPOSITION );
 #
@@ -748,8 +752,8 @@ sub initialize( $;$$) {
 		    TC_SCRIPT               => '',
 		    EXPORT                  => 0,
 		    KLUDGEFREE              => '',
-		    VERSION                 => "5.1.3",
-		    CAPVERSION              => 50100 ,
+		    VERSION                 => "5.1.5-RC1",
+		    CAPVERSION              => 50106 ,
 		    BLACKLIST_LOG_TAG       => '',
 		    RELATED_LOG_TAG         => '',
 		    MACLIST_LOG_TAG         => '',
@@ -907,6 +911,8 @@ sub initialize( $;$$) {
 	  ZERO_MARKS => undef ,
 	  FIREWALL => undef ,
 	  BALANCE_PROVIDERS => undef ,
+	  PERL_HASH_SEED => undef ,
+	  USE_NFLOG_SIZE => undef ,
 	  #
 	  # Packet Disposition
 	  #
@@ -1040,6 +1046,8 @@ sub initialize( $;$$) {
 	       WAIT_OPTION => undef,
 	       CPU_FANOUT => undef,
 	       NETMAP_TARGET => undef,
+	       NFLOG_SIZE => undef,
+	       RESTORE_WAIT_OPTION => undef,
 
 	       AMANDA_HELPER => undef,
 	       FTP_HELPER => undef,
@@ -1092,7 +1100,7 @@ sub initialize( $;$$) {
 
     %compiler_params = ();
 
-    %actparams = ( 0 => 0, loglevel => '', logtag => '', chain => '', disposition => '', caller => ''  );
+    %actparams = ( 0 => 0, loglevel => '', logtag => '', chain => '', disposition => '', caller => '', callfile => '', callline => ''  );
     $parmsmodified = 0;
     $usedcaller    = 0;
     %ipsets = ();
@@ -1165,7 +1173,7 @@ sub initialize( $;$$) {
     #
     # Process the global shorewallrc file
     #
-    #   Note: The build file executes this function passing only the protocol family
+    #   Note: The build script calls this function passing only the protocol family
     #
     process_shorewallrc( $shorewallrc,
 			 $family == F_IPV4 ? 'shorewall' : 'shorewall6'
@@ -1216,10 +1224,9 @@ sub compiletime() {
 # Create 'currentlineinfo'
 #
 sub currentlineinfo() {
-    my $linenumber = $currentlinenumber || 1;
-
-    if ( $currentfile ) {
-	my $lineinfo = " $currentfilename ";
+    if ( $currentfilename ) {
+	my $linenumber = $currentlinenumber || 1;
+	my $lineinfo   = " $currentfilename ";
 	
 	if ( $linenumber eq 'EOF' ) {
 	    $lineinfo .= '(EOF)'
@@ -2177,7 +2184,7 @@ sub split_list3( $$ ) {
 	    $element = join ',', $element , $_;
 	}
     }
-    
+
     unless ( $opencount == 0 ) {
 	fatal_error "Invalid $type ($list)";
     }
@@ -2232,7 +2239,7 @@ sub split_list4( $ ) {
 sub split_columns( $ ) {
     my ($list) = @_;
 
-    return split ' ', $list unless $list =~ /\(/;
+    return split ' ', $list unless $list =~ /[()]/;
 
     my @list1 = split ' ', $list;
     my @list2;
@@ -2273,9 +2280,7 @@ sub split_columns( $ ) {
 	}
     }
 
-    unless ( $opencount == 0 ) {
-	fatal_error "Mismatched parentheses ($list)";
-    }
+    fatal_error "Mismatched parentheses ($list)" unless $opencount == 0;
 
     @list2;
 }
@@ -2288,7 +2293,7 @@ sub clear_comment();
 #    ensure that it has an appropriate number of columns.
 #    supply '-' in omitted trailing columns.
 #    Handles all of the supported forms of column/pair specification
-#    Handles segragating raw iptables input in INLINE rules
+#    Handles segragating raw iptables input in rules
 #
 sub split_line2( $$;$$$ ) {
     my ( $description, $columnsref, $nopad, $maxcolumns, $inline ) = @_;
@@ -2341,7 +2346,7 @@ sub split_line2( $$;$$$ ) {
 
 	    $inline_matches = $pairs;
 
-	    if ( $columns =~ /^(\s*|.*[^&@%]){(.*)}\s*$/ ) {
+	    if ( $columns =~ /^(\s*|.*[^&@%])\{(.*)\}\s*$/ ) {
 		#
 		# Pairs are enclosed in curly brackets.
 		#
@@ -2357,7 +2362,7 @@ sub split_line2( $$;$$$ ) {
 	    if ( $currline =~ /^\s*INLINE(?:\(.*\)(:.*)?|:.*)?\s/ || $currline =~ /^\s*IP6?TABLES(?:\(.*\)|:.*)?\s/ ) {
 		$inline_matches = $pairs;
 
-		if ( $columns =~ /^(\s*|.*[^&@%]){(.*)}\s*$/ ) {
+		if ( $columns =~ /^(\s*|.*[^&@%])\{(.*)\}\s*$/ ) {
 		    #
 		    # Pairs are enclosed in curly brackets.
 		    #
@@ -2371,7 +2376,7 @@ sub split_line2( $$;$$$ ) {
 	} elsif ( $checkinline ) {
 	    warning_message "This entry needs to be changed before INLINE_MATCHES can be set to Yes";
 	}
-    } elsif ( $currline =~ /^(\s*|.*[^&@%]){(.*)}$/ ) {
+    } elsif ( $currline =~ /^(\s*|.*[^&@%])\{(.*)\}$/ ) {
 	#
 	# Pairs are enclosed in curly brackets.
 	#
@@ -2437,12 +2442,12 @@ sub split_line2( $$;$$$ ) {
 		}
 	    } else {
 		fatal_error "Unknown column ($1)" unless exists $columnsref->{$column};
-		$column = $columnsref->{$column};
-		fatal_error "Non-ASCII gunk in file" if $columns =~ /[^\s[:print:]]/;
 		$value = $1 if $value =~ /^"([^"]+)"$/;
 		$value =~ s/\\"/"/g;
-		fatal_error "Non-ASCII gunk in the value of the $column column" if $columns =~ /[^\s[:print:]]/;
-		$line[$column] = $value;
+		fatal_error "Non-ASCII gunk in the value of the $column column" if $value =~ /[^\s[:print:]]/;
+		my $colnum = $columnsref->{$column};
+		warning_message qq(Replacing "$line[$colnum]" with "$value" in the ) . uc( $column ) . ' column' if $line[$colnum] ne '-';
+		$line[$colnum] = $value;
 	    }
 	}
     }
@@ -2782,7 +2787,7 @@ sub evaluate_expression( $$$$ ) {
 	    my ( $first, $var, $rest ) = ( $1, $3, $4);
 	    $var = numeric_value( $var ) if $var =~ /^\d/;
 	    $val = $var ? $actparams{$var} : $chain;
-	    $usedcaller = USEDCALLER if $var eq 'caller';
+	    $usedcaller = USEDCALLER if $var =~ /^(?:caller|callfile|callline)$/;
 	    $expression = join_parts( $first, $val, $rest , $just_expand );
 	    directive_error( "Variable Expansion Loop" , $filename, $linenumber ) if ++$count > 100;
 	}
@@ -2818,7 +2823,6 @@ sub evaluate_expression( $$$$ ) {
 	#
 	# Not a simple one-term expression -- compile it
 	#
-
 	declare_passed unless $evals++;
 
 	$val = eval qq(package Shorewall::User;
@@ -2835,6 +2839,7 @@ sub evaluate_expression( $$$$ ) {
     $val;
 }
 
+sub pop_open();
 #
 # Set callback
 #
@@ -2842,6 +2847,40 @@ sub directive_callback( $ ) {
     $directive_callback = shift;
 }
 
+sub directive_message( \&$$$$ ) {
+    my ( $functptr, $verbose, $expression, $filename, $linenumber ) = @_;
+
+    unless ( $omitting ) {
+	if ( $actparams{0} ) {
+	    #
+	    # When issuing a message from an action, report the action invocation
+	    # site rather than the action file and line number.
+	    #
+	    # Avoid double-reporting by temporarily removing the invocation site
+	    # from the open stack.
+	    #
+	    my $saveopens = pop @openstack;
+
+	    $functptr->( $verbose ,
+			 evaluate_expression( $expression ,
+					      $filename ,
+					      $linenumber ,
+					      1 ),
+			 $actparams{callfile} ,
+			 $actparams{callline} );
+	    push @openstack, $saveopens;
+	} else {
+	    $functptr->( $verbose ,
+			 evaluate_expression( $expression ,
+					      $filename ,
+					      $linenumber ,
+					      1 ),
+			 $filename ,
+			 $linenumber );
+	}
+    }
+}
+
 #
 # Each entry in @ifstack consists of a 4-tupple
 #
@@ -2855,7 +2894,8 @@ sub process_compiler_directive( $$$$ ) {
 
     print "CD===> $line\n" if $debug;
 
-    directive_error( "Invalid compiler directive ($line)" , $filename, $linenumber ) unless $line =~ /^\s*\?(IF\s+|ELSE|ELSIF\s+|ENDIF|SET\s+|RESET\s+|FORMAT\s+|COMMENT\s*|ERROR\s+|WARNING\s+|INFO\s+|WARNING!\s+|INFO!\s+|REQUIRE\s+)(.*)$/i;
+    directive_error( "Invalid compiler directive ($line)" , $filename, $linenumber )
+	unless $line =~ /^\s*\?(IF\s+|ELSE|ELSIF\s+|ENDIF|SET\s+|RESET\s+|FORMAT\s+|COMMENT\s*|ERROR\s+|WARNING\s+|INFO\s+|WARNING!\s+|INFO!\s+|REQUIRE\s+)(.*)$/i;
 
     my ($keyword, $expression) = ( uc $1, $2 );
 
@@ -2957,15 +2997,16 @@ sub process_compiler_directive( $$$$ ) {
 		      $var = $2 || 'chain';
 		      directive_error( "Shorewall variables may only be RESET in the body of an action", $filename, $linenumber ) unless $actparams{0};
 		      if ( exists $actparams{$var} ) {
-			  if ( $var =~ /^loglevel|logtag|chain|disposition|caller$/ ) {
+			  if ( $var =~ /^(?:loglevel|logtag|chain|disposition|caller|callfile|callline)$/ ) {
 			      $actparams{$var} = '';
 			  } else {
 			      delete $actparams{$var}
 			  }
+
+			  $parmsmodified = PARMSMODIFIED if @ifstack > $ifstack;
 		      } else {
 			  directive_warning( 'Yes', "Shorewall variable $2 does not exist", $filename, $linenumber );
 		      }
-
 		  } else {
 		      if ( exists $variables{$2} ) {
 			  delete $variables{$2};
@@ -2996,68 +3037,85 @@ sub process_compiler_directive( $$$$ ) {
 
 	  ERROR => sub() {
 	      unless ( $omitting ) {
-		  directive_error( evaluate_expression( $expression ,
-							$filename ,
-							$linenumber ,
-							1 ) ,
-				   $filename ,
-				   $linenumber ) unless $omitting;
+		  if ( $actparams{0} ) {
+		      close $currentfile;
+		      #
+		      # Avoid 'missing ?ENDIF' error in pop_open'
+		      #
+		      @ifstack = ();
+		      #
+		      # Avoid double-reporting the action invocation site
+		      #
+		      pop_open;
+
+		      directive_error( evaluate_expression( $expression ,
+							    $filename ,
+							    $linenumber ,
+							    1 ) ,
+				       $actparams{callfile} ,
+				       $actparams{callline} );
+		  } else {
+		      directive_error( evaluate_expression( $expression ,
+							    $filename ,
+							    $linenumber ,
+							    1 ) ,
+				       $filename ,
+				       $linenumber ) unless $omitting;
+		  }
 	      }
 	  } ,
 
 	  WARNING => sub() {
-	      unless ( $omitting ) {
-		  directive_warning( $config{VERBOSE_MESSAGES} ,
-				     evaluate_expression( $expression ,
-							  $filename ,
-							  $linenumber ,
-							  1 ),
-				     $filename ,
-				     $linenumber ) unless $omitting;
-	      }
+	      directive_message( &directive_warning ,
+				 $config{VERBOSE_MESSAGES},
+				 $expression ,
+				 $filename ,
+				 $linenumber );
 	  } ,
 
 	  INFO => sub() {
-	      unless ( $omitting ) {
-		  directive_info( $config{VERBOSE_MESSAGES} ,
-				  evaluate_expression( $expression ,
-						       $filename ,
-						       $linenumber ,
-						       1 ),
-				  $filename ,
-				  $linenumber ) unless $omitting;
-	      }
+	      directive_message( &directive_info,
+				 $config{VERBOSE_MESSAGES} ,
+				 $expression ,
+				 $filename ,
+				 $linenumber );
 	  } ,
 
 	  'WARNING!' => sub() {
-	      unless ( $omitting ) {
-		  directive_warning( ! $config{VERBOSE_MESSAGES} ,
-				     evaluate_expression( $expression ,
-							  $filename ,
-							  $linenumber ,
-							  1 ),
-				     $filename ,
-				     $linenumber ) unless $omitting;
-	      }
+	      directive_message( &directive_warning ,
+				 ! $config{VERBOSE_MESSAGES} ,
+				 $expression ,
+				 $filename ,
+				 $linenumber );
 	  } ,
 
 	  'INFO!' => sub() {
-	      unless ( $omitting ) {
-		  directive_info( ! $config{VERBOSE_MESSAGES} ,
-				  evaluate_expression( $expression ,
-						       $filename ,
-						       $linenumber ,
-						       1 ),
-				  $filename ,
-				  $linenumber ) unless $omitting;
-	      }
+	      directive_message( &directive_info ,
+				 ! $config{VERBOSE_MESSAGES} ,
+				 $expression ,
+				 $filename ,
+				 $linenumber );
 	  } ,
 
 	  REQUIRE => sub() {
 	      unless ( $omitting ) {
 		  fatal_error "?REQUIRE may only be used within action files" unless $actparams{0};
-		  fatal_error "Unknown capability ($expression)" unless $capdesc{$expression};
-		  require_capability( $expression, "The $actparams{action} action", 's' );
+		  fatal_error "Unknown capability ($expression)" unless ( my $capdesc = $capdesc{$expression} );
+		  unless ( have_capability( $expression ) ) {
+		      close $currentfile;
+		      #
+		      # Avoid 'missing ?ENDIF' error in pop_open'
+		      #
+		      @ifstack = ();
+		      #
+		      # Avoid double-reporting the action call site
+		      #
+		      pop_open;
+
+		      directive_error( "The $actparams{action} action requires the $capdesc capability",
+				       $actparams{callfile} ,
+				       $actparams{callline} );
+		  }
 	      }
 	  } ,
 
@@ -3559,6 +3617,8 @@ sub push_action_params( $$$$$$ ) {
     $actparams{loglevel}    = $loglevel;
     $actparams{logtag}      = $logtag;
     $actparams{caller}      = $caller;
+    $actparams{callfile}    = $currentfilename;
+    $actparams{callline}    = $currentlinenumber;
     $actparams{disposition} = '' if $chainref->{action};
     #
     # The Shorewall variable '@chain' has non-word characters other than hyphen removed
@@ -3991,7 +4051,7 @@ sub make_mask( $ ) {
     0xffffffff >> ( 32 - $_[0] );
 }
 
-my @suffixes = qw(group range threshold nlgroup cprange qthreshold);
+my @suffixes;
 
 #
 # Validate a log level -- Drop the trailing '!' and translate to numeric value if appropriate"
@@ -4763,6 +4823,10 @@ sub NFLog_Target() {
     qt1( "$iptables $iptablesw -A $sillyname -j NFLOG" );
 }
 
+sub NFLog_Size() {
+    have_capability( 'NFLOG_TARGET' ) && qt1( "$iptables $iptablesw -A $sillyname -j NFLOG --nflog-size 64" );
+}
+
 sub Logmark_Target() {
     qt1( "$iptables $iptablesw -A $sillyname -j LOGMARK" );
 }
@@ -4886,6 +4950,10 @@ sub Cpu_Fanout() {
     have_capability( 'NFQUEUE_TARGET' ) && qt1( "$iptables -A $sillyname -j NFQUEUE --queue-balance 0:3 --queue-cpu-fanout" );
 }
 
+sub Restore_Wait_Option() {
+    length( `${iptables}-restore --wait < /dev/null 2>&1` ) == 0;
+}
+
 our %detect_capability =
     ( ACCOUNT_TARGET =>\&Account_Target,
       AMANDA_HELPER => \&Amanda_Helper,
@@ -4938,6 +5006,7 @@ our %detect_capability =
       LOG_TARGET => \&Log_Target,
       ULOG_TARGET => \&Ulog_Target,
       NFLOG_TARGET => \&NFLog_Target,
+      NFLOG_SIZE => \&NFLog_Size,
       MANGLE_ENABLED => \&Mangle_Enabled,
       MANGLE_FORWARD => \&Mangle_Forward,
       MARK => \&Mark,
@@ -4965,6 +5034,7 @@ our %detect_capability =
       REALM_MATCH => \&Realm_Match,
       REAP_OPTION => \&Reap_Option,
       RECENT_MATCH => \&Recent_Match,
+      RESTORE_WAIT_OPTION => \&Restore_Wait_Option,
       RPFILTER_MATCH => \&RPFilter_Match,
       SANE_HELPER => \&SANE_Helper,
       SANE0_HELPER => \&SANE0_Helper,
@@ -5131,6 +5201,9 @@ sub determine_capabilities() {
 	$capabilities{TCPMSS_TARGET}   = detect_capability( 'TCPMSS_TARGET' );
 	$capabilities{CPU_FANOUT}      = detect_capability( 'CPU_FANOUT' );
 	$capabilities{NETMAP_TARGET}   = detect_capability( 'NETMAP_TARGET' );
+	$capabilities{NFLOG_SIZE}      = detect_capability( 'NFLOG_SIZE' );
+	$capabilities{RESTORE_WAIT_OPTION}
+				       = detect_capability( 'RESTORE_WAIT_OPTION' );
 
 	unless ( have_capability 'CT_TARGET' ) {
 	    $capabilities{HELPER_MATCH} = detect_capability 'HELPER_MATCH';
@@ -5308,11 +5381,11 @@ sub update_config_file( $ ) {
 	update_default( 'BALANCE_PROVIDERS', 'Yes' );
     }
 
-    update_default( 'EXPORTMODULES',     'No' );
-    update_default( 'RESTART',           'reload' );
-    update_default( 'PAGER',             $shorewallrc1{DEFAULT_PAGER} );
-    update_default( 'LOGFORMAT',         'Shorewall:%s:%s:' );
-    update_default( 'LOGLIMIT',          '' );
+    update_default( 'EXPORTMODULES',         'No' );
+    update_default( 'RESTART',               'reload' );
+    update_default( 'PAGER',                 $shorewallrc1{DEFAULT_PAGER} );
+    update_default( 'LOGFORMAT',             'Shorewall:%s:%s:' );
+    update_default( 'LOGLIMIT',              '' );
 
     if ( $family == F_IPV4 ) {
 	update_default( 'BLACKLIST_DEFAULT', 'dropBcasts,dropNotSyn,dropInvalid' );
@@ -6338,6 +6411,17 @@ sub get_configuration( $$$$ ) {
     default_yes_no 'AUTOMAKE'                   , '';
     default_yes_no 'TRACK_PROVIDERS'            , '';
     default_yes_no 'BALANCE_PROVIDERS'          , $config{USE_DEFAULT_RT} ? 'Yes' : '';
+    default_yes_no 'USE_NFLOG_SIZE'             , '';
+
+    if ( $config{USE_NFLOG_SIZE} ) {
+	if ( have_capability( 'NFLOG_SIZE' ) ) {
+	    @suffixes = qw(group size threshold nlgroup cprange qthreshold);
+	} else {
+	    fatal_error "USE_NFLOG_SIZE=Yes, but the --nflog-size capabiity is not present";
+	}
+    } else {
+	@suffixes = qw(group range threshold nlgroup cprange qthreshold);
+    }
 
     unless ( ( $config{NULL_ROUTE_RFC1918} || '' ) =~ /^(?:blackhole|unreachable|prohibit)$/ ) {
 	default_yes_no( 'NULL_ROUTE_RFC1918', '' );
@@ -6758,6 +6842,12 @@ sub get_configuration( $$$$ ) {
 	}
     }
 
+    if ( supplied( $val = $config{MUTEX_TIMEOUT} ) ) {
+	fatal_error "Invalid value ($val) for MUTEX_TIMEOUT" unless $val && $val =~ /^\d+$/;
+    } else {
+	$config{MUTEX_TIMEOUT} = 60;
+    }
+
     add_variables %config;
 
     while ( my ($var, $val ) = each %renamed ) {

Shorewall/Perl/Shorewall/IPAddrs.pm

@@ -63,7 +63,6 @@ our @EXPORT = ( qw( ALLIPv4
 		  validate_host
 		  validate_range
 		  ip_range_explicit
-		  expand_port_range
 		  allipv4
 		  allipv6
 		  allip
@@ -74,10 +73,6 @@ our @EXPORT = ( qw( ALLIPv4
 		  resolve_proto
 		  resolve_dnsname
 		  proto_name
-		  validate_port
-		  validate_portpair
-		  validate_portpair1
-		  validate_port_list
 		  validate_icmp
 		  validate_icmp6
 		 ) );
@@ -411,114 +406,6 @@ sub proto_name( $ ) {
     $proto =~ /^(\d+)$/ ? $prototoname[ $proto ] || scalar getprotobynumber $proto : $proto
 }
 
-sub validate_port( $$ ) {
-    my ($proto, $port) = @_;
-
-    my $value;
-
-    if ( $port =~ /^(\d+)$/ || $port =~ /^0x/ ) {
-	$port = numeric_value $port;
-	return $port if defined $port && $port && $port <= 65535;
-    } else {
-	$proto = proto_name $proto if $proto =~ /^(\d+)$/;
-	$value = getservbyname( $port, $proto );
-    }
-
-    return $value if defined $value;
-
-    fatal_error "The separator for a port range is ':', not '-' ($port)" if $port =~ /^\d+-\d+$/;
-
-    fatal_error "Invalid/Unknown $proto port/service ($_[1])" unless defined $value;
-}
-
-sub validate_portpair( $$ ) {
-    my ($proto, $portpair) = @_;
-    my $what;
-    my $pair = $portpair;
-    #
-    # Accept '-' as a port-range separator
-    #
-    $pair =~ tr/-/:/ if $pair =~ /^[-0-9]+$/;
-
-    fatal_error "Invalid port range ($portpair)" if $pair =~ tr/:/:/ > 1;
-
-    $pair = "0$pair"       if substr( $pair,  0, 1 ) eq ':';
-    $pair = "${pair}65535" if substr( $pair, -1, 1 ) eq ':';
-
-    my @ports = split /:/, $pair, 2;
-
-    my $protonum = resolve_proto( $proto ) || 0;
-
-    $_ = validate_port( $protonum, $_) for grep $_, @ports;
-
-    if ( @ports == 2 ) {
-	$what = 'port range';
-	fatal_error "Invalid port range ($portpair)" unless $ports[0] < $ports[1];
-    } else {
-	$what = 'port';
-    }
-
-    fatal_error "Using a $what ( $portpair ) requires PROTO TCP, UDP, UDPLITE, SCTP or DCCP" unless
-	defined $protonum && ( $protonum == TCP     ||
-			       $protonum == UDP     ||
-			       $protonum == UDPLITE ||
-			       $protonum == SCTP    ||
-			       $protonum == DCCP );
-    join ':', @ports;
-
-}
-
-sub validate_portpair1( $$ ) {
-    my ($proto, $portpair) = @_;
-    my $what;
-
-    fatal_error "Invalid port range ($portpair)" if $portpair =~ tr/-/-/ > 1;
-
-    $portpair = "1$portpair"       if substr( $portpair,  0, 1 ) eq ':';
-    $portpair = "${portpair}65535" if substr( $portpair, -1, 1 ) eq ':';
-
-    my @ports = split /-/, $portpair, 2;
-
-    my $protonum = resolve_proto( $proto ) || 0;
-
-    $_ = validate_port( $protonum, $_) for grep $_, @ports;
-
-    if ( @ports == 2 ) {
-	$what = 'port range';
-	fatal_error "Invalid port range ($portpair)" unless $ports[0] && $ports[0] < $ports[1];
-    } else {
-	$what = 'port';
-	fatal_error 'Invalid port number (0)' unless $portpair;
-    }
-
-    fatal_error "Using a $what ( $portpair ) requires PROTO TCP, UDP, SCTP or DCCP" unless
-	defined $protonum && ( $protonum == TCP  ||
-			       $protonum == UDP  ||
-			       $protonum == SCTP ||
-			       $protonum == DCCP );
-    join '-', @ports;
-
-}
-
-sub validate_port_list( $$ ) {
-    my $result = '';
-    my ( $proto, $list ) = @_;
-    my @list   = split_list( $list, 'port' );
-
-    if ( @list > 1 && $list =~ /[:-]/ ) {
-	require_capability( 'XMULTIPORT' , 'Port ranges in a port list', '' );
-    }
-
-    $proto = proto_name $proto;
-
-    for ( @list ) {
-	my $value = validate_portpair( $proto , $_ );
-	$result = $result ? join ',', $result, $value : $value;
-    }
-
-    $result;
-}
-
 my %icmp_types = ( any                          => 'any',
 		   'echo-reply'                 => 0,
 		   'destination-unreachable'    => 3,
@@ -572,67 +459,6 @@ sub validate_icmp( $ ) {
     fatal_error "Invalid ICMP Type ($type)"
 }
 
-#
-# Expands a port range into a minimal list of ( port, mask ) pairs.
-# Each port and mask are expressed as 4 hex nibbles without a leading '0x'.
-#
-# Example:
-#
-#       DB<3> @foo = Shorewall::IPAddrs::expand_port_range( 6, '110:' ); print "@foo\n"
-#       006e fffe 0070 fff0 0080 ff80 0100 ff00 0200 fe00 0400 fc00 0800 f800 1000 f000 2000 e000 4000 c000 8000 8000
-#
-sub expand_port_range( $$ ) {
-    my ( $proto, $range ) = @_;
-
-    if ( $range =~ /^(.*):(.*)$/ ) {
-	my ( $first, $last ) = ( $1, $2);
-	my @result;
-
-	fatal_error "Invalid port range ($range)" unless $first ne '' or $last ne '';
-	#
-	# Supply missing first/last port number
-	#
-	$first = 0     if $first eq '';
-	$last  = 65535 if $last eq '';
-	#
-	# Validate the ports
-	#
-	( $first , $last ) = ( validate_port( $proto, $first || 1 ) , validate_port( $proto, $last ) );
-
-	$last++; #Increment last address for limit testing.
-	#
-	# Break the range into groups:
-	#
-	#      - If the first port in the remaining range is odd, then the next group is ( <first>, ffff ).
-	#      - Otherwise, find the largest power of two P that divides the first address such that
-	#        the remaining range has less than or equal to P ports. The next group is
-	#        ( <first> , ~( P-1 ) ).
-	#
-	while ( ( my $ports = ( $last - $first ) ) > 0 ) {
-	    my $mask = 0xffff;         #Mask for current ports in group.
-	    my $y    = 2;              #Next power of two to test
-	    my $z    = 1;              #Number of ports in current group (Previous value of $y).
-
-	    while ( ( ! ( $first % $y ) ) && ( $y <= $ports ) ) {
-		$mask <<= 1;
-		$z  = $y;
-		$y <<= 1;
-	    }
-	    #
-	    #
-	    push @result, sprintf( '%04x', $first ) , sprintf( '%04x' , $mask & 0xffff );
-	    $first += $z;
-	}
-
-	fatal_error "Invalid port range ($range)" unless @result; # first port > last port
-
-	@result;
-
-    } else {
-	( sprintf( '%04x' , validate_port( $proto, $range ) ) , 'ffff' );
-    }
-}
-
 sub valid_6address( $ ) {
     my $address = $_[0];
 

Shorewall/Perl/Shorewall/Misc.pm

@@ -1213,55 +1213,53 @@ sub add_common_rules ( $ ) {
 	}
     }
 
-    if ( $family == F_IPV4 ) {
-	my $announced = 0;
+    my $announced = 0;
 
-	$list = find_interfaces_by_option 'upnp';
+    $list = find_interfaces_by_option 'upnp';
 
-	if ( @$list ) {
-	    progress_message2 "$doing UPnP";
+    if ( @$list ) {
+	progress_message2 "$doing UPnP";
 
-	    $chainref = set_optflags( new_nat_chain( 'UPnP' ), DONT_OPTIMIZE );
+	$chainref = set_optflags( new_nat_chain( 'UPnP' ), DONT_OPTIMIZE );
 
-	    add_commands( $chainref, '[ -s /${VARDIR}/.UPnP ] && cat ${VARDIR}/.UPnP >&3' );
+	add_commands( $chainref, '[ -s /${VARDIR}/.UPnP ] && cat ${VARDIR}/.UPnP >&3' );
 
-	    my $chainref1;
+	my $chainref1;
 
-	    if ( $config{MINIUPNPD} ) {
-		$chainref1 = set_optflags( new_nat_chain( 'MINIUPNPD-POSTROUTING' ), DONT_OPTIMIZE ); 
-		add_commands( $chainref, '[ -s /${VARDIR}/.MINIUPNPD-POSTROUTING ] && cat ${VARDIR}/.MINIUPNPD-POSTROUTING >&3' );
-	    }
-
-	    $announced = 1;
-
-	    for $interface ( @$list ) {
-		add_ijump_extended $nat_table->{PREROUTING} ,            j => 'UPnP',                   get_interface_origin($interface), imatch_source_dev ( $interface );
-		add_ijump_extended $nat_table->{$globals{POSTROUTING}} , j => 'MINIUPNPD-POSTROUTING' , $origin{MINIUPNPD}              , imatch_dest_dev   ( $interface ) if $chainref1;
-	    }
+	if ( $config{MINIUPNPD} ) {
+	    $chainref1 = set_optflags( new_nat_chain( 'MINIUPNPD-POSTROUTING' ), DONT_OPTIMIZE ); 
+	    add_commands( $chainref, '[ -s /${VARDIR}/.MINIUPNPD-POSTROUTING ] && cat ${VARDIR}/.MINIUPNPD-POSTROUTING >&3' );
 	}
 
-	$list = find_interfaces_by_option 'upnpclient';
+	$announced = 1;
 
-	if ( @$list ) {
-	    progress_message2 "$doing UPnP" unless $announced;
+	for $interface ( @$list ) {
+	    add_ijump_extended $nat_table->{PREROUTING} ,            j => 'UPnP',                   get_interface_origin($interface), imatch_source_dev ( $interface );
+	    add_ijump_extended $nat_table->{$globals{POSTROUTING}} , j => 'MINIUPNPD-POSTROUTING' , $origin{MINIUPNPD}              , imatch_dest_dev   ( $interface ) if $chainref1;
+	}
+    }
 
-	    for $interface ( @$list ) {
-		my $chainref = $filter_table->{input_option_chain $interface};
-		my $base     = uc var_base get_physical $interface;
-		my $optional = interface_is_optional( $interface );
-		my $variable = get_interface_gateway( $interface, ! $optional );
-		my $origin   = get_interface_origin( $interface );
+    $list = find_interfaces_by_option 'upnpclient';
 
-		if ( $optional ) {
-		    add_commands( $chainref,
-				  qq(if [ -n "SW_\$${base}_IS_USABLE" -a -n "$variable" ]; then) );
-		    incr_cmd_level( $chainref );
-		    add_ijump_extended( $chainref, j => 'ACCEPT', $origin, imatch_source_dev( $interface ), s => $variable, p => 'udp' );
-		    decr_cmd_level( $chainref );
-		    add_commands( $chainref, 'fi' );
-		} else {
-		    add_ijump_extended( $chainref, j => 'ACCEPT', $origin, imatch_source_dev( $interface ), s => $variable, p => 'udp' );
-		}
+    if ( @$list ) {
+	progress_message2 "$doing UPnP" unless $announced;
+
+	for $interface ( @$list ) {
+	    my $chainref = $filter_table->{input_option_chain $interface};
+	    my $base     = uc var_base get_physical $interface;
+	    my $optional = interface_is_optional( $interface );
+	    my $variable = get_interface_gateway( $interface, ! $optional );
+	    my $origin   = get_interface_origin( $interface );
+
+	    if ( $optional ) {
+		add_commands( $chainref,
+			      qq(if [ -n "SW_\$${base}_IS_USABLE" -a -n "$variable" ]; then) );
+		incr_cmd_level( $chainref );
+		add_ijump_extended( $chainref, j => 'ACCEPT', $origin, imatch_source_dev( $interface ), s => $variable, p => 'udp' );
+		decr_cmd_level( $chainref );
+		add_commands( $chainref, 'fi' );
+	    } else {
+		add_ijump_extended( $chainref, j => 'ACCEPT', $origin, imatch_source_dev( $interface ), s => $variable, p => 'udp' );
 	    }
 	}
     }

Shorewall/Perl/Shorewall/Nat.pm

@@ -941,7 +941,17 @@ sub handle_nat_rule( $$$$$$$$$$$$$ ) {
 	} else {
 	    $server = $1 if $family == F_IPV6 && $server =~ /^\[(.+)\]$/;
 	    fatal_error "Invalid server IP address ($server)" if $server eq ALLIP || $server eq NILIP;
-	    my @servers = validate_address $server, 1;
+
+	    my @servers;
+
+	    if ( ( $server =~ /^([&%])(.+)/ ) ) {
+		$server = record_runtime_address( $1, $2 );
+		$server =~ s/ $//;
+		@servers = ( $server );
+	    } else {
+		@servers = validate_address $server, 1;
+	    }
+
 	    $server = join ',', @servers;
 	}
 

Shorewall/Perl/Shorewall/Providers.pm

@@ -64,6 +64,8 @@ our @load_interfaces;
 
 our $balancing;
 our $fallback;
+our $balanced_providers;
+our $fallback_providers;
 our $metrics;
 our $first_default_route;
 our $first_fallback_route;
@@ -99,6 +101,8 @@ sub initialize( $ ) {
     %provider_interfaces    = ();
     @load_interfaces        = ();
     $balancing              = 0;
+    $balanced_providers     = 0;
+    $fallback_providers     = 0;
     $fallback               = 0;
     $metrics                = 0;
     $first_default_route    = 1;
@@ -323,7 +327,13 @@ sub balance_default_route( $$$$ ) {
     emit '';
 
     if ( $first_default_route ) {
-	if ( $gateway ) {
+	if ( $balanced_providers == 1 ) {
+	    if ( $gateway ) {
+		emit "DEFAULT_ROUTE=\"via $gateway dev $interface $realm\"";
+	    } else {
+		emit "DEFAULT_ROUTE=\"dev $interface $realm\"";
+	    }
+	} elsif ( $gateway ) {
 	    emit "DEFAULT_ROUTE=\"nexthop via $gateway dev $interface weight $weight $realm\"";
 	} else {
 	    emit "DEFAULT_ROUTE=\"nexthop dev $interface weight $weight $realm\"";
@@ -347,7 +357,13 @@ sub balance_fallback_route( $$$$ ) {
     emit '';
 
     if ( $first_fallback_route ) {
-	if ( $gateway ) {
+	if ( $fallback_providers == 1 ) {
+	    if ( $gateway ) {
+		emit "FALLBACK_ROUTE=\"via $gateway dev $interface $realm\"";
+	    } else {
+		emit "FALLBACK_ROUTE=\"dev $interface $realm\"";
+	    }
+	} elsif ( $gateway ) {
 	    emit "FALLBACK_ROUTE=\"nexthop via $gateway dev $interface weight $weight $realm\"";
 	} else {
 	    emit "FALLBACK_ROUTE=\"nexthop dev $interface weight $weight $realm\"";
@@ -593,7 +609,12 @@ sub process_a_provider( $ ) {
 	}
     }
 
-    fatal_error q(The 'balance' and 'fallback' options are mutually exclusive) if $balance && $default;
+    if ( $balance ) {
+	fatal_error q(The 'balance' and 'fallback' options are mutually exclusive) if $default;
+	$balanced_providers++;
+    } elsif ( $default ) {
+	$fallback_providers++;
+    }
 
     if ( $load ) {
 	fatal_error q(The 'balance=<weight>' and 'load=<load-factor>' options are mutually exclusive) if $balance > 1;
@@ -1067,7 +1088,10 @@ CEOF
 	    emit( "setup_${dev}_tc" ) if $tcdevices->{$interface};
 	}
 
-	emit( qq(rm -f \${VARDIR}/${physical}_disabled) );
+	emit( qq(rm -f \${VARDIR}/${physical}_disabled),
+	      $pseudo ? "run_enabled_exit ${physical} ${interface}" : "run_enabled_exit ${physical} ${interface} ${table}"
+	    );
+
 	emit_started_message( '', 2, $pseudo, $table, $number );
 
 	if ( get_interface_option( $interface, 'used_address_variable' ) || get_interface_option( $interface, 'used_gateway_variable' ) ) {
@@ -1212,7 +1236,9 @@ CEOF
 		  "qt \$TC qdisc del dev $physical ingress\n" ) if $tcdevices->{$interface};
 	}
 
-	emit( "echo 1 > \${VARDIR}/${physical}.status" );
+	emit( "echo 1 > \${VARDIR}/${physical}.status",
+	      $pseudo ? "run_disabled_exit ${physical} ${interface}" : "run_disabled_exit ${physical} ${interface} ${table}"
+	    );
 
 	if ( $pseudo ) {
 	    emit( "progress_message2 \"   Optional Interface $table stopped\"" );
@@ -1534,9 +1560,9 @@ sub finish_providers() {
 	} else {
 	    emit  ( "    if echo \$DEFAULT_ROUTE | grep -q 'nexthop.+nexthop'; then",
 		    "        qt \$IP -6 route delete default scope global table $table \$DEFAULT_ROUTE",
-		    "        run_ip -6 route add default scope global table $table \$DEFAULT_ROUTE",
+		    "        run_ip route add default scope global table $table \$DEFAULT_ROUTE",
 		    '    else',
-		    "        run_ip -6 route replace default scope global table $table \$DEFAULT_ROUTE",
+		    "        run_ip route replace default scope global table $table \$DEFAULT_ROUTE",
 		    '    fi',
 		    '' );
 	}

Shorewall/Perl/Shorewall/Rules.pm

@@ -617,7 +617,7 @@ sub handle_nfqueue( $$ ) {
 	    fatal_error "Invalid NFQUEUE queue number ($queue1)" unless defined( $queuenum1) && $queuenum1 >= 0 && $queuenum1 <= 65535;
 
 	    if ( supplied $queue2 ) {
-		$fanout    = ' --queue-cpu-fanout' if $queue2 =~ s/c$//;
+		$fanout    = $queue2 =~ s/c$// ? ' --queue-cpu-fanout' : '';
 		$queuenum2 = numeric_value( $queue2 );
 
 		fatal_error "Invalid NFQUEUE queue number ($queue2)" unless defined( $queuenum2) && $queuenum2 >= 0 && $queuenum2 <= 65535 && $queuenum1 < $queuenum2;
@@ -5642,15 +5642,23 @@ sub process_snat( )
 sub setup_snat( $ ) # Convert masq->snat if true
 {
     my $fn;
+    my $have_masq;
 
-    convert_masq() if $_[0];
-
-    if ( $fn = open_file( 'masq', 1, 1 ) ) {
+    if ( $_[0] ) {
+	convert_masq();
+    } elsif ( $fn = open_file( 'masq', 1, 1 ) ) {
 	first_entry( sub { progress_message2 "$doing $fn..."; require_capability 'NAT_ENABLED' , "a non-empty masq file" , 's'; } );
-	process_one_masq(0) while read_a_line( NORMAL_READ );
-    } elsif ( $fn = open_file( 'snat', 1, 1 ) ) {
-	first_entry( sub { progress_message2 "$doing $fn..."; require_capability 'NAT_ENABLED' , "a non-empty snat file" , 's'; } );
-	process_snat while read_a_line( NORMAL_READ );
+	process_one_masq(0), $have_masq = 1 while read_a_line( NORMAL_READ );
+    }
+
+    unless ( $have_masq ) {
+	#
+	# Masq file empty or didn't exist
+	#
+	if ( $fn = open_file( 'snat', 1, 1 ) ) {
+	    first_entry( sub { progress_message2 "$doing $fn..."; require_capability 'NAT_ENABLED' , "a non-empty snat file" , 's'; } );
+	    process_snat while read_a_line( NORMAL_READ );
+	}
     }
 }
 

Shorewall/Perl/Shorewall/Tc.pm

@@ -1434,7 +1434,7 @@ sub process_tc_filter2( $$$$$$$$$ ) {
 
 	    while ( @sportlist ) {
 		my ( $sport, $smask ) = ( shift @sportlist, shift @sportlist );
-		$rule .= "\\\n   cmp\\( u16 at 0 layer 2 mask $smask eq 0x$sport \\)";
+		$rule .= "\\\n   cmp\\( u16 at 0 layer 2 mask 0x$smask eq 0x$sport \\)";
 		$rule .= ' or' if @sportlist;
 	    }
 

Shorewall/Perl/Shorewall/Zones.pm

@@ -92,7 +92,7 @@ our @EXPORT = ( qw( NOTHING
 		    find_interfaces_by_option
 		    find_interfaces_by_option1
 		    get_interface_option
-                    get_interface_origin
+		    get_interface_origin
 		    interface_has_option
 		    set_interface_option
 		    interface_zone
@@ -108,55 +108,37 @@ our @EXPORT = ( qw( NOTHING
 
 our @EXPORT_OK = qw( initialize );
 our $VERSION = 'MODULEVERSION';
-
-#
-# IPSEC Option types
-#
-use constant { NOTHING    => 'NOTHING',
-	       NUMERIC    => '0x[\da-fA-F]+|\d+',
-	       NETWORK    => '\d+.\d+.\d+.\d+(\/\d+)?',
-	       IPSECPROTO => 'ah|esp|ipcomp',
-	       IPSECMODE  => 'tunnel|transport'
-	       };
-
-#
-# Option columns
-#
-use constant { IN_OUT     => 1,
-	       IN         => 2,
-	       OUT        => 3 };
-
 #
 # Zone Table.
 #
 #     @zones contains the ordered list of zones with sub-zones appearing before their parents.
 #
 #     %zones{<zone1> => {name =>       <name>,
-#                        type =>       <zone type>       FIREWALL, IP, IPSEC, BPORT;
-#                        complex =>    0|1
-#                        super   =>    0|1
-#                        options =>    { in_out  => < policy match string >
-#                                        in      => < policy match string >
-#                                        out     => < policy match string >
-#                                      }
-#                        parents =>    [ <parents> ]      Parents, Children and interfaces are listed by name
-#                        children =>   [ <children> ]
-#                        interfaces => { <interfaces1> => 1, ... }
-#                        bridge =>     <bridge>
-#                        hosts { <type> } => [ { <interface1> => { ipsec   => 'ipsec'|'none'
-#                                                                  options => { <option1> => <value1>
-#                                                                               ...
-#                                                                             }
-#                                                                  hosts   => [ <net1> , <net2> , ... ]
-#                                                                  exclusions => [ <net1>, <net2>, ... ]
-#                                                                  origin   => <where defined>
-#                                                                }
-#                                                <interface2> => ...
-#                                              }
-#                                            ]
-#                       }
-#             <zone2> => ...
-#           }
+#			 type =>       <zone type>	 FIREWALL, IP, IPSEC, BPORT;
+#			 complex =>    0|1
+#			 super	 =>    0|1
+#			 options =>    { in_out	 => < policy match string >
+#					 in	 => < policy match string >
+#					 out	 => < policy match string >
+#				       }
+#			 parents =>    [ <parents> ]	  Parents, Children and interfaces are listed by name
+#			 children =>   [ <children> ]
+#			 interfaces => { <interfaces1> => 1, ... }
+#			 bridge =>     <bridge>
+#			 hosts { <type> } => [ { <interface1> => { ipsec   => 'ipsec'|'none'
+#								   options => { <option1> => <value1>
+#										...
+#									      }
+#								   hosts   => [ <net1> , <net2> , ... ]
+#								   exclusions => [ <net1>, <net2>, ... ]
+#								   origin   => <where defined>
+#								 }
+#						 <interface2> => ...
+#					       }
+#					     ]
+#			}
+#	      <zone2> => ...
+#	    }
 #
 #     $firewall_zone names the firewall zone.
 #
@@ -178,27 +160,27 @@ our %reservedName = ( all => 1,
 #
 #     @interfaces lists the interface names in the order that they appear in the interfaces file.
 #
-#     %interfaces { <interface1> => { name        => <name of interface>
-#                                     root        => <name without trailing '+'>
-#                                     options     => { port => undef|1
-#                                                    { <option1> } => <val1> ,          #See %validinterfaceoptions
-#                                                      ...
-#                                                    }
-#                                     zone        => <zone name>
-#                                     multizone   => undef|1   #More than one zone interfaces through this interface
-#                                     nets        => <number of nets in interface/hosts records referring to this interface>
-#                                     bridge      => <bridge name> # Same as ->{name} if not a bridge port.
-#                                     ports       => <number of port on this bridge>
-#                                     ipsec       => undef|1 # Has an ipsec host group
-#                                     broadcasts  => 'none', 'detect' or [ <addr1>, <addr2>, ... ]
-#                                     number      => <ordinal position in the interfaces file>
-#                                     physical    => <physical interface name>
-#                                     base        => <shell variable base representing this interface>
-#                                     wildcard    => undef|1 # Wildcard Name
-#                                     zones       => { zone1 => 1, ... }
-#                                     origin      => <where defined>
-#                                   }
-#                 }
+#     %interfaces { <interface1> => { name	  => <name of interface>
+#				      root	  => <name without trailing '+'>
+#				      options	  => { port => undef|1
+#						     { <option1> } => <val1> ,		#See %validinterfaceoptions
+#						       ...
+#						     }
+#				      zone	  => <zone name>
+#				      multizone	  => undef|1   #More than one zone interfaces through this interface
+#				      nets	  => <number of nets in interface/hosts records referring to this interface>
+#				      bridge	  => <bridge name> # Same as ->{name} if not a bridge port.
+#				      ports	  => <number of port on this bridge>
+#				      ipsec	  => undef|1 # Has an ipsec host group
+#				      broadcasts  => 'none', 'detect' or [ <addr1>, <addr2>, ... ]
+#				      number	  => <ordinal position in the interfaces file>
+#				      physical	  => <physical interface name>
+#				      base	  => <shell variable base representing this interface>
+#				      wildcard	  => undef|1 # Wildcard Name
+#				      zones	  => { zone1 => 1, ... }
+#				      origin	  => <where defined>
+#				    }
+#		  }
 #
 #    The purpose of the 'base' member is to ensure that the base names associated with the physical interfaces are assigned in
 #    the same order as the interfaces are encountered in the configuration files.
@@ -221,6 +203,26 @@ our $zonemarkincr;
 our $zonemarklimit;
 our $loopback_interface;
 
+#
+# IPSEC Option types
+#
+use constant { NOTHING    => 'NOTHING',
+	       NUMERIC    => '0x[\da-fA-F]+|\d+',
+	       IPSECPROTO => 'ah|esp|ipcomp',
+	       IPSECMODE  => 'tunnel|transport'
+	     };
+
+sub NETWORK() {
+    $family == F_IPV4 ? '\d+.\d+.\d+.\d+(\/\d+)?' : '(?:[0-9a-fA-F]{0,4}:){2,7}[0-9a-fA-F]{0,4}(?:\/d+)?';
+}
+
+#
+# Option columns
+#
+use constant { IN_OUT     => 1,
+	       IN         => 2,
+	       OUT        => 3 };
+
 use constant { FIREWALL => 1,
 	       IP       => 2,
 	       BPORT    => 4,
@@ -276,19 +278,7 @@ our %maxoptionvalue = ( routefilter => 2, mss => 100000 , wait => 120 , ignore =
 
 our %validhostoptions;
 
-our %validzoneoptions = ( mss            => NUMERIC,
-			  nomark         => NOTHING,
-			  blacklist      => NOTHING,
-			  dynamic_shared => NOTHING,
-			  strict         => NOTHING,
-			  next           => NOTHING,
-			  reqid          => NUMERIC,
-			  spi            => NUMERIC,
-			  proto          => IPSECPROTO,
-			  mode           => IPSECMODE,
-			 "tunnel-src"   => NETWORK,
-			 "tunnel-dst"   => NETWORK,
-		       );
+our %validzoneoptions;
 
 use constant { UNRESTRICTED => 1, NOFW => 2 , COMPLEX => 8, IN_OUT_ONLY => 16 };
 #
@@ -330,6 +320,20 @@ sub initialize( $$ ) {
     $minroot = 0;
     $loopback_interface = '';
 
+    %validzoneoptions = ( mss            => NUMERIC,
+			  nomark         => NOTHING,
+			  blacklist      => NOTHING,
+			  dynamic_shared => NOTHING,
+			  strict         => NOTHING,
+			  next           => NOTHING,
+			  reqid          => NUMERIC,
+			  spi            => NUMERIC,
+			  proto          => IPSECPROTO,
+			  mode           => IPSECMODE,
+			 "tunnel-src"   => NETWORK,
+			 "tunnel-dst"   => NETWORK,
+		       );
+
     if ( $family == F_IPV4 ) {
 	%validinterfaceoptions = (arp_filter  => BINARY_IF_OPTION,
 				  arp_ignore  => ENUM_IF_OPTION,
@@ -407,6 +411,8 @@ sub initialize( $$ ) {
 				    forward     => BINARY_IF_OPTION,
 				    physical    => STRING_IF_OPTION + IF_OPTION_HOST,
 				    unmanaged   => SIMPLE_IF_OPTION,
+				    upnp        => SIMPLE_IF_OPTION,
+				    upnpclient  => SIMPLE_IF_OPTION,
 				    wait        => NUMERIC_IF_OPTION + IF_OPTION_WILDOK,
 				 );
 	%validhostoptions = (
@@ -695,6 +701,40 @@ sub haveipseczones() {
     0;
 }
 
+#
+# Returns 1 if the two interfaces passed are related
+#
+sub interface_match( $$ ) {
+    my ( $piface, $ciface ) = @_;
+
+    return 1 if $piface eq $ciface;
+
+    my ( $pifaceref, $cifaceref ) = @interfaces{$piface, $ciface};
+
+    return 1 if $piface eq $cifaceref->{bridge};
+    return 1 if $ciface eq $pifaceref->{bridge};
+
+    if ( $minroot ) {
+	if ( $piface =~ /\+$/ ) {
+	    my $root    = $pifaceref->{root};
+	    my $rlength = length( $root );
+	    while ( length( $ciface ) >= $rlength ) {
+		return 1 if $ciface eq $root;
+		chop $ciface;
+	    }
+	} elsif ( $ciface =~ /\+$/ ) {
+	    my $root    = $cifaceref->{root};
+	    my $rlength = length( $root );
+	    while ( length( $piface ) >= $rlength ) {
+		return 1 if $piface eq $root;
+		chop $piface;
+	    }
+	}
+    }
+
+    0;
+}
+
 #
 # Report about zones.
 #
@@ -732,7 +772,7 @@ sub zone_report()
 			    if ( $family == F_IPV4 ) {
 				progress_message_nocompress "      $iref->{physical}:$grouplist";
 			    } else {
-				progress_message_nocompress "      $iref->{physical}:<$grouplist>";
+				progress_message_nocompress "      $iref->{physical}:[$grouplist]";
 			    }
 			    $printed = 1;
 			}
@@ -741,6 +781,17 @@ sub zone_report()
 	    }
 	}
 
+      PARENT:
+	for my $p ( @{$zoneref->{parents}} ) {
+	    for my $pi ( keys ( %{$zones{$p}{interfaces}} ) ) {
+		for my $ci ( keys( %{$zoneref->{interfaces}} ) ) {
+		    next PARENT if interface_match( $pi, $ci );
+		}
+	    }
+
+	    warning_message "Zone $zone is defined as a sub-zone of $p, yet the two zones have no interface in common";
+	}
+
 	unless ( $printed ) {
 	    fatal_error "No bridge has been associated with zone $zone" if $type & BPORT && ! $zoneref->{bridge};
 	    warning_message "*** $zone is an EMPTY ZONE ***" unless $type == FIREWALL;
@@ -1313,7 +1364,7 @@ sub process_interface( $$ ) {
 		    assert(0);
 		}
 	    } elsif ( $type == STRING_IF_OPTION ) {
-		fatal_error "The '$option' option requires a value" unless defined $value;
+		fatal_error "The '$option' option requires a value" unless supplied $value;
 
 		if ( $option eq 'physical' ) {
 		    fatal_error "Invalid interface name ($interface)" if $interface =~ /[()\[\]\*\?%]/;
@@ -1569,9 +1620,7 @@ sub known_interface($)
 	#
 	# We have wildcard interfaces -- see if this interface matches one of their roots
 	#
-	while ( length $iface > $minroot ) {
-	    chop $iface;
-
+	while ( length $iface >= $minroot ) {
 	    if ( my $i = $roots{$iface} ) {
 		#
 		# Found one
@@ -1593,6 +1642,8 @@ sub known_interface($)
 		                              };
 		return $interfaceref;
 	    }
+
+	    chop $iface;
 	}
     }
 

Shorewall/Perl/compiler.pl

@@ -43,6 +43,8 @@
 #         --inline                    # Update alternative column specifications
 #         --update                    # Update configuration to current release
 #
+#    If the <filename> is omitted, then a 'check' operation is performed.
+#
 use strict;
 use FindBin;
 use lib "$FindBin::Bin";

Shorewall/Perl/lib.runtime

@@ -32,7 +32,7 @@
 #	    down			Stop an optional interface
 #	    enable			Enable an optional interface
 #	    help			Show command syntax
-#	    reenable			Disable then nable an optional
+#	    reenable			Disable then enable an optional
 #					interface
 #	    refresh			Refresh the firewall
 #	    reload			Reload the firewall

Shorewall/Samples/Universal/shorewall.conf

@@ -217,6 +217,8 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
+PERL_HASH_SEED=0
+
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=Yes
@@ -247,6 +249,8 @@ TRACK_RULES=No
 
 USE_DEFAULT_RT=Yes
 
+USE_NFLOG_SIZE=No
+
 USE_PHYSICAL_NAMES=No
 
 USE_RT_NAMES=No

Shorewall/Samples/one-interface/shorewall.conf

@@ -228,6 +228,8 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
+PERL_HASH_SEED=0
+
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No
@@ -258,6 +260,8 @@ TRACK_RULES=No
 
 USE_DEFAULT_RT=Yes
 
+USE_NFLOG_SIZE=No
+
 USE_PHYSICAL_NAMES=No
 
 USE_RT_NAMES=No

Shorewall/Samples/three-interfaces/shorewall.conf

@@ -225,6 +225,8 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
+PERL_HASH_SEED=0
+
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No
@@ -255,6 +257,8 @@ TRACK_RULES=No
 
 USE_DEFAULT_RT=Yes
 
+USE_NFLOG_SIZE=No
+
 USE_PHYSICAL_NAMES=No
 
 USE_RT_NAMES=No

Shorewall/Samples/two-interfaces/shorewall.conf

@@ -228,6 +228,8 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
+PERL_HASH_SEED=0
+
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No
@@ -258,6 +260,8 @@ TRACK_RULES=No
 
 USE_DEFAULT_RT=Yes
 
+USE_NFLOG_SIZE=No
+
 USE_PHYSICAL_NAMES=No
 
 USE_RT_NAMES=No

Shorewall/actions.std

@@ -8,6 +8,7 @@
 #
 ###############################################################################
 #ACTION
+A_AllowICMPs inline		# Audited version of AllowICMPs
 A_Drop				# Audited Default Action for DROP policy
 A_REJECT     noinline,logjump	# Audits then rejects a connection request
 A_REJECT!    inline		# Audits then rejects a connection request
@@ -24,6 +25,7 @@ Broadcast    noinline,audit	# Handles Broadcast/Anycast
 DNSAmp				# Matches one-question recursive DNS queries
 Drop				# Default Action for DROP policy (deprecated)
 dropBcast    inline		# Silently Drop Broadcast
+dropBcasts    inline		# Silently Drop Broadcast
 dropInvalid  inline		# Drops packets in the INVALID conntrack state
 dropMcast    inline		# Silently Drop Multicast
 dropNotSyn   noinline		# Silently Drop Non-syn TCP packets
@@ -31,6 +33,7 @@ DropDNSrep   inline		# Drops DNS replies
 DropSmurfs   noinline		# Drop smurf packets
 Established  inline,\		# Handles packets in the ESTABLISHED state
 	     state=ESTABLISHED	#
+FIN	     inline,audit	# Handles ACK,FIN,PSH packets
 forwardUPnP  noinline		# Allow traffic that upnpd has redirected from 'upnp' interfaces.
 GlusterFS    inline		# Handles GlusterFS
 IfEvent	     noinline		# Perform an action based on an event

Shorewall/configfiles/disabled

@@ -0,0 +1,12 @@
+#
+# Shorewall -- /etc/shorewall/disabled
+#
+# Add commands below that you want executed when an optional
+# interface is successfully disabled using the 'disable' command
+#
+# When the commands are invoked:
+#
+#  $1 contains the physical name of the interface
+#  $2 contains the logical name of the interface
+#  $3 contains the name of the provider associated with the interface,
+      if any

Shorewall/configfiles/enabled

@@ -0,0 +1,12 @@
+#
+# Shorewall -- /etc/shorewall/enabled
+#
+# Add commands below that you want executed when an optional
+# interface is successfully enabled using the 'enable' command
+#
+# When the commands are invoked:
+#
+#  $1 contains the physical name of the interface
+#  $2 contains the logical name of the interface
+#  $3 contains the name of the provider associated with the interface,
+      if any

Shorewall/configfiles/shorewall.conf

@@ -217,6 +217,8 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
+PERL_HASH_SEED=0
+
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No
@@ -247,6 +249,8 @@ TRACK_RULES=No
 
 USE_DEFAULT_RT=Yes
 
+USE_NFLOG_SIZE=No
+
 USE_PHYSICAL_NAMES=No
 
 USE_RT_NAMES=No

Shorewall/install.sh

@@ -444,6 +444,12 @@ if [ -z "$first_install" ]; then
 	delete_file ${DESTDIR}${SHAREDIR}/shorewall/action.Reject
 	delete_file ${DESTDIR}${SHAREDIR}/shorewall/action.A_Drop
 	delete_file ${DESTDIR}${SHAREDIR}/shorewall/action.A_Reject
+	delete_file ${DESTDIR}${SHAREDIR}/shorewall/action.A_AllowICMPs
+    else
+	delete_file ${DESTDIR}${SHAREDIR}/shorewall6/action.A_AllowICMPs
+	delete_file ${DESTDIR}${SHAREDIR}/shorewall6/action.AllowICMPs
+	delete_file ${DESTDIR}${SHAREDIR}/shorewall6/action.Broadcast
+	delete_file ${DESTDIR}${SHAREDIR}/shorewall6/action.Multicast
     fi
 fi
 
@@ -486,8 +492,11 @@ fi
 #
 # Install the config file
 #
-run_install $OWNERSHIP -m 0644 $PRODUCT.conf           ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles/
-run_install $OWNERSHIP -m 0644 $PRODUCT.conf.annotated ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles/
+run_install $OWNERSHIP -m 0644 $PRODUCT.conf            ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles/
+
+if [ $PRODUCT = shorewall ]; then
+    run_install $OWNERSHIP -m 0644 shorewall.conf.annotated ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles/
+fi
 
 if [ ! -f ${DESTDIR}${CONFDIR}/$PRODUCT/$PRODUCT.conf ]; then
     run_install $OWNERSHIP -m 0600 ${PRODUCT}.conf${suffix} ${DESTDIR}${CONFDIR}/$PRODUCT/$PRODUCT.conf
@@ -607,8 +616,14 @@ run_install $OWNERSHIP -m 0644 params.annotated ${DESTDIR}${SHAREDIR}/$PRODUCT/c
 if [ -f ${DESTDIR}${CONFDIR}/$PRODUCT/params ]; then
     chmod 0644 ${DESTDIR}${CONFDIR}/$PRODUCT/params
 else
-    run_install $OWNERSHIP -m 0600 params${suffix} ${DESTDIR}${CONFDIR}/$PRODUCT/params
-    echo "Parameter file installed as ${DESTDIR}${CONFDIR}/$PRODUCT/params"
+    case "$SPARSE" in
+	[Vv]ery)
+	;;
+	*)
+	    run_install $OWNERSHIP -m 0600 params${suffix} ${DESTDIR}${CONFDIR}/$PRODUCT/params
+	    echo "Parameter file installed as ${DESTDIR}${CONFDIR}/$PRODUCT/params"
+	    ;;
+    esac
 fi
 
 if [ $PRODUCT = shorewall ]; then
@@ -684,10 +699,16 @@ fi
 run_install $OWNERSHIP -m 0644 conntrack           ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles
 run_install $OWNERSHIP -m 0644 conntrack.annotated ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles
 
-if [ ! -f ${DESTDIR}${CONFDIR}/$PRODUCT/conntrack ]; then
-    run_install $OWNERSHIP -m 0600 conntrack${suffix} ${DESTDIR}${CONFDIR}/$PRODUCT/conntrack
-    echo "Conntrack file installed as ${DESTDIR}${CONFDIR}/$PRODUCT/conntrack"
-fi
+case "$SPARSE" in
+    [Vv]ery)
+    ;;
+    *)
+	if [ ! -f ${DESTDIR}${CONFDIR}/$PRODUCT/conntrack ]; then
+	    run_install $OWNERSHIP -m 0600 conntrack${suffix} ${DESTDIR}${CONFDIR}/$PRODUCT/conntrack
+	    echo "Conntrack file installed as ${DESTDIR}${CONFDIR}/$PRODUCT/conntrack"
+	fi
+	;;
+esac
 
 #
 # Install the Mangle file
@@ -1141,13 +1162,39 @@ if [ -n "$MANDIR" ]; then
 
 cd manpages
 
-[ -n "$INSTALLD" ] || make_parent_directory ${DESTDIR}${MANDIR}/man5 0755
+if [ $PRODUCT = shorewall ]; then
+    [ -n "$INSTALLD" ] || make_parent_directory ${DESTDIR}${MANDIR}/man5 0755
 
-for f in *.5; do
-    gzip -9c $f > $f.gz
-    run_install $INSTALLD  -m 0644 $f.gz ${DESTDIR}${MANDIR}/man5/$f.gz
-    echo "Man page $f.gz installed to ${DESTDIR}${MANDIR}/man5/$f.gz"
-done
+    for f in *.5; do
+	gzip -9c $f > $f.gz
+	run_install $INSTALLD  -m 0644 $f.gz ${DESTDIR}${MANDIR}/man5/$f.gz
+	echo "Man page $f.gz installed to ${DESTDIR}${MANDIR}/man5/$f.gz"
+    done
+fi
+
+if [ $PRODUCT = shorewall6 ]; then
+    make_parent_directory ${DESTDIR}${MANDIR}/man5 0755
+
+    rm -f ${DESTDIR}${MANDIR}/man5/shorewall6*
+
+    for f in \
+	shorewall-accounting.5  shorewall-ipsets.5   shorewall-providers.5     shorewall-tcclasses.5     \
+	shorewall-actions.5     shorewall-maclist.5                            shorewall-tcdevices.5     \
+	                        shorewall-mangle.5   shorewall-proxyndp.5      shorewall-tcfilters.5     \
+	shorewall-blacklist.5   shorewall-masq.5     shorewall-routes.5        shorewall-tcinterfaces.5  \
+	shorewall-blrules.5     shorewall-modules.5  shorewall-routestopped.5  shorewall-tcpri.5         \
+	shorewall-conntrack.5   shorewall-nat.5      shorewall-rtrules.5       shorewall-tcrules.5       \
+                                shorewall-nesting.5  shorewall-rules.5         shorewall-tos.5           \
+	shorewall-exclusion.5   shorewall-netmap.5   shorewall-secmarks.5      shorewall-tunnels.5       \
+	shorewall-hosts.5       shorewall-params.5   shorewall-snat.5          shorewall-vardir.5        \
+	shorewall-interfaces.5  shorewall-policy.5   shorewall-stoppedrules.5  shorewall-zones.5
+    do
+	f6=shorewall6-${f#*-}
+	echo ".so man5/$f" > ${DESTDIR}${MANDIR}/man5/$f6
+    done
+
+    echo ".so man5/shorewall.conf.5" > ${DESTDIR}${MANDIR}/man5/shorewall6.conf.5
+fi
 
 [ -n "$INSTALLD" ] || make_parent_directory ${DESTDIR}${MANDIR}/man8 0755
 

Shorewall/lib.cli-std

@@ -341,6 +341,18 @@ get_config() {
 	setup_dbl
     fi
 
+    if [ -z "$PERL_HASH_SEED" ]; then
+	PERL_HASH_SEED=0
+    else
+	case $PERL_HASH_SEED in
+	    [0-9]|[1-9][0-9]|[1-9][0-9][0-9]|[1-9][0-9][0-9][0-9]|[1-9][0-9][0-9][0-9][0-9]|random)
+	        ;;
+	    *)
+		fatal_error "Invalid setting ($PERL_HASH_SEED) for PERL_HASH_SEED"
+		;;
+	esac
+    fi
+
     lib=$(find_file lib.cli-user)
 
     [ -f $lib ] && . $lib
@@ -484,8 +496,17 @@ compiler() {
     #
     [ "$g_debugging" != trace -a -z "$g_preview" ] || [ -n "$g_debug" ] && g_pager=
 
-    PERL_HASH_SEED=0
-    export PERL_HASH_SEED
+    case $PERL_HASH_SEED in
+	random)
+	    unset PERL_HASH_SEED
+	    unset PERL_PERTURB_KEYS
+	    ;;
+	*)
+	    export PERL_HASH_SEED
+	    PERL_PERTURB_KEYS=0
+	    export PERL_PERTURB_KEYS
+	    ;;
+    esac
 
     if [ ${PERLLIBDIR} = ${LIBEXECDIR}/shorewall ]; then
 	eval $PERL $debugflags $pc $options $@ $g_pager
@@ -513,28 +534,6 @@ start_command() {
     local rc
     rc=0
 
-    do_it() {
-	if [ -n "$AUTOMAKE" ]; then
-	    [ -n "$nolock" ] || mutex_on
-	    run_it ${VARDIR}/firewall $g_debugging start
-	    rc=$?
-	    [ -n "$nolock" ] || mutex_off
-	else
-	    g_file="${VARDIR}/.start"
-	    if compiler $g_debugging $nolock compile "$g_file"; then
-		[ -n "$nolock" ] || mutex_on
-		run_it ${VARDIR}/.start $g_debugging start
-		rc=$?
-		[ -n "$nolock" ] || mutex_off
-	    else
-		rc=$?
-		mylogger kern.err "ERROR:$g_product start failed"
-	    fi
-	fi
-
-	exit $rc
-    }
-
     if product_is_started; then
 	error_message "Shorewall is already running"
 	exit 0
@@ -626,7 +625,25 @@ start_command() {
 	fi
     fi
 
-    do_it
+    if [ -n "$AUTOMAKE" ]; then
+	[ -n "$nolock" ] || mutex_on
+	run_it ${VARDIR}/firewall $g_debugging start
+	rc=$?
+	[ -n "$nolock" ] || mutex_off
+    else
+	g_file="${VARDIR}/.start"
+	if compiler $g_debugging $nolock compile "$g_file"; then
+	    [ -n "$nolock" ] || mutex_on
+	    run_it ${VARDIR}/.start $g_debugging start
+	    rc=$?
+	    [ -n "$nolock" ] || mutex_off
+	else
+	    rc=$?
+	    mylogger kern.err "ERROR:$g_product start failed"
+	fi
+    fi
+
+    exit $rc
 }
 
 #

Shorewall/manpages/shorewall-accounting.xml

@@ -18,7 +18,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/accounting</command>
+      <command>/etc/shorewall[6]/accounting</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -783,6 +783,8 @@
     <title>FILES</title>
 
     <para>/etc/shorewall/accounting</para>
+
+    <para>/etc/shorewall6/accounting</para>
   </refsect1>
 
   <refsect1>
@@ -798,14 +800,6 @@
     <para><ulink
     url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
 
-    <para>shorewall(8), shorewall-actions(5), shorewall-blacklist(5),
-    shorewall-hosts(5), shorewall_interfaces(5), shorewall-ipsets(5),
-    shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5),
-    shorewall-netmap(5), shorewall-params(5), shorewall-policy(5),
-    shorewall-providers(5), shorewall-proxyarp(5), shorewall-rtrules(5),
-    shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
-    shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
-    shorewall-mangle(5), shorewall-tos(5), shorewall-tunnels(5),
-    shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-actions.xml

@@ -18,7 +18,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/actions</command>
+      <command>/etc/shorewall[6]/actions</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -148,9 +148,9 @@
               <listitem>
                 <para>Added in Shorewall 5.0.7. Specifies that this action is
                 to be used in <ulink
-                url="shorewall-mangle.html">shorewall-mangle(5)</ulink> rather
-                than <ulink
-                url="shorewall-rules.html">shorewall-rules(5)</ulink>.</para>
+                url="/manpages/shorewall-mangle.html">shorewall-mangle(5)</ulink>
+                rather than <ulink
+                url="/manpages/shorewall-rules.html">shorewall-rules(5)</ulink>.</para>
               </listitem>
             </varlistentry>
 
@@ -160,11 +160,11 @@
               <listitem>
                 <para>Added in Shorewall 5.0.13. Specifies that this action is
                 to be used in <ulink
-                url="shorewall-snat.html">shorewall-snat(5)</ulink> rather
-                than <ulink
-                url="shorewall-rules.html">shorewall-rules(5)</ulink>. The
-                <option>mangle</option> and <option>nat</option> options are
-                mutually exclusive.</para>
+                url="/manpages/shorewall-snat.html">shorewall-snat(5)</ulink>
+                rather than <ulink
+                url="/manpages/shorewall-rules.html">shorewall-rules(5)</ulink>.
+                The <option>mangle</option> and <option>nat</option> options
+                are mutually exclusive.</para>
               </listitem>
             </varlistentry>
 
@@ -206,7 +206,7 @@
                 <para>Given that neither the <filename>snat</filename> nor the
                 <filename>mangle</filename> file is sectioned, this parameter
                 has no effect when <option>mangle</option> or
-                <option>nat</option> is specified. </para>
+                <option>nat</option> is specified.</para>
               </listitem>
             </varlistentry>
 
@@ -239,6 +239,8 @@
     <title>FILES</title>
 
     <para>/etc/shorewall/actions</para>
+
+    <para>/etc/shorewall6/actions</para>
   </refsect1>
 
   <refsect1>
@@ -247,14 +249,6 @@
     <para><ulink
     url="/Actions.html">http://www.shorewall.net/Actions.html</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-blacklist(5),
-    shorewall-hosts(5), shorewall_interfaces(5), shorewall-ipsets(5),
-    shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5),
-    shorewall-netmap(5), shorewall-params(5), shorewall-policy(5),
-    shorewall-providers(5), shorewall-proxyarp(5), shorewall-rtrules(5),
-    shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
-    shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
-    shorewall-mangle(5), shorewall-tos(5), shorewall-tunnels(5),
-    shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-arprules.xml

@@ -25,6 +25,8 @@
   <refsect1>
     <title>Description</title>
 
+    <para>IPv4 only.</para>
+
     <para>This file was added in Shorewall 4.5.12 and is used to describe
     low-level rules managed by arptables (8). These rules only affect Address
     Resolution Protocol (ARP), Reverse Address Resolution Protocol (RARP) and
@@ -377,4 +379,10 @@ SNAT:10.1.10.11        -                       eth1:10.1.10.0/24   1</programlis
 
     <para>/etc/shorewall/arprules</para>
   </refsect1>
+
+  <refsect1>
+    <title>See ALSO</title>
+
+    <para>shorewall(8)</para>
+  </refsect1>
 </refentry>

Shorewall/manpages/shorewall-blrules.xml

@@ -18,7 +18,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/blrules</command>
+      <command>/etc/shorewall[6]/blrules</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -27,12 +27,9 @@
 
     <para>This file is used to perform blacklisting and whitelisting.</para>
 
-    <para>Rules in this file are applied depending on the setting of
-    BLACKLISTNEWONLY in <ulink
-    url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5). If
-    BLACKLISTNEWONLY=No, then they are applied regardless of the connection
-    tracking state of the packet. If BLACKLISTNEWONLY=Yes, they are applied to
-    connections in the NEW and INVALID states.</para>
+    <para>Rules in this file are applied depending on the setting of BLACKLIST
+    in <ulink
+    url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5).</para>
 
     <para>The format of rules in this file is the same as the format of rules
     in <ulink url="/manpages/shorewall-rules.html">shorewall-rules
@@ -118,10 +115,10 @@
             </varlistentry>
 
             <varlistentry>
-              <term>A_DROP and A_DROP!</term>
+              <term>A_DROP</term>
 
               <listitem>
-                <para>Audited versions of DROP. Requires AUDIT_TARGET support
+                <para>Audited version of DROP. Requires AUDIT_TARGET support
                 in the kernel and ip6tables.</para>
               </listitem>
             </varlistentry>
@@ -170,7 +167,7 @@
               <listitem>
                 <para>queues matching packets to a back end logging daemon via
                 a netlink socket then continues to the next rule. See <ulink
-                url="/shorewall.logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
+                url="/shorewall_logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
               </listitem>
             </varlistentry>
 
@@ -276,11 +273,11 @@
   </refsect1>
 
   <refsect1>
-    <title>Example</title>
+    <title>Examples</title>
 
     <variablelist>
       <varlistentry>
-        <term>Example 1:</term>
+        <term>IPv4 Example 1:</term>
 
         <listitem>
           <para>Drop Teredo packets from the net.</para>
@@ -290,7 +287,28 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 2:</term>
+        <term>IPv4 Example 2:</term>
+
+        <listitem>
+          <para>Don't subject packets from 2001:DB8::/64 to the remaining
+          rules in the file.</para>
+
+          <programlisting>WHITELIST     net:[2001:DB8::/64]        all</programlisting>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>IPv6 Example 1:</term>
+
+        <listitem>
+          <para>Drop Teredo packets from the net.</para>
+
+          <programlisting>DROP          net:[2001::/32]            all</programlisting>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>IPv6 Example 2:</term>
 
         <listitem>
           <para>Don't subject packets from 2001:DB8::/64 to the remaining
@@ -306,6 +324,8 @@
     <title>FILES</title>
 
     <para>/etc/shorewall/blrules</para>
+
+    <para>/etc/shorewall6/blrules</para>
   </refsect1>
 
   <refsect1>
@@ -317,12 +337,6 @@
     <para><ulink
     url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-hosts(5), shorewall-interfaces(5), shorewall-maclist(5),
-    shorewall6-netmap(5),shorewall-params(5), shorewall-policy(5),
-    shorewall-providers(5), shorewall-rtrules(5), shorewall-routestopped(5),
-    shorewall-rules(5), shorewall.conf(5), shorewall-secmarks(5),
-    shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-mangle(5),
-    shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-conntrack.xml

@@ -18,7 +18,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/conntrack</command>
+      <command>/etc/shorewall[6]/conntrack</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -35,7 +35,7 @@
     <emphasis role="bold">conntrack</emphasis>.</para>
 
     <para>The file supports three different column layouts: FORMAT 1, FORMAT
-    2, and FORMAT 3, FORMAT 1 being the default. The three differ as
+    2, and FORMAT 3 with FORMAT 1 being the default. The three differ as
     follows:</para>
 
     <itemizedlist>
@@ -311,9 +311,9 @@
             <listitem>
               <para><option>ULOG</option></para>
 
-              <para>Added in Shoreawll 4.6.0. Queues the packet to a backend
-              logging daemon using the ULOG netfilter target with the
-              specified <replaceable>ulog-parameters</replaceable>.</para>
+              <para>IPv4 only. Added in Shoreawll 4.6.0. Queues the packet to
+              a backend logging daemon using the ULOG netfilter target with
+              the specified <replaceable>ulog-parameters</replaceable>.</para>
             </listitem>
           </itemizedlist>
 
@@ -689,31 +689,57 @@
   <refsect1>
     <title>EXAMPLE</title>
 
-    <para>Example 1:</para>
+    <para>IPv4 Example 1:</para>
 
     <programlisting>#ACTION                       SOURCE            DEST               PROTO            DPORT             SPORT               USER
 CT:helper:ftp(expevents=new)  fw                -                  tcp              21              </programlisting>
 
-    <para>Example 2 (Shorewall 4.5.10 or later):</para>
+    <para>IPv4 Example 2 (Shorewall 4.5.10 or later):</para>
 
     <para>Drop traffic to/from all zones to IP address 1.2.3.4</para>
 
-    <programlisting>FORMAT 2
+    <programlisting>?FORMAT 2
 #ACTION                       SOURCE             DEST               PROTO           DPORT             SPORT               USER
 DROP                          all-:1.2.3.4       -
 DROP                          all                1.2.3.4</programlisting>
 
-    <para>or<programlisting>FORMAT 3
+    <para>or<programlisting>?FORMAT 3
 #ACTION                       SOURCE             DEST               PROTO           DPORT             SPORT               USER
 DROP:P                        1.2.3.4            -
 DROP:PO                       -                  1.2.3.4
 </programlisting></para>
+
+    <para>IPv6 Example 1:</para>
+
+    <para>Use the FTP helper for TCP port 21 connections from the firewall
+    itself.</para>
+
+    <programlisting>FORMAT 2
+#ACTION                       SOURCE            DEST               PROTO            DPORT             SPORT               USER
+CT:helper:ftp(expevents=new)  fw                -                  tcp              21              </programlisting>
+
+    <para>IPv6 Example 2 (Shorewall 4.5.10 or later):</para>
+
+    <para>Drop traffic to/from all zones to IP address 2001:1.2.3::4</para>
+
+    <programlisting>FORMAT 2
+#ACTION                       SOURCE             DEST               PROTO            DPORT             SPORT               USER
+DROP                          all-:2001:1.2.3::4 -
+DROP                          all                2001:1.2.3::4
+</programlisting>
+
+    <para>or<programlisting>FORMAT 3
+#ACTION                       SOURCE             DEST               PROTO            DPORT             SPORT               USER
+DROP:P                        2001:1.2.3::4      -
+DROP:PO                       -                  2001:1.2.3::4</programlisting></para>
   </refsect1>
 
   <refsect1>
     <title>FILES</title>
 
     <para>/etc/shorewall/conntrack</para>
+
+    <para>/etc/shorewall6/conntrack</para>
   </refsect1>
 
   <refsect1>
@@ -722,14 +748,6 @@ DROP:PO                       -                  1.2.3.4
     <para><ulink
     url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-masq(5), shorewall-nat(5),
-    shorewall-netmap(5), shorewall-params(5), shorewall-policy(5),
-    shorewall-providers(5), shorewall-proxyarp(5), shorewall-rtrules(5),
-    shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
-    shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
-    shorewall-mangle(5), shorewall-tos(5), shorewall-tunnels(5),
-    shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-ecn.xml

@@ -25,8 +25,12 @@
   <refsect1>
     <title>Description</title>
 
+    <para>IPv4 only.</para>
+
     <para>Use this file to list the destinations for which you want to disable
-    ECN (Explicit Congestion Notification).</para>
+    ECN (Explicit Congestion Notification). Use of this file is deprecated in
+    favor of ECN rules in <ulink
+    url="/manpages/shorewall-mangle.html">shorewall-mangle</ulink>(8).</para>
 
     <para>The columns in the file are as follows.</para>
 
@@ -65,14 +69,6 @@
   <refsect1>
     <title>See ALSO</title>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
-    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
-    shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
-    shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5),
-    shorewall.conf(5), shorewall-secmarks(5), shorewall-tcclasses(5),
-    shorewall-tcdevices(5), shorewall-mangle(5), shorewall-tos(5),
-    shorewall-tunnels(5), shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-exclusion.xml

@@ -49,9 +49,10 @@
 
     <para>Beginning in Shorewall 4.4.13, the second form of exclusion is
     allowed after <emphasis role="bold">all</emphasis> and <emphasis
-    role="bold">any</emphasis> in the SOURCE and DEST columns of
-    /etc/shorewall/rules. It allows you to omit arbitrary zones from the list
-    generated by those key words.</para>
+    role="bold">any</emphasis> in the SOURCE and DEST columns of <ulink
+    url="/manpages/shorewall-rules.html">shorewall-rules</ulink>(5). It allows
+    you to omit arbitrary zones from the list generated by those key
+    words.</para>
 
     <warning>
       <para>If you omit a sub-zone and there is an explicit or explicit
@@ -117,7 +118,7 @@ ACCEPT          all!z2        net         tcp           22</programlisting>
 
     <variablelist>
       <varlistentry>
-        <term>Example 1 - All IPv4 addresses except 192.168.3.4</term>
+        <term>IPv4 Example 1 - All IPv4 addresses except 192.168.3.4</term>
 
         <listitem>
           <para>!192.168.3.4</para>
@@ -125,8 +126,8 @@ ACCEPT          all!z2        net         tcp           22</programlisting>
       </varlistentry>
 
       <varlistentry>
-        <term>Example 2 - All IPv4 addresses except the network 192.168.1.0/24
-        and the host 10.2.3.4</term>
+        <term>IPv4 Example 2 - All IPv4 addresses except the network
+        192.168.1.0/24 and the host 10.2.3.4</term>
 
         <listitem>
           <para>!192.168.1.0/24,10.1.3.4</para>
@@ -134,7 +135,7 @@ ACCEPT          all!z2        net         tcp           22</programlisting>
       </varlistentry>
 
       <varlistentry>
-        <term>Example 3 - All IPv4 addresses except the range
+        <term>IPv4 Example 3 - All IPv4 addresses except the range
         192.168.1.3-192.168.1.12 and the network 10.0.0.0/8</term>
 
         <listitem>
@@ -143,8 +144,8 @@ ACCEPT          all!z2        net         tcp           22</programlisting>
       </varlistentry>
 
       <varlistentry>
-        <term>Example 4 - The network 192.168.1.0/24 except hosts 192.168.1.3
-        and 192.168.1.9</term>
+        <term>IPv4 Example 4 - The network 192.168.1.0/24 except hosts
+        192.168.1.3 and 192.168.1.9</term>
 
         <listitem>
           <para>192.168.1.0/24!192.168.1.3,192.168.1.9</para>
@@ -176,14 +177,6 @@ ACCEPT          all!z2        net         tcp           22</programlisting>
   <refsect1>
     <title>See ALSO</title>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
-    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
-    shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
-    shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5),
-    shorewall.conf(5), shorewall-secmarks(5), shorewall-tcclasses(5),
-    shorewall-tcdevices(5), shorewall-mangle(5), shorewall-tos(5),
-    shorewall-tunnels(5), shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-hosts.xml

@@ -18,7 +18,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/hosts</command>
+      <command>/etc/shorewall[6]/hosts</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -270,6 +270,8 @@ vpn         ppp+:192.168.3.0/24</programlisting></para>
     <title>FILES</title>
 
     <para>/etc/shorewall/hosts</para>
+
+    <para>/etc/shorewall6/hosts</para>
   </refsect1>
 
   <refsect1>
@@ -278,14 +280,6 @@ vpn         ppp+:192.168.3.0/24</programlisting></para>
     <para><ulink
     url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall_interfaces(5), shorewall-ipsets(5),
-    shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5),
-    shorewall-nesting(5), shorewall-netmap(5), shorewall-params(5),
-    shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
-    shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5),
-    shorewall.conf(5), shorewall-secmarks(5), shorewall-tcclasses(5),
-    shorewall-tcdevices(5), shorewall-mangle(5), shorewall-tos(5),
-    shorewall-tunnels(5), shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-init.xml

@@ -165,14 +165,6 @@
   <refsect1>
     <title>See ALSO</title>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
-    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
-    shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
-    shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5),
-    shorewall.conf(5), shorewall-secmarks(5), shorewall-tcclasses(5),
-    shorewall-tcdevices(5), shorewall-mangle(5), shorewall-tos(5),
-    shorewall-tunnels(5), shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-interfaces.xml

@@ -18,7 +18,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/interfaces</command>
+      <command>/etc/shorewall[6]/interfaces</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -104,9 +104,7 @@ loc     eth2            -</programlisting>
           <para>You may use wildcards here by specifying a prefix followed by
           the plus sign ("+"). For example, if you want to make an entry that
           applies to all PPP interfaces, use 'ppp+'; that would match ppp0,
-          ppp1, ppp2, … Please note that the '+' means '<emphasis
-          role="bold">one</emphasis> or more additional characters' so 'ppp'
-          does not match 'ppp+'.</para>
+          ppp1, ppp2, …</para>
 
           <para>When using Shorewall versions before 4.1.4, care must be
           exercised when using wildcards where there is another zone that uses
@@ -199,11 +197,12 @@ loc     eth2            -</programlisting>
               <term><emphasis role="bold">arp_filter[={0|1}]</emphasis></term>
 
               <listitem>
-                <para>If specified, this interface will only respond to ARP
-                who-has requests for IP addresses configured on the interface.
-                If not specified, the interface can respond to ARP who-has
-                requests for IP addresses on any of the firewall's interface.
-                The interface must be up when Shorewall is started.</para>
+                <para>IPv4 only. If specified, this interface will only
+                respond to ARP who-has requests for IP addresses configured on
+                the interface. If not specified, the interface can respond to
+                ARP who-has requests for IP addresses on any of the firewall's
+                interface. The interface must be up when Shorewall is
+                started.</para>
 
                 <para>Only those interfaces with the
                 <option>arp_filter</option> option will have their setting
@@ -225,8 +224,8 @@ loc     eth2            -</programlisting>
               role="bold">arp_ignore</emphasis>[=<emphasis>number</emphasis>]</term>
 
               <listitem>
-                <para>If specified, this interface will respond to arp
-                requests based on the value of <emphasis>number</emphasis>
+                <para>IPv4 only. If specified, this interface will respond to
+                arp requests based on the value of <emphasis>number</emphasis>
                 (defaults to 1).</para>
 
                 <para>1 - reply only if the target IP address is local address
@@ -257,7 +256,7 @@ loc     eth2            -</programlisting>
                 <warning>
                   <para>Do not specify <emphasis
                   role="bold">arp_ignore</emphasis> for any interface involved
-                  in <ulink url="../ProxyARP.htm">Proxy ARP</ulink>.</para>
+                  in <ulink url="/ProxyARP.htm">Proxy ARP</ulink>.</para>
                 </warning>
               </listitem>
             </varlistentry>
@@ -323,7 +322,7 @@ loc     eth2            -</programlisting>
                 and/or destination address is to be compared against the
                 ipset-based dynamic blacklist (DYNAMIC_BLACKLIST=ipset... in
                 <ulink
-                url="manpages/shorewall.conf.html">shorewall.conf(5)</ulink>).
+                url="/manpages/shorewall.conf.html">shorewall.conf(5)</ulink>).
                 The default is determine by the setting of
                 DYNAMIC_BLACKLIST:</para>
 
@@ -411,13 +410,13 @@ loc     eth2            -</programlisting>
 
                   <listitem>
                     <para>the interface is a <ulink
-                    url="../SimpleBridge.html">simple bridge</ulink> with a
-                    DHCP server on one port and DHCP clients on another
+                    url="/SimpleBridge.html">simple bridge</ulink> with a DHCP
+                    server on one port and DHCP clients on another
                     port.</para>
 
                     <note>
                       <para>If you use <ulink
-                      url="../bridge-Shorewall-perl.html">Shorewall-perl for
+                      url="/bridge-Shorewall-perl.html">Shorewall-perl for
                       firewall/bridging</ulink>, then you need to include
                       DHCP-specific rules in <ulink
                       url="/manpages/shorewall-rules.html">shorewall-rules</ulink>(5).
@@ -467,15 +466,15 @@ loc     eth2            -</programlisting>
               role="bold">logmartians[={0|1}]</emphasis></term>
 
               <listitem>
-                <para>Turn on kernel martian logging (logging of packets with
-                impossible source addresses. It is strongly suggested that if
-                you set <emphasis role="bold">routefilter</emphasis> on an
-                interface that you also set <emphasis
-                role="bold">logmartians</emphasis>. Even if you do not specify
-                the <option>routefilter</option> option, it is a good idea to
-                specify <option>logmartians</option> because your distribution
-                may have enabled route filtering without you knowing
-                it.</para>
+                <para>IPv4 only. Turn on kernel martian logging (logging of
+                packets with impossible source addresses. It is strongly
+                suggested that if you set <emphasis
+                role="bold">routefilter</emphasis> on an interface that you
+                also set <emphasis role="bold">logmartians</emphasis>. Even if
+                you do not specify the <option>routefilter</option> option, it
+                is a good idea to specify <option>logmartians</option> because
+                your distribution may have enabled route filtering without you
+                knowing it.</para>
 
                 <para>Only those interfaces with the
                 <option>logmartians</option> option will have their setting
@@ -576,8 +575,8 @@ loc     eth2            -</programlisting>
               <term><emphasis role="bold">nosmurfs</emphasis></term>
 
               <listitem>
-                <para>Filter packets for smurfs (packets with a broadcast
-                address as the source).</para>
+                <para>IPv4 only. Filter packets for smurfs (packets with a
+                broadcast address as the source).</para>
 
                 <para>Smurfs will be optionally logged based on the setting of
                 SMURF_LOG_LEVEL in <ulink
@@ -596,9 +595,9 @@ loc     eth2            -</programlisting>
                 <itemizedlist>
                   <listitem>
                     <para>a <filename
-                    class="directory">/proc/sys/net/ipv4/conf/</filename>
+                    class="directory">/proc/sys/net/ipv[46]/conf/</filename>
                     entry for the interface cannot be modified (including for
-                    proxy ARP).</para>
+                    proxy ARP or proxy NDP).</para>
                   </listitem>
 
                   <listitem>
@@ -638,7 +637,7 @@ loc     eth2            -</programlisting>
               <term><emphasis role="bold">proxyarp[={0|1}]</emphasis></term>
 
               <listitem>
-                <para>Sets
+                <para>IPv4 only. Sets
                 /proc/sys/net/ipv4/conf/<emphasis>interface</emphasis>/proxy_arp.
                 Do NOT use this option if you are employing Proxy ARP through
                 entries in <ulink
@@ -659,6 +658,24 @@ loc     eth2            -</programlisting>
               </listitem>
             </varlistentry>
 
+            <varlistentry>
+              <term><emphasis role="bold">proxyndp</emphasis>[={0|1}]</term>
+
+              <listitem>
+                <para>IPv6 only. Sets
+                /proc/sys/net/ipv6/conf/<emphasis>interface</emphasis>/proxy_ndp.</para>
+
+                <para><emphasis role="bold">Note</emphasis>: This option does
+                not work with a wild-card <replaceable>interface</replaceable>
+                name (e.g., eth0.+) in the INTERFACE column.</para>
+
+                <para>Only those interfaces with the <option>proxyndp</option>
+                option will have their setting changed; the value assigned to
+                the setting will be the value specified (if any) or 1 if no
+                value is given.</para>
+              </listitem>
+            </varlistentry>
+
             <varlistentry>
               <term><emphasis role="bold">required</emphasis></term>
 
@@ -700,8 +717,8 @@ loc     eth2            -</programlisting>
               role="bold">routefilter[={0|1|2}]</emphasis></term>
 
               <listitem>
-                <para>Turn on kernel route filtering for this interface
-                (anti-spoofing measure).</para>
+                <para>IPv4 only. Turn on kernel route filtering for this
+                interface (anti-spoofing measure).</para>
 
                 <para>Only those interfaces with the
                 <option>routefilter</option> option will have their setting
@@ -886,10 +903,13 @@ loc     eth2            -</programlisting>
                       role="bold">routefilter</emphasis></member>
 
                       <member><emphasis
-                      role="bold">sourceroute</emphasis></member>
+                      role="bold">proxyarp</emphasis></member>
 
                       <member><emphasis
-                      role="bold">proxyndp</emphasis></member>
+                      role="bold">proxyudp</emphasis></member>
+
+                      <member><emphasis
+                      role="bold">sourceroute</emphasis></member>
                     </simplelist>
                   </listitem>
                 </itemizedlist>
@@ -902,7 +922,9 @@ loc     eth2            -</programlisting>
               <listitem>
                 <para>Incoming requests from this interface may be remapped
                 via UPNP (upnpd). See <ulink
-                url="/UPnP.html">http://www.shorewall.net/UPnP.html</ulink>.</para>
+                url="/UPnP.html">http://www.shorewall.net/UPnP.html</ulink>.
+                Supported in IPv4 and in IPv6 in Shorewall 5.1.4 and
+                later.</para>
               </listitem>
             </varlistentry>
 
@@ -916,7 +938,8 @@ loc     eth2            -</programlisting>
                 causes Shorewall to detect the default gateway through the
                 interface and to accept UDP packets from that gateway. Note
                 that, like all aspects of UPnP, this is a security hole so use
-                this option at your own risk.</para>
+                this option at your own risk. Supported in IPv4 and in IPv6 in
+                Shorewall 5.1.4 and later.</para>
               </listitem>
             </varlistentry>
 
@@ -943,7 +966,7 @@ loc     eth2            -</programlisting>
 
     <variablelist>
       <varlistentry>
-        <term>Example 1:</term>
+        <term>IPv4 Example 1:</term>
 
         <listitem>
           <para>Suppose you have eth0 connected to a DSL modem and eth1
@@ -956,7 +979,7 @@ loc     eth2            -</programlisting>
 
           <para>Your entries for this setup would look like:</para>
 
-          <programlisting>FORMAT 1
+          <programlisting>?FORMAT 1
 #ZONE   INTERFACE BROADCAST        OPTIONS
 net     eth0      206.191.149.223  dhcp
 loc     eth1      192.168.1.255
@@ -971,7 +994,7 @@ dmz     eth2      192.168.2.255</programlisting>
           <para>The same configuration without specifying broadcast addresses
           is:</para>
 
-          <programlisting>FORMAT 2
+          <programlisting>?FORMAT 2
 #ZONE   INTERFACE OPTIONS
 net     eth0      dhcp
 loc     eth1      
@@ -986,7 +1009,7 @@ dmz     eth2</programlisting>
           <para>You have a simple dial-in system with no Ethernet
           connections.</para>
 
-          <programlisting>FORMAT 2
+          <programlisting>?FORMAT 2
 #ZONE   INTERFACE OPTIONS
 net     ppp0      -</programlisting>
         </listitem>
@@ -999,7 +1022,7 @@ net     ppp0      -</programlisting>
           <para>You have a bridge with no IP address and you want to allow
           traffic through the bridge.</para>
 
-          <programlisting>FORMAT 2
+          <programlisting>?FORMAT 2
 #ZONE   INTERFACE OPTIONS
 -       br0       bridge</programlisting>
         </listitem>
@@ -1011,6 +1034,8 @@ net     ppp0      -</programlisting>
     <title>FILES</title>
 
     <para>/etc/shorewall/interfaces</para>
+
+    <para>/etc/shorewall6/interfaces</para>
   </refsect1>
 
   <refsect1>
@@ -1019,13 +1044,6 @@ net     ppp0      -</programlisting>
     <para><ulink
     url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall-maclist(5),
-    shorewall-masq(5), shorewall-nat(5), shorewall-netmap(5),
-    shorewall-params(5), shorewall-policy(5), shorewall-providers(5),
-    shorewall-proxyarp(5), shorewall-rtrules(5), shorewall-routestopped(5),
-    shorewall-rules(5), shorewall.conf(5), shorewall-secmarks(5),
-    shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-mangle(5),
-    shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-ipsets.xml

@@ -103,7 +103,7 @@
 
     <important>
       <para>These additional match options are not available in <ulink
-      url="shorewall-tcfilters.html">shorewall-tcfilters(5)</ulink>.</para>
+      url="/manpages/shorewall-tcfilters.html">shorewall-tcfilters(5)</ulink>.</para>
     </important>
 
     <para>Available options are:</para>
@@ -251,34 +251,44 @@
 
     <para>/etc/shorewall/accounting</para>
 
+    <para>/etc/shorewall6/accounting</para>
+
     <para>/etc/shorewall/blrules</para>
 
+    <para>/etc/shorewall6/blrules</para>
+
     <para>/etc/shorewall/hosts -- <emphasis role="bold">Note:</emphasis>
     Multiple matches enclosed in +[...] may not be used in this file.</para>
 
+    <para>/etc/shorewall6/hosts -- <emphasis role="bold">Note:</emphasis>
+    Multiple matches enclosed in +[...] may not be used in this file.</para>
+
     <para>/etc/shorewall/maclist -- <emphasis role="bold">Note:</emphasis>
     Multiple matches enclosed in +[...] may not be used in this file.</para>
 
-    <para>/etc/shorewall/masq</para>
+    <para>/etc/shorewall6/maclist -- <emphasis role="bold">Note:</emphasis>
+    Multiple matches enclosed in +[...] may not be used in this file.</para>
 
     <para>/etc/shorewall/rules</para>
 
+    <para>/etc/shorewall6/rules</para>
+
     <para>/etc/shorewall/secmarks</para>
 
+    <para>/etc/shorewall6/secmarks</para>
+
     <para>/etc/shorewall/mangle</para>
+
+    <para>/etc/shorewall6/mangle</para>
+
+    <para>/etc/shorewall/snat</para>
+
+    <para>/etc/shorewall6/snat</para>
   </refsect1>
 
   <refsect1>
     <title>See ALSO</title>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5),
-    shorewall-netmap(5), shorewall-params(5), shorewall-policy(5),
-    shorewall-providers(5), shorewall-proxyarp(5), shorewall-rtrules(5),
-    shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
-    shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
-    shorewall-mangle(5), shorewall-tos(5), shorewall-tunnels(5),
-    shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-maclist.xml

@@ -18,7 +18,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/maclist</command>
+      <command>/etc/shorewall[6]/maclist</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -97,6 +97,8 @@
     <title>FILES</title>
 
     <para>/etc/shorewall/maclist</para>
+
+    <para>/etc/shorewall6/maclist</para>
   </refsect1>
 
   <refsect1>
@@ -108,14 +110,6 @@
     <para><ulink
     url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-masq(5), shorewall-nat(5),
-    shorewall-netmap(5), shorewall-params(5), shorewall-policy(5),
-    shorewall-providers(5), shorewall-proxyarp(5), shorewall-rtrules(5),
-    shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
-    shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
-    shorewall-mangle(5), shorewall-tos(5), shorewall-tunnels(5),
-    shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-mangle.xml

@@ -18,31 +18,17 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/mangle</command>
+      <command>/etc/shorewall[6]/mangle</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
   <refsect1>
     <title>Description</title>
 
-    <para>This file was introduced in Shorewall 4.6.0 and is intended to
-    replace <ulink
+    <para>This file was introduced in Shorewall 4.6.0 and replaces <ulink
     url="/manpages/shorewall-tcrules.html">shorewall-tcrules(5)</ulink>. This
     file is only processed by the compiler if:</para>
 
-    <orderedlist numeration="loweralpha">
-      <listitem>
-        <para>No file named 'tcrules' exists on the current CONFIG_PATH (see
-        <ulink url="/manpages/shorewall.conf.html">shorewall.conf(5)</ulink>);
-        or</para>
-      </listitem>
-
-      <listitem>
-        <para>The first file named 'tcrules' found on the CONFIG_PATH contains
-        no non-commentary entries.</para>
-      </listitem>
-    </orderedlist>
-
     <para>Entries in this file cause packets to be marked as a means of
     classifying them for traffic control or policy routing.</para>
 
@@ -117,9 +103,7 @@
           SOURCE is $FW, the generated rule is always placed in the OUTPUT
           chain. If DEST is '$FW', then the rule is placed in the INPUT chain.
           Additionally, a <replaceable>chain-designator</replaceable> may not
-          be specified in an action body unless the action is declared as
-          <option>inline</option> in <ulink
-          url="shorewall6-actions.html">shorewall-actions</ulink>(5).</para>
+          be specified in an action body.</para>
 
           <para>Where a command takes parameters, those parameters are
           enclosed in parentheses ("(....)") and separated by commas.</para>
@@ -299,7 +283,7 @@
                 configuration described at <ulink
                 url="http://www.loadbalancer.org/blog/setting-up-haproxy-with-transparent-mode-on-centos-6-x">http://www.loadbalancer.org/blog/setting-up-haproxy-with-transparent-mode-on-centos-6-x</ulink>,
                 place this entry in <ulink
-                url="manpages/shorewall-providers.html">shorewall-providers(5)</ulink>:</para>
+                url="/manpages/shorewall-providers.html">shorewall-providers(5)</ulink>:</para>
 
                 <programlisting>#NAME    NUMBER   MARK    DUPLICATE  INTERFACE GATEWAY         OPTIONS               COPY
 TProxy   1        -       -          lo        -               tproxy</programlisting>
@@ -365,8 +349,9 @@ DIVERTHA        -               -               tcp</programlisting>
 
               <listitem>
                 <para>Added in Shorewall 5.0.6 as an alternative to entries in
-                <ulink url="shorewall-ecn.html">shorewall-ecn(5)</ulink>. If a
-                PROTO is specified, it must be 'tcp' (6). If no PROTO is
+                <ulink
+                url="/manpages/shorewall-ecn.html">shorewall-ecn(5)</ulink>.
+                If a PROTO is specified, it must be 'tcp' (6). If no PROTO is
                 supplied, TCP is assumed. This action causes all ECN bits in
                 the TCP header to be cleared.</para>
               </listitem>
@@ -788,7 +773,7 @@ Normal-Service       =&gt; 0x00</programlisting>
               <listitem>
                 <para>where <replaceable>interface</replaceable> is the
                 logical name of an interface defined in <ulink
-                url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5).
+                url="/manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>(5).
                 Matches packets entering the firewall from the named
                 interface. May not be used in CLASSIFY rules or in rules using
                 the :T chain qualifier.</para>
@@ -911,11 +896,12 @@ Normal-Service       =&gt; 0x00</programlisting>
               <listitem>
                 <para>where <replaceable>interface</replaceable> is the
                 logical name of an interface defined in <ulink
-                url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5).
+                url="/manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>(5).
                 Matches packets leaving the firewall through the named
                 interface. May not be used in the PREROUTING chain (:P in the
                 mark column or no chain qualifier and MARK_IN_FORWARD_CHAIN=No
-                in <ulink url="manpages/shorewall.conf">shorewall.conf</ulink>
+                in <ulink
+                url="/manpages/shorewall.conf">shorewall.conf</ulink>
                 (5)).</para>
               </listitem>
             </varlistentry>
@@ -952,7 +938,7 @@ Normal-Service       =&gt; 0x00</programlisting>
                 when both the outgoing interface and destination IP address
                 match. May not be used in the PREROUTING chain (:P in the mark
                 column or no chain qualifier and MARK_IN_FORWARD_CHAIN=No in
-                <ulink url="manpages/shorewall.conf">shorewall.conf</ulink>
+                <ulink url="/manpages/shorewall.conf">shorewall.conf</ulink>
                 (5)).</para>
               </listitem>
             </varlistentry>
@@ -967,7 +953,7 @@ Normal-Service       =&gt; 0x00</programlisting>
                 <replaceable>exclusion</replaceable>. May not be used in the
                 PREROUTING chain (:P in the mark column or no chain qualifier
                 and MARK_IN_FORWARD_CHAIN=No in <ulink
-                url="manpages/shorewall.conf">shorewall.conf</ulink>
+                url="/manpages/shorewall.conf">shorewall.conf</ulink>
                 (5)).</para>
               </listitem>
             </varlistentry>
@@ -1036,7 +1022,7 @@ Normal-Service       =&gt; 0x00</programlisting>
 
         <listitem>
           <para>See <ulink
-          url="shorewall-rules.html">shorewall-rules(5)</ulink> for
+          url="/manpages/shorewall-rules.html">shorewall-rules(5)</ulink> for
           details.</para>
 
           <para>Beginning with Shorewall 4.5.12, this column can accept a
@@ -1543,7 +1529,7 @@ Normal-Service       =&gt; 0x00</programlisting>
 
     <variablelist>
       <varlistentry>
-        <term>Example 1:</term>
+        <term>IPv4 Example 1:</term>
 
         <listitem>
           <para>Mark all ICMP echo traffic with packet mark 1. Mark all peer
@@ -1572,7 +1558,7 @@ Normal-Service       =&gt; 0x00</programlisting>
       </varlistentry>
 
       <varlistentry>
-        <term>Example 2:</term>
+        <term>IPv4 Example 2:</term>
 
         <listitem>
           <para>SNAT outgoing connections on eth0 from 192.168.1.0/24 in
@@ -1584,12 +1570,41 @@ Normal-Service       =&gt; 0x00</programlisting>
        #ACTION            SOURCE         DEST         PROTO   DPORT         SPORT   USER    TEST
        CONNMARK(1-3):F    192.168.1.0/24 eth0 ; state=NEW
 
-/etc/shorewall/masq:
+/etc/shorewall/snat:
 
-       #INTERFACE SOURCE         ADDRESS     ...
-       eth0       192.168.1.0/24 1.1.1.1 ; mark=1:C
-       eth0       192.168.1.0/24 1.1.1.3 ; mark=2:C
-       eth0       192.168.1.0/24 1.1.1.4 ; mark=3:C</programlisting>
+       #ACTION          SOURCE              DEST     ...
+       SNAT(1.1.1.1)    eth0:192.168.1.0/24 - { mark=1:C }
+       SNAT(1.1.1.3)    eth0:192.168.1.0/24 - { mark=2:C }
+       SNAT(1.1.1.4)    eth0:192.168.1.0/24 - { mark=3:C }</programlisting>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>IPv6 Example 1:</term>
+
+        <listitem>
+          <para>Mark all ICMP echo traffic with packet mark 1. Mark all peer
+          to peer traffic with packet mark 4.</para>
+
+          <para>This is a little more complex than otherwise expected. Since
+          the ipp2p module is unable to determine all packets in a connection
+          are P2P packets, we mark the entire connection as P2P if any of the
+          packets are determined to match.</para>
+
+          <para>We assume packet/connection mark 0 means unclassified.</para>
+
+          <programlisting>       #ACTION    SOURCE    DEST         PROTO   DPORT         SPORT   USER    TEST
+       MARK(1):T  ::/0      ::/0         icmp    echo-request
+       MARK(1):T  ::/0      ::/0         icmp    echo-reply
+       RESTORE:T  ::/0      ::/0         all     -             -       -       0
+       CONTINUE:T ::/0      ::/0         all     -             -       -       !0
+       MARK(4):T  ::/0      ::/0         ipp2p:all
+       SAVE:T     ::/0      ::/0         all     -             -       -       !0</programlisting>
+
+          <para>If a packet hasn't been classified (packet mark is 0), copy
+          the connection mark to the packet mark. If the packet mark is set,
+          we're done. If the packet is P2P, set the packet mark to 4. If the
+          packet mark has been set, save it to the connection mark.</para>
         </listitem>
       </varlistentry>
     </variablelist>
@@ -1599,6 +1614,8 @@ Normal-Service       =&gt; 0x00</programlisting>
     <title>FILES</title>
 
     <para>/etc/shorewall/mangle</para>
+
+    <para>/etc/shorewall6/mangle</para>
   </refsect1>
 
   <refsect1>
@@ -1616,14 +1633,6 @@ Normal-Service       =&gt; 0x00</programlisting>
     <para><ulink
     url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-ecn(5), shorewall-exclusion(5),
-    shorewall-hosts(5), shorewall_interfaces(5), shorewall-ipsets(5),
-    shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5),
-    shorewall-netmap(5), shorewall-params(5), shorewall-policy(5),
-    shorewall-providers(5), shorewall-proxyarp(5), shorewall-rtrules(5),
-    shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
-    shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
-    shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-masq.xml

@@ -18,7 +18,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/masq</command>
+      <command>/etc/shorewall[6]/masq</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -579,7 +579,7 @@
 
     <variablelist>
       <varlistentry>
-        <term>Example 1:</term>
+        <term>IPv4 Example 1:</term>
 
         <listitem>
           <para>You have a simple masquerading setup where eth0 connects to a
@@ -594,7 +594,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 2:</term>
+        <term>IPv4 Example 2:</term>
 
         <listitem>
           <para>You add a router to your local network to connect subnet
@@ -607,7 +607,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 3:</term>
+        <term>IPv4 Example 3:</term>
 
         <listitem>
           <para>You have an IPSEC tunnel through ipsec0 and you want to
@@ -620,7 +620,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 4:</term>
+        <term>IPv4 Example 4:</term>
 
         <listitem>
           <para>You want all outgoing traffic from 192.168.1.0/24 through eth0
@@ -634,7 +634,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 5:</term>
+        <term>IPv4 Example 5:</term>
 
         <listitem>
           <para>You want all outgoing SMTP traffic entering the firewall from
@@ -654,7 +654,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 6:</term>
+        <term>IPv4 Example 6:</term>
 
         <listitem>
           <para>Connections leaving on eth0 and destined to any host defined
@@ -667,7 +667,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 7:</term>
+        <term>IPv4 Example 7:</term>
 
         <listitem>
           <para>SNAT outgoing connections on eth0 from 192.168.1.0/24 in
@@ -689,7 +689,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 8:</term>
+        <term>IPv4 Example 8:</term>
 
         <listitem>
           <para>Your eth1 has two public IP addresses: 70.90.191.121 and
@@ -716,6 +716,49 @@
 </programlisting>
         </listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term>IPv6 Example 1:</term>
+
+        <listitem>
+          <para>You have a simple 'masquerading' setup where eth0 connects to
+          a DSL or cable modem and eth1 connects to your local network with
+          subnet 2001:470:b:787::0/64</para>
+
+          <para>Your entry in the file will be:</para>
+
+          <programlisting>        #INTERFACE   SOURCE                  ADDRESS
+        eth0         2001:470:b:787::0/64    -</programlisting>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>IPv6 Example 2:</term>
+
+        <listitem>
+          <para>Your sit1 interface has two public IP addresses:
+          2001:470:a:227::1 and 2001:470:b:227::1. You want to use the
+          iptables statistics match to masquerade outgoing connections evenly
+          between these two addresses.</para>
+
+          <programlisting>/etc/shorewall/masq:
+
+       #INTERFACE    SOURCE         ADDRESS 
+       INLINE(sit1)  ::/0           2001:470:a:227::1 ;  -m statistic --mode random --probability 0.50
+       sit1          ::/0           2001:470:a:227::2 
+</programlisting>
+
+          <para>If INLINE_MATCHES=Yes in <ulink
+          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5),
+          then these rules may be specified as follows:</para>
+
+          <programlisting>/etc/shorewall/masq:
+
+       #INTERFACE    SOURCE         ADDRESS 
+       sit1          ::/0           2001:470:a:227::1 ;  -m statistic --mode random --probability 0.50
+       sit1          ::/0           2001:470:a:227::2</programlisting>
+        </listitem>
+      </varlistentry>
     </variablelist>
   </refsect1>
 
@@ -723,6 +766,8 @@
     <title>FILES</title>
 
     <para>/etc/shorewall/masq</para>
+
+    <para>/etc/shorewall6/masq</para>
   </refsect1>
 
   <refsect1>
@@ -731,14 +776,6 @@
     <para><ulink
     url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-exclusion(5), shorewall-hosts(5),
-    shorewall_interfaces(5), shorewall-ipsets(5), shorewall-maclist(5),
-    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
-    shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
-    shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5),
-    shorewall.conf(5), shorewall-secmarks(5), shorewall-tcclasses(5),
-    shorewall-tcdevices(5), shorewall-mangle(5), shorewall-tos(5),
-    shorewall-tunnels(5), shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-modules.xml

@@ -18,11 +18,11 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/usr/share/shorewall/modules</command>
+      <command>/usr/share/shorewall[6]/modules</command>
     </cmdsynopsis>
 
     <cmdsynopsis>
-      <command>/usr/share/shorewall/helpers</command>
+      <command>/usr/share/shorewall[6]/helpers</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -82,19 +82,19 @@
     <para>/etc/shorewall/modules</para>
 
     <para>/etc/shorewall/helpers</para>
+
+    <para>/usr/share/shorewall6/modules</para>
+
+    <para>/usr/share/shorewall6/helpers</para>
+
+    <para>/etc/shorewall6/modules</para>
+
+    <para>/etc/shorewall6/helpers</para>
   </refsect1>
 
   <refsect1>
     <title>See ALSO</title>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
-    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
-    shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
-    shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5),
-    shorewall.conf(5), shorewall-secmarks(5), shorewall-tcclasses(5),
-    shorewall-tcdevices(5), shorewall-mangle(5), shorewall-tos(5),
-    shorewall-tunnels(5), shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-nat.xml

@@ -34,6 +34,8 @@
       url="/FAQ.htm#faq1">http://www.shorewall.net/FAQ.htm#faq1</ulink>. Also,
       in many cases, Proxy ARP (<ulink
       url="/manpages/shorewall-proxyarp.html">shorewall-proxyarp</ulink>(5))
+      or Proxy-NDP(<ulink
+      url="/manpages6/shorewall6-proxyndp.html">shorewall6-proxyndp</ulink>(5))
       is a better solution that one-to-one NAT.</para>
     </warning>
 
@@ -199,7 +201,7 @@ all		all		REJECT		info
 
       <listitem>
         <para>Set IMPLICIT_CONTINUE=Yes in <ulink
-        url="manpages/shorewall.conf.html">shorewall.conf(5)</ulink>.</para>
+        url="/manpages/shorewall.conf.html">shorewall.conf(5)</ulink>.</para>
       </listitem>
     </orderedlist>
   </refsect1>
@@ -208,6 +210,8 @@ all		all		REJECT		info
     <title>FILES</title>
 
     <para>/etc/shorewall/nat</para>
+
+    <para>/etc/shorewall6/nat</para>
   </refsect1>
 
   <refsect1>
@@ -219,14 +223,6 @@ all		all		REJECT		info
     <para><ulink
     url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
-    shorewall-netmap(5), shorewall-params(5), shorewall-policy(5),
-    shorewall-providers(5), shorewall-proxyarp(5), shorewall-rtrules(5),
-    shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
-    shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
-    shorewall-mangle(5), shorewall-tos(5), shorewall-tunnels(5),
-    shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-nesting.xml

@@ -200,6 +200,16 @@
     <para>/etc/shorewall/policy</para>
 
     <para>/etc/shorewall/rules</para>
+
+    <para>/etc/shorewall6/zones</para>
+
+    <para>/etc/shorewall6/interfaces</para>
+
+    <para>/etc/shorewall6/hosts</para>
+
+    <para>/etc/shorewall6/policy</para>
+
+    <para>/etc/shorewall6/rules</para>
   </refsect1>
 
   <refsect1>

Shorewall/manpages/shorewall-netmap.xml

@@ -18,7 +18,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/netmap</command>
+      <command>/etc/shorewall[6]/netmap</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -44,8 +44,6 @@
         role="bold">SNAT}</emphasis></term>
 
         <listitem>
-          <para>Must be DNAT or SNAT</para>
-
           <para>If DNAT, traffic entering INTERFACE and addressed to NET1 has
           its destination address rewritten to the corresponding address in
           NET2.</para>
@@ -169,6 +167,8 @@
     <title>FILES</title>
 
     <para>/etc/shorewall/netmap</para>
+
+    <para>/etc/shorewall6/netmap</para>
   </refsect1>
 
   <refsect1>
@@ -180,14 +180,6 @@
     <para><ulink
     url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
-    shorewall-nat(5), shorewall-params(5), shorewall-policy(5),
-    shorewall-providers(5), shorewall-proxyarp(5), shorewall-rtrules(5),
-    shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
-    shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
-    shorewall-mangle(5), shorewall-tos(5), shorewall-tunnels(5),
-    shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-params.xml

@@ -18,7 +18,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/params</command>
+      <command>/etc/shorewall[6]/params</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -107,7 +107,7 @@
 
     <programlisting>NET_IF=eth0
 NET_BCAST=130.252.100.255
-NET_OPTIONS=routefilter,norfc1918</programlisting>
+NET_OPTIONS=routefilter</programlisting>
 
     <para>Example <ulink
     url="/manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
@@ -119,13 +119,15 @@ net     $NET_IF         $NET_BCAST      $NET_OPTIONS</programlisting>
     <para>This is the same as if the interfaces file had contained:</para>
 
     <programlisting>ZONE    INTERFACE       BROADCAST       OPTIONS
-net     eth0            130.252.100.255 routefilter,norfc1918</programlisting>
+net     eth0            130.252.100.255 routefilter</programlisting>
   </refsect1>
 
   <refsect1>
     <title>FILES</title>
 
     <para>/etc/shorewall/params</para>
+
+    <para>/etc/shorewall6/params</para>
   </refsect1>
 
   <refsect1>
@@ -134,14 +136,6 @@ net     eth0            130.252.100.255 routefilter,norfc1918</programlisting>
     <para><ulink
     url="/configuration_file_basics.htm#Variables">http://www.shorewall.net/configuration_file_basics.htm#Variables</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
-    shorewall-nat(5), shorewall-netmap(5), shorewall-policy(5),
-    shorewall-providers(5), shorewall-proxyarp(5), shorewall-rtrules(5),
-    shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
-    shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
-    shorewall-mangle(5), shorewall-tos(5), shorewall-tunnels(5),
-    shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-policy.xml

@@ -18,7 +18,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/policy</command>
+      <command>/etc/shorewall[6]/policy</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -33,25 +33,30 @@
       <para>The order of entries in this file is important</para>
 
       <para>This file determines what to do with a new connection request if
-      we don't get a match from the /etc/shorewall/rules file . For each
-      source/destination pair, the file is processed in order until a match is
-      found ("all" will match any source or destination).</para>
+      we don't get a match from the <ulink
+      url="/manpages/shorewall-blrules.html">shorewall-blrules</ulink>(5) or
+      <ulink url="/manpages/shorewall-rules.html">shorewall-rules</ulink>(5)
+      files. For each source/destination pair, the file is processed in order
+      until a match is found ("all" will match any source or
+      destination).</para>
     </important>
 
     <important>
       <para>Intra-zone policies are pre-defined</para>
 
-      <para>For $FW and for all of the zones defined in /etc/shorewall/zones,
-      the POLICY for connections from the zone to itself is ACCEPT (with no
+      <para>For $FW and for all of the zones defined in <ulink
+      url="/manpages/shorewall-zones.html">shorewall-zones</ulink>(5), the
+      POLICY for connections from the zone to itself is ACCEPT (with no
       logging or TCP connection rate limiting) but may be overridden by an
       entry in this file. The overriding entry must be explicit (specifying
       the zone name in both SOURCE and DEST) or it must use "all+" (Shorewall
       4.5.17 or later).</para>
 
-      <para>Similarly, if you have IMPLICIT_CONTINUE=Yes in shorewall.conf,
-      then the implicit policy to/from any sub-zone is CONTINUE. These
-      implicit CONTINUE policies may also be overridden by an explicit entry
-      in this file.</para>
+      <para>Similarly, if you have IMPLICIT_CONTINUE=Yes in <ulink
+      url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5), then the
+      implicit policy to/from any sub-zone is CONTINUE. These implicit
+      CONTINUE policies may also be overridden by an explicit entry in this
+      file.</para>
     </important>
 
     <para>The columns in the file are as follows (where the column name is
@@ -396,6 +401,8 @@
     <title>FILES</title>
 
     <para>/etc/shorewall/policy</para>
+
+    <para>/etc/shorewall6/policy</para>
   </refsect1>
 
   <refsect1>
@@ -404,14 +411,6 @@
     <para><ulink
     url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
-    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
-    shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
-    shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5),
-    shorewall.conf(5), shorewall-secmarks(5), shorewall-tcclasses(5),
-    shorewall-tcdevices(5), shorewall-mangle(5), shorewall-tos(5),
-    shorewall-tunnels(5), shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-providers.xml

@@ -82,14 +82,11 @@
           url="/manpages/shorewall-mangle.html">shorewall-mangle(5)</ulink>
           file to direct packets to this provider.</para>
 
-          <para>If HIGH_ROUTE_MARKS=Yes in <ulink
+          <para>If PROVIDER_OFFSET is non-zero in <ulink
           url="/manpages/shorewall.conf.html">shorewall.conf(5)</ulink>, then
-          the value must be a multiple of 256 between 256 and 65280 or their
-          hexadecimal equivalents (0x0100 and 0xff00 with the low-order byte
-          of the value being zero). Otherwise, the value must be between 1 and
-          255. Each provider must be assigned a unique mark value. This column
-          may be omitted if you don't use packet marking to direct connections
-          to a particular provider.</para>
+          the value must be a mutiple of 2^^PROVIDER_OFFSET. In all cases, the
+          number of significant bits may not exceed PROVIDER_OFFSET +
+          PROVIDER_BITS.</para>
         </listitem>
       </varlistentry>
 
@@ -116,9 +113,9 @@
           listed in <ulink
           url="/manpages/shorewall-interfaces.html">shorewall-interfaces(5)</ulink>.
           In general, that interface should not have the
-          <option>proxyarp</option> option specified unless
-          <option>loose</option> is given in the OPTIONS column of this
-          entry.</para>
+          <option>proxyarp</option> or <option>proxyndp</option> option
+          specified unless <option>loose</option> is given in the OPTIONS
+          column of this entry.</para>
 
           <para>Where more than one provider is serviced through a single
           interface, the <emphasis>interface</emphasis> must be followed by a
@@ -217,7 +214,14 @@
                 BALANCE_PROVIDERS=Yes, <option>balance=1</option> is assumed
                 unless the <option>fallback</option>, <option>loose</option>,
                 <option>load</option> or <option>tproxy</option> option is
-                specified.</para>
+                specified.I</para>
+
+                <caution>
+                  <para>In IPV6, the <option>balance</option> option does not
+                  cause balanced default routes to be created; it rather
+                  causes a sequence of default routes with different metrics
+                  to be created. </para>
+                </caution>
               </listitem>
             </varlistentry>
 
@@ -340,6 +344,14 @@
                 <para>Prior to Shorewall 4.4.24, the option is ignored with a
                 warning message if USE_DEFAULT_RT=Yes in
                 <filename>shorewall.conf</filename>.</para>
+
+                <caution>
+                  <para>In IPV6, specifying the <option>fallback</option>
+                  option on multiple providers does not cause balanced
+                  fallback routes to be created; it rather causes a sequence
+                  of fallback routes with different metrics to be
+                  created.</para>
+                </caution>
               </listitem>
             </varlistentry>
 
@@ -461,7 +473,7 @@
 
     <variablelist>
       <varlistentry>
-        <term>Example 1:</term>
+        <term>IPv4 Example 1:</term>
 
         <listitem>
           <para>You run squid in your DMZ on IP address 192.168.2.99. Your DMZ
@@ -473,7 +485,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 2:</term>
+        <term>IPv4 Example 2:</term>
 
         <listitem>
           <para>eth0 connects to ISP 1. The IP address of eth0 is
@@ -491,6 +503,36 @@
         ISP2  2       2    main      eth1      130.252.99.254  track,balance      eth2</programlisting>
         </listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term>IPv6 Example 1:</term>
+
+        <listitem>
+          <para>You run squid in your DMZ on IP address 2002:ce7c:92b4:1::2.
+          Your DMZ interface is eth2</para>
+
+          <programlisting>        #NAME   NUMBER  MARK DUPLICATE  INTERFACE GATEWAY              OPTIONS
+        Squid   1       1    -          eth2      2002:ce7c:92b4:1::2  -</programlisting>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>IPv6 Example 2:</term>
+
+        <listitem>
+          <para>eth0 connects to ISP 1. The ISP's gateway router has IP
+          address 2001:ce7c:92b4:1::2.</para>
+
+          <para>eth1 connects to ISP 2. The ISP's gateway router has IP
+          address 2001:d64c:83c9:12::8b.</para>
+
+          <para>eth2 connects to a local network.</para>
+
+          <programlisting>        #NAME NUMBER MARK DUPLICATE INTERFACE GATEWAY               OPTIONS    COPY
+        ISP1  1       1    main      eth0     2001:ce7c:92b4:1::2   track      eth2
+        ISP2  2       2    main      eth1     2001:d64c:83c9:12::8b track      eth2</programlisting>
+        </listitem>
+      </varlistentry>
     </variablelist>
   </refsect1>
 
@@ -498,6 +540,8 @@
     <title>FILES</title>
 
     <para>/etc/shorewall/providers</para>
+
+    <para>/etc/shorewall6/providers</para>
   </refsect1>
 
   <refsect1>
@@ -509,14 +553,6 @@
     <para><ulink
     url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
-    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
-    shorewall-policy(5), shorewall-proxyarp(5), shorewall-rtrules(5),
-    shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
-    shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
-    shorewall-mangle(5), shorewall-tos(5), shorewall-tunnels(5),
-    shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-proxyarp.xml

@@ -25,6 +25,8 @@
   <refsect1>
     <title>Description</title>
 
+    <para>IPv4 only.</para>
+
     <para>This file is used to define Proxy ARP. There is one entry in this
     file for each IP address to be proxied.</para>
 
@@ -139,14 +141,6 @@
     <para><ulink
     url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
-    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
-    shorewall-policy(5), shorewall-providers(5), shorewall-rtrules(5),
-    shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
-    shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
-    shorewall-mangle(5), shorewall-tos(5), shorewall-tunnels(5),
-    shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-routes.xml

@@ -18,7 +18,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/routes</command>
+      <command>/etc/shorewall[6]/routes</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -109,6 +109,8 @@
     <title>FILES</title>
 
     <para>/etc/shorewall/routes</para>
+
+    <para>/etc/shorewall6/routes</para>
   </refsect1>
 
   <refsect1>
@@ -117,14 +119,6 @@
     <para><ulink
     url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
-    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
-    shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
-    shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5),
-    shorewall.conf(5), shorewall-secmarks(5), shorewall-tcclasses(5),
-    shorewall-tcdevices(5), shorewall-mangle(5), shorewall-tos(5),
-    shorewall-tunnels(5), shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-rtrules.xml

@@ -18,7 +18,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/rtrules</command>
+      <command>/etc/shorewall[6]/rtrules</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -177,7 +177,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 2:</term>
+        <term>IPv4 Example 2:</term>
 
         <listitem>
           <para>You use OpenVPN (routed setup /tunX) in combination with
@@ -199,6 +199,8 @@
     <title>FILES</title>
 
     <para>/etc/shorewall/rtrules</para>
+
+    <para>/etc/shorewall6/rtrules</para>
   </refsect1>
 
   <refsect1>
@@ -210,14 +212,6 @@
     <para><ulink
     url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
-    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
-    shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
-    shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
-    shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
-    shorewall-mangle(5), shorewall-tos(5), shorewall-tunnels(5),
-    shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-rules.xml

@@ -18,7 +18,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/rules</command>
+      <command>/etc/shorewall[6]/rules</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -54,7 +54,8 @@
         <listitem>
           <para>This section was added in Shorewall 4.4.23. Rules in this
           section are applied, regardless of the connection tracking state of
-          the packet.</para>
+          the packet and are applied before rules in the other
+          sections.</para>
         </listitem>
       </varlistentry>
 
@@ -136,10 +137,8 @@
     <note>
       <para>If you are not familiar with Netfilter to the point where you are
       comfortable with the differences between the various connection tracking
-      states, then it is suggested that you omit the <emphasis
-      role="bold">ESTABLISHED</emphasis> and <emphasis
-      role="bold">RELATED</emphasis> sections and place all of your rules in
-      the NEW section (That's after the line that reads ?SECTION NEW').</para>
+      states, then it is suggested that you place all of your rules in the NEW
+      section (That's after the line that reads ?SECTION NEW').</para>
     </note>
 
     <warning>
@@ -148,8 +147,8 @@
       <emphasis role="bold">ALL, ESTABLISHED</emphasis> and <emphasis
       role="bold">RELATED</emphasis> sections must be empty.</para>
 
-      <para>An except is made if you are running Shorewall 4.4.27 or later and
-      you have specified a non-default value for RELATED_DISPOSITION or
+      <para>An exception is made if you are running Shorewall 4.4.27 or later
+      and you have specified a non-default value for RELATED_DISPOSITION or
       RELATED_LOG_LEVEL. In that case, you may have rules in the RELATED
       section of this file.</para>
     </warning>
@@ -213,7 +212,8 @@
                 role="bold">DNAT</emphasis>[<emphasis
                 role="bold">-</emphasis>] or <emphasis
                 role="bold">REDIRECT</emphasis>[<emphasis
-                role="bold">-</emphasis>] rules.</para>
+                role="bold">-</emphasis>] rules. Use with IPv6 requires
+                Shorewall 4.5.14 or later.</para>
               </listitem>
             </varlistentry>
 
@@ -234,7 +234,7 @@
                 <para>The name of an <emphasis>action</emphasis> declared in
                 <ulink
                 url="/manpages/shorewall-actions.html">shorewall-actions</ulink>(5)
-                or in /usr/share/shorewall/actions.std.</para>
+                or in /usr/share/shorewall[6]/actions.std.</para>
               </listitem>
             </varlistentry>
 
@@ -288,7 +288,8 @@
               <listitem>
                 <para>Added in Shorewall 4.4.20. Audited versions of ACCEPT,
                 ACCEPT+ and ACCEPT! respectively. Require AUDIT_TARGET support
-                in the kernel and iptables.</para>
+                in the kernel and iptables. A_ACCEPT+ with IPv6 requires
+                Shorewall 4.5.14 or later.</para>
               </listitem>
             </varlistentry>
 
@@ -403,7 +404,8 @@
 
               <listitem>
                 <para>Forward the request to another system (and optionally
-                another port).</para>
+                another port). Use with IPv6 requires Shorewall 4.5.14 or
+                later.</para>
               </listitem>
             </varlistentry>
 
@@ -416,7 +418,8 @@
                 <para>Like <emphasis role="bold">DNAT</emphasis> but only
                 generates the <emphasis role="bold">DNAT</emphasis> iptables
                 rule and not the companion <emphasis
-                role="bold">ACCEPT</emphasis> rule.</para>
+                role="bold">ACCEPT</emphasis> rule. Use with IPv6 requires
+                Shorewall 4.5.14 or later.</para>
               </listitem>
             </varlistentry>
 
@@ -498,11 +501,11 @@
               [<replaceable>option</replaceable> ...])</term>
 
               <listitem>
-                <para>This action allows you to specify an iptables target
-                with options (e.g., 'IPTABLES(MARK --set-xmark 0x01/0xff)'. If
-                the <replaceable>iptables-target</replaceable> is not one
-                recognized by Shorewall, the following error message will be
-                issued:</para>
+                <para>IPv4 only. This action allows you to specify an iptables
+                target with options (e.g., 'IPTABLES(MARK --set-xmark
+                0x01/0xff)'. If the <replaceable>iptables-target</replaceable>
+                is not one recognized by Shorewall, the following error
+                message will be issued:</para>
 
                 <programlisting>    ERROR: Unknown target (<replaceable>iptables-target</replaceable>)</programlisting>
 
@@ -523,6 +526,39 @@
               </listitem>
             </varlistentry>
 
+            <varlistentry>
+              <term><emphasis
+              role="bold">IP6TABLES</emphasis>({<replaceable>ip6tables-target</replaceable>
+              [<replaceable>option</replaceable> ...])</term>
+
+              <listitem>
+                <para>IPv6 only. This action allows you to specify an
+                ip6tables target with options (e.g., 'IPTABLES(MARK
+                --set-xmark 0x01/0xff)'. If the
+                <replaceable>ip6tables-target</replaceable> is not one
+                recognized by Shorewall, the following error message will be
+                issued:</para>
+
+                <programlisting>    ERROR: Unknown target (<replaceable>ip6tables-target</replaceable>)</programlisting>
+
+                <para>This error message may be eliminated by adding
+                the<replaceable>
+                ip6tables-</replaceable><replaceable>target</replaceable> as a
+                builtin action in <ulink
+                url="/manpages6/shorewall6-actions.html">shorewall-actions</ulink>(5).</para>
+
+                <important>
+                  <para>If you specify REJECT as the
+                  <replaceable>ip6tables-target</replaceable>, the target of
+                  the rule will be the i6ptables REJECT target and not
+                  Shorewall's builtin 'reject' chain which is used when REJECT
+                  (see below) is specified as the
+                  <replaceable>target</replaceable> in the ACTION
+                  column.</para>
+                </important>
+              </listitem>
+            </varlistentry>
+
             <varlistentry>
               <term><emphasis
               role="bold">LOG:<replaceable>level</replaceable></emphasis></term>
@@ -594,7 +630,7 @@
                 <para>Added in Shorewall 4.5.9.3. Queues matching packets to a
                 back end logging daemon via a netlink socket then continues to
                 the next rule. See <ulink
-                url="/shorewall.logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
+                url="/shorewall_logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
 
                 <para>The <replaceable>nflog-parameters</replaceable> are a
                 comma-separated list of up to 3 numbers:</para>
@@ -675,7 +711,8 @@
                 <para>Excludes the connection from any subsequent <emphasis
                 role="bold">DNAT</emphasis>[-] or <emphasis
                 role="bold">REDIRECT</emphasis>[-] rules but doesn't generate
-                a rule to accept the traffic.</para>
+                a rule to accept the traffic. Use with IPv6 requires Shorewall
+                4.5.14 or later.</para>
               </listitem>
             </varlistentry>
 
@@ -710,7 +747,7 @@
 
                 <para>Beginning with Shorewall 5.0.8, the type of reject may
                 be specified in the <replaceable>option</replaceable>
-                paramater. Valid <replaceable>option</replaceable> values
+                paramater. Valid IPv4 <replaceable>option</replaceable> values
                 are:</para>
 
                 <simplelist>
@@ -733,6 +770,28 @@
                   option may also be specified as
                   <option>tcp-reset</option>.</member>
                 </simplelist>
+
+                <para>Valid IPv6 <replaceable>option</replaceable> values
+                are:</para>
+
+                <simplelist>
+                  <member><option>icmp6-no-route</option></member>
+
+                  <member><option>no-route</option></member>
+
+                  <member><option>i</option><option>cmp6-adm-prohibited</option></member>
+
+                  <member><option>adm-prohibited</option></member>
+
+                  <member><option>icmp6-addr-unreachable</option></member>
+
+                  <member><option>addr-unreach</option></member>
+
+                  <member><option>icmp6-port-unreachable</option></member>
+
+                  <member><option>tcp-reset</option> (the PROTO column must
+                  specify TCP)</member>
+                </simplelist>
               </listitem>
             </varlistentry>
 
@@ -751,7 +810,8 @@
 
               <listitem>
                 <para>Redirect the request to a server running on the
-                firewall.</para>
+                firewall. Use with IPv6 requires Shorewall 4.5.14 or
+                later.</para>
               </listitem>
             </varlistentry>
 
@@ -764,7 +824,8 @@
                 <para>Like <emphasis role="bold">REDIRECT</emphasis> but only
                 generates the <emphasis role="bold">REDIRECT</emphasis>
                 iptables rule and not the companion <emphasis
-                role="bold">ACCEPT</emphasis> rule.</para>
+                role="bold">ACCEPT</emphasis> rule. Use with IPv6 requires
+                Shorewall 4.5.14 or later.</para>
               </listitem>
             </varlistentry>
 
@@ -844,10 +905,10 @@
               role="bold">ULOG</emphasis>[(<replaceable>ulog-parameters</replaceable>)]</term>
 
               <listitem>
-                <para>Added in Shorewall 4.5.10. Queues matching packets to a
-                back end logging daemon via a netlink socket then continues to
-                the next rule. See <ulink
-                url="/shorewall.logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
+                <para>IPv4 only. Added in Shorewall 4.5.10. Queues matching
+                packets to a back end logging daemon via a netlink socket then
+                continues to the next rule. See <ulink
+                url="/shorewall_logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
 
                 <para>Similar to<emphasis role="bold">
                 LOG:ULOG</emphasis>[(<replaceable>ulog-parameters</replaceable>)],
@@ -891,10 +952,10 @@
             </listitem>
           </itemizedlist>
 
-          <para>You may also specify <emphasis role="bold">ULOG</emphasis> or
-          <emphasis role="bold">NFLOG</emphasis> (must be in upper case) as a
-          log level.This will log to the ULOG or NFLOG target for routing to a
-          separate log through use of ulogd (<ulink
+          <para>You may also specify <emphasis role="bold">ULOG</emphasis>
+          (IPv4 only) or <emphasis role="bold">NFLOG</emphasis> (must be in
+          upper case) as a log level.This will log to the ULOG or NFLOG target
+          for routing to a separate log through use of ulogd (<ulink
           url="http://www.netfilter.org/projects/ulogd/index.html">http://www.netfilter.org/projects/ulogd/index.html</ulink>).</para>
 
           <para>Actions specifying logging may be followed by a log tag (a
@@ -924,9 +985,9 @@
 
               <listitem>
                 <para>The name of a zone defined in <ulink
-                url="shorewall-zones.html">shorewall-zones</ulink>(5). When
-                only the zone name is specified, the packet source may be any
-                host in that zone.</para>
+                url="/manpages/shorewall-zones.html">shorewall-zones</ulink>(5).
+                When only the zone name is specified, the packet source may be
+                any host in that zone.</para>
 
                 <para>zone may also be one of the following:</para>
 
@@ -991,11 +1052,12 @@
                 <replaceable>interface</replaceable> must be the name of an
                 interface associated with the named
                 <replaceable>zone</replaceable> in either <ulink
-                url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
+                url="/manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
                 or <ulink
-                url="shorewall.hosts.html">shorewall-hosts</ulink>(5). Only
-                packets from hosts in the <replaceable>zone</replaceable> that
-                arrive through the named interface will match the rule.</para>
+                url="/manpages/shorewall.hosts.html">shorewall-hosts</ulink>(5).
+                Only packets from hosts in the <replaceable>zone</replaceable>
+                that arrive through the named interface will match the
+                rule.</para>
               </listitem>
             </varlistentry>
 
@@ -1009,7 +1071,7 @@
                   <listitem>
                     <para>A host or network IP address. A network address may
                     be followed by exclusion (see <ulink
-                    url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
+                    url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
                   </listitem>
 
                   <listitem>
@@ -1069,7 +1131,7 @@
               <listitem>
                 <para>This form matches if the host IP address does not match
                 any of the entries in the exclusion (see <ulink
-                url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
+                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
               </listitem>
             </varlistentry>
 
@@ -1210,6 +1272,49 @@
                 of the net zone.</para>
               </listitem>
             </varlistentry>
+
+            <varlistentry>
+              <term>dmz:[2002:ce7c:2b4:1::2]</term>
+
+              <listitem>
+                <para>Host 2002:ce7c:92b4:1::2 in the DMZ</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>net:2001:4d48:ad51:24::/64</term>
+
+              <listitem>
+                <para>Subnet 2001:4d48:ad51:24::/64 on the Internet</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>loc:[2002:cec792b4:1::2],[2002:cec792b4:1::44]</term>
+
+              <listitem>
+                <para>Hosts 2002:cec792b4:1::2 and 2002:cec792b4:1::44 in the
+                local zone.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>loc:~00-A0-C9-15-39-78</term>
+
+              <listitem>
+                <para>Host in the local zone with MAC address
+                00:A0:C9:15:39:78.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>net:[2001:4d48:ad51:24::]/64![2001:4d48:ad51:24:6::]/80</term>
+
+              <listitem>
+                <para>Subnet 2001:4d48:ad51:24::/64 on the Internet except for
+                2001:4d48:ad51:24:6::/80.</para>
+              </listitem>
+            </varlistentry>
           </variablelist>
         </listitem>
       </varlistentry>
@@ -1231,9 +1336,9 @@
 
               <listitem>
                 <para>The name of a zone defined in <ulink
-                url="shorewall-zones.html">shorewall-zones</ulink>(5). When
-                only the zone name is specified, the packet destination may be
-                any host in that zone.</para>
+                url="/manpages/shorewall-zones.html">shorewall-zones</ulink>(5).
+                When only the zone name is specified, the packet destination
+                may be any host in that zone.</para>
 
                 <para>zone may also be one of the following:</para>
 
@@ -1298,11 +1403,11 @@
                 <replaceable>interface</replaceable> must be the name of an
                 interface associated with the named
                 <replaceable>zone</replaceable> in either <ulink
-                url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
+                url="/manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>(5)
                 or <ulink
-                url="shorewall.hosts.html">shorewall-hosts</ulink>(5). Only
-                packets to hosts in the <replaceable>zone</replaceable> that
-                are sent through the named interface will match the
+                url="/manpages/shorewall-hosts.html">shorewall-hosts</ulink>(5).
+                Only packets to hosts in the <replaceable>zone</replaceable>
+                that are sent through the named interface will match the
                 rule.</para>
               </listitem>
             </varlistentry>
@@ -1317,7 +1422,7 @@
                   <listitem>
                     <para>A host or network IP address. A network address may
                     be followed by exclusion (see <ulink
-                    url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
+                    url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
                   </listitem>
 
                   <listitem>
@@ -1372,7 +1477,7 @@
               <listitem>
                 <para>This form matches if the host IP address does not match
                 any of the entries in the exclusion (see <ulink
-                url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
+                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).</para>
               </listitem>
             </varlistentry>
 
@@ -2084,12 +2189,100 @@
       </varlistentry>
 
       <varlistentry>
-        <term><emphasis role="bold">HEADERS</emphasis></term>
+        <term><emphasis role="bold">HEADERS -
+        [!][any:|exactly:]</emphasis><replaceable>header-list
+        </replaceable>(Optional - Added in Shorewall 4.4.15)</term>
 
         <listitem>
-          <para>Added in Shorewall 4.4.15. Not used in IPv4 configurations. If
-          you with to supply a value for one of the later columns, enter '-'
-          in this column.</para>
+          <para>This column is only used in IPv6. In IPv4, supply "-" in this
+          column if you with to place a value in one of the following
+          columns.</para>
+
+          <para>The <replaceable>header-list</replaceable> consists of a
+          comma-separated list of headers from the following list.</para>
+
+          <variablelist>
+            <varlistentry>
+              <term><emphasis role="bold">auth</emphasis>, <emphasis
+              role="bold">ah</emphasis>, or <emphasis
+              role="bold">51</emphasis></term>
+
+              <listitem>
+                <para><firstterm>Authentication Headers</firstterm> extension
+                header.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">esp</emphasis>, or <emphasis
+              role="bold">50</emphasis></term>
+
+              <listitem>
+                <para><firstterm>Encrypted Security Payload</firstterm>
+                extension header.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">hop</emphasis>, <emphasis
+              role="bold">hop-by-hop</emphasis> or <emphasis
+              role="bold">0</emphasis></term>
+
+              <listitem>
+                <para>Hop-by-hop options extension header.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">route</emphasis>, <emphasis
+              role="bold">ipv6-route</emphasis> or <emphasis
+              role="bold">43</emphasis></term>
+
+              <listitem>
+                <para>IPv6 Route extension header.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">frag</emphasis>, <emphasis
+              role="bold">ipv6-frag</emphasis> or <emphasis
+              role="bold">44</emphasis></term>
+
+              <listitem>
+                <para>IPv6 fragmentation extension header.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">none</emphasis>, <emphasis
+              role="bold">ipv6-nonxt</emphasis> or <emphasis
+              role="bold">59</emphasis></term>
+
+              <listitem>
+                <para>No next header</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><emphasis role="bold">proto</emphasis>, <emphasis
+              role="bold">protocol</emphasis> or <emphasis
+              role="bold">255</emphasis></term>
+
+              <listitem>
+                <para>Any protocol header.</para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
+
+          <para>If <emphasis role="bold">any:</emphasis> is specified, the
+          rule will match if any of the listed headers are present. If
+          <emphasis role="bold">exactly:</emphasis> is specified, the will
+          match packets that exactly include all specified headers. If neither
+          is given, <emphasis role="bold">any:</emphasis> is assumed.</para>
+
+          <para>If <emphasis role="bold">!</emphasis> is entered, the rule
+          will match those packets which would not be matched when <emphasis
+          role="bold">!</emphasis> is omitted.</para>
         </listitem>
       </varlistentry>
 
@@ -2415,6 +2608,20 @@
         SECCTX             builtin</programlisting>
         </listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term>Example 15:</term>
+
+        <listitem>
+          <para>You want to accept SSH connections to your firewall only from
+          internet IP addresses 2002:ce7c::92b4:1::2 and
+          2002:ce7c::92b4:1::22</para>
+
+          <programlisting>        #ACTION  SOURCE DEST            PROTO   DPORT   SPORT   ORIGDEST
+        ACCEPT   net:&lt;2002:ce7c::92b4:1::2,2002:ce7c::92b4:1::22&gt; \
+                        $FW              tcp     22</programlisting>
+        </listitem>
+      </varlistentry>
     </variablelist>
   </refsect1>
 
@@ -2422,6 +2629,8 @@
     <title>FILES</title>
 
     <para>/etc/shorewall/rules</para>
+
+    <para>/etc/shorewall6/rules</para>
   </refsect1>
 
   <refsect1>
@@ -2436,14 +2645,6 @@
     <para><ulink
     url="/shorewall_logging.html">http://www.shorewall.net/shorewall_logging.html</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-blrules(5), shorewall-hosts(5),
-    shorewall_interfaces(5), shorewall-ipsets(5), shorewall-maclist(5),
-    shorewall-masq(5), shorewall-nat(5), shorewall-netmap(5),
-    shorewall-params(5), shorewall-policy(5), shorewall-providers(5),
-    shorewall-proxyarp(5), shorewall-rtrules(5), shorewall-routestopped(5),
-    shorewall.conf(5), shorewall-secmarks(5), shorewall-tcclasses(5),
-    shorewall-tcdevices(5), shorewall-mangle(5), shorewall-tos(5),
-    shorewall-tunnels(5), shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-secmarks.xml

@@ -18,7 +18,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/secmarks</command>
+      <command>/etc/shorewall[6]/secmarks</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -229,7 +229,7 @@
         role="bold">all}[,...]</emphasis></term>
 
         <listitem>
-          <para> See <ulink
+          <para>See <ulink
           url="shorewall-rules.html">shorewall-rules(5)</ulink> for
           details.</para>
 
@@ -404,6 +404,8 @@ RESTORE                               I:ER</programlisting>
     <title>FILES</title>
 
     <para>/etc/shorewall/secmarks</para>
+
+    <para>/etc/shorewall6/secmarks</para>
   </refsect1>
 
   <refsect1>
@@ -415,14 +417,6 @@ RESTORE                               I:ER</programlisting>
     <para><ulink
     url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
-    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
-    shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
-    shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5),
-    shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
-    shorewall-mangle(5), shorewall-tos(5), shorewall-tunnels(5),
-    shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-snat.xml

@@ -18,7 +18,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/snat</command>
+      <command>/etc/shorewall[6]/snat</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -27,7 +27,7 @@
 
     <para>This file is used to define dynamic NAT (Masquerading) and to define
     Source NAT (SNAT). It superseded <ulink
-    url="shorewall-masq.html">shorewall-masq</ulink>(5) in Shorewall
+    url="/manpages/shorewall-masq.html">shorewall-masq</ulink>(5) in Shorewall
     5.0.14.</para>
 
     <warning>
@@ -86,7 +86,7 @@
                 ADD_SNAT_ALIASES is set to Yes or yes in <ulink
                 url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5)
                 then Shorewall will automatically add this address to the
-                INTERFACE named in the first column.</para>
+                INTERFACE named in the first column (IPv4 only).</para>
 
                 <para>You may also specify a range of up to 256 IP addresses
                 if you want the SNAT address to be assigned from that range in
@@ -105,9 +105,7 @@
                 role="bold">:random</emphasis>) with <emphasis
                 role="bold">:persistent</emphasis>. This is only useful when
                 an address range is specified and causes a client to be given
-                the same source/destination IP pair. This feature replaces the
-                SAME modifier which was removed from Shorewall in version
-                4.4.0.</para>
+                the same source/destination IP pair.</para>
 
                 <para>You may also use the special value
                 <option>detect</option> which causes Shorewall to determine
@@ -150,8 +148,8 @@
               <listitem>
                 <para>where <replaceable>action</replaceable> is an action
                 declared in <ulink
-                url="shorewall-actions.html">shorewall-actions(5)</ulink> with
-                the <option>nat</option> option. See <ulink
+                url="/manpages/shorewall-actions.html">shorewall-actions(5)</ulink>
+                with the <option>nat</option> option. See <ulink
                 url="/Actions.html">www.shorewall.net/Actions.html</ulink> for
                 further information.</para>
               </listitem>
@@ -257,7 +255,8 @@
         <listitem>
           <para>If you wish to restrict this entry to a particular protocol
           then enter the protocol name (from protocols(5)) or number here. See
-          <ulink url="shorewall-rules.html">shorewall-rules(5)</ulink> for
+          <ulink
+          url="/manpages/shorewall-rules.html">shorewall-rules(5)</ulink> for
           details.</para>
 
           <para>Beginning with Shorewall 4.5.12, this column can accept a
@@ -599,7 +598,7 @@
 
     <variablelist>
       <varlistentry>
-        <term>Example 1:</term>
+        <term>IPv4 Example 1:</term>
 
         <listitem>
           <para>You have a simple masquerading setup where eth0 connects to a
@@ -614,7 +613,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 2:</term>
+        <term>IPv4 Example 2:</term>
 
         <listitem>
           <para>You add a router to your local network to connect subnet
@@ -628,7 +627,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 3:</term>
+        <term>IPv4 Example 3:</term>
 
         <listitem>
           <para>You want all outgoing traffic from 192.168.1.0/24 through eth0
@@ -642,7 +641,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 4:</term>
+        <term>IPv4 Example 4:</term>
 
         <listitem>
           <para>You want all outgoing SMTP traffic entering the firewall from
@@ -666,7 +665,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 5:</term>
+        <term>IPv4 Example 5:</term>
 
         <listitem>
           <para>Connections leaving on eth0 and destined to any host defined
@@ -679,7 +678,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 6:</term>
+        <term>IPv4 Example 6:</term>
 
         <listitem>
           <para>SNAT outgoing connections on eth0 from 192.168.1.0/24 in
@@ -701,19 +700,34 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 7:</term>
+        <term>IPv6 Example 1:</term>
 
         <listitem>
-          <para>Your eth1 has two public IP addresses: 70.90.191.121 and
-          70.90.191.123. You want to use the iptables statistics match to
-          masquerade outgoing connections evenly between these two
-          addresses.</para>
+          <para>You have a simple 'masquerading' setup where eth0 connects to
+          a DSL or cable modem and eth1 connects to your local network with
+          subnet 2001:470:b:787::0/64</para>
+
+          <para>Your entry in the file will be:</para>
+
+          <programlisting>        #ACTION      SOURCE                  DEST
+        MASQUERADE   2001:470:b:787::0/64    eth0</programlisting>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>IPv6 Example 2:</term>
+
+        <listitem>
+          <para>Your sit1 interface has two public IP addresses:
+          2001:470:a:227::1 and 2001:470:b:227::1. You want to use the
+          iptables statistics match to masquerade outgoing connections evenly
+          between these two addresses.</para>
 
           <programlisting>/etc/shorewall/snat:
 
-       #ACTION                 SOURCE           DEST
-       SNAT(70.90.191.121)     -                eth1 { probability=.50 }
-       SNAT(70.90.191.123)     -                eth1</programlisting>
+       #ACTION                      SOURCE     DEST
+       SNAT(2001:470:a:227::1)      ::/0       sit1              { probability=0.50 }
+       SNAT(2001:470:a:227::2)      ::/0       sit</programlisting>
         </listitem>
       </varlistentry>
     </variablelist>
@@ -723,6 +737,8 @@
     <title>FILES</title>
 
     <para>/etc/shorewall/snat</para>
+
+    <para>/etc/shorewall6/snat</para>
   </refsect1>
 
   <refsect1>
@@ -731,14 +747,6 @@
     <para><ulink
     url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-exclusion(5), shorewall-hosts(5),
-    shorewall_interfaces(5), shorewall-ipsets(5), shorewall-maclist(5),
-    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
-    shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
-    shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5),
-    shorewall.conf(5), shorewall-secmarks(5), shorewall-tcclasses(5),
-    shorewall-tcdevices(5), shorewall-mangle(5), shorewall-tos(5),
-    shorewall-tunnels(5), shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-stoppedrules.xml

@@ -19,7 +19,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/stoppedrules</command>
+      <command>/etc/shorewall[6]/stoppedrules</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -153,6 +153,8 @@
     <title>FILES</title>
 
     <para>/etc/shorewall/stoppedrules</para>
+
+    <para>/etc/shorewall6/stoppedrules</para>
   </refsect1>
 
   <refsect1>
@@ -164,14 +166,6 @@
     <para><ulink
     url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
-    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
-    shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
-    shorewall-rtrules(5), shorewall-rules(5), shorewall.conf(5),
-    shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
-    shorewall-mangle(5), shorewall-tos(5), shorewall-tunnels(5),
-    shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-tcclasses.xml

@@ -18,7 +18,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/tcclasses</command>
+      <command>/etc/shorewall[6]/tcclasses</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -763,6 +763,8 @@
     <title>FILES</title>
 
     <para>/etc/shorewall/tcclasses</para>
+
+    <para>/etc/shorewall6/tcclasses</para>
   </refsect1>
 
   <refsect1>
@@ -778,14 +780,6 @@
 
     <para>tc-red(8)</para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
-    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
-    shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
-    shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5),
-    shorewall.conf(5), shorewall-secmarks(5), shorewall-tcdevices(5),
-    shorewall-mangle(5), shorewall-tos(5), shorewall-tunnels(5),
-    shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-tcdevices.xml

@@ -18,7 +18,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/tcdevices</command>
+      <command>/etc/shorewall[6]/tcdevices</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -276,6 +276,8 @@
     <title>FILES</title>
 
     <para>/etc/shorewall/tcdevices</para>
+
+    <para>/etc/shorewall6/tcdevices</para>
   </refsect1>
 
   <refsect1>
@@ -292,14 +294,6 @@
     <para><ulink
     url="http://ace-host.stuart.id.au/russell/files/tc/doc/estimators.txt">http://ace-host.stuart.id.au/russell/files/tc/doc/estimators.txt</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
-    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
-    shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
-    shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5),
-    shorewall.conf(5), shorewall-secmarks(5), shorewall-tcclasses(5),
-    shorewall-mangle(5), shorewall-tos(5), shorewall-tunnels(5),
-    shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-tcfilters.xml

@@ -18,7 +18,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/tcfilters</command>
+      <command>/etc/shorewall[6]/tcfilters</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -89,12 +89,12 @@
           Beginning with Shorewall 4.6.0, an ipset name (prefixed with '+')
           may be used if your kernel and ip6tables have the <firstterm>Basic
           Ematch</firstterm> capability and you set BASIC_FILTERS=Yes in
-          <ulink url="shorewall.conf.html">shorewall.conf (5)</ulink>. The
-          ipset name may optionally be followed by a number or a comma
-          separated list of src and/or dst enclosed in square brackets
-          ([...]). See <ulink
-          url="shorewall-ipsets.html">shorewall-ipsets(5)</ulink> for
-          details.</para>
+          <ulink url="/manpages/shorewall.conf.html">shorewall.conf
+          (5)</ulink>. The ipset name may optionally be followed by a number
+          or a comma separated list of src and/or dst enclosed in square
+          brackets ([...]). See <ulink
+          url="/manpages/shorewall-ipsets.html">shorewall-ipsets(5)</ulink>
+          for details.</para>
         </listitem>
       </varlistentry>
 
@@ -108,12 +108,12 @@
           Beginning with Shorewall 4.6.0, an ipset name (prefixed with '+')
           may be used if your kernel and ip6tables have the <firstterm>Basic
           Ematch</firstterm> capability and you set BASIC_FILTERS=Yes in
-          <ulink url="shorewall.conf.html">shorewall.conf (5)</ulink>. The
-          ipset name may optionally be followed by a number or a comma
-          separated list of src and/or dst enclosed in square brackets
-          ([...]). See <ulink
-          url="shorewall-ipsets.html">shorewall-ipsets(5)</ulink> for
-          details.</para>
+          <ulink url="/manpages/shorewall.conf.html">shorewall.conf
+          (5)</ulink>. The ipset name may optionally be followed by a number
+          or a comma separated list of src and/or dst enclosed in square
+          brackets ([...]). See <ulink
+          url="/manpages/shorewall-ipsets.html">shorewall-ipsets(5)</ulink>
+          for details.</para>
 
           <para>You may exclude certain hosts from the set already defined
           through use of an <emphasis>exclusion</emphasis> (see <ulink
@@ -288,7 +288,7 @@
 
     <variablelist>
       <varlistentry>
-        <term>Example 1:</term>
+        <term>IPv4 Example 1:</term>
 
         <listitem>
           <para>Place all 'ping' traffic on interface 1 in class 10. Note that
@@ -310,7 +310,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 2:</term>
+        <term>IPv4 Example 2:</term>
 
         <listitem>
           <para>Add two filters with priority 10 (Shorewall 4.5.8 or
@@ -324,6 +324,22 @@
        1:10      0.0.0.0/0 0.0.0.0/0    icmp    echo-reply      10</programlisting>
         </listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term>IPv6 Example 1:</term>
+
+        <listitem>
+          <para>Add two filters with priority 10 (Shorewall 4.5.8 or
+          later).</para>
+
+          <programlisting>       #CLASS    SOURCE    DEST         PROTO   DPORT           PRIORITY
+
+       IPV6
+
+       1:10      ::/0      ::/0         icmp    echo-request    10
+       1:10      ::/0      ::/0         icmp    echo-reply      10</programlisting>
+        </listitem>
+      </varlistentry>
     </variablelist>
   </refsect1>
 
@@ -331,6 +347,8 @@
     <title>FILES</title>
 
     <para>/etc/shorewall/tcfilters</para>
+
+    <para>/etc/shorewall6/tcfilters</para>
   </refsect1>
 
   <refsect1>
@@ -348,14 +366,6 @@
     <para><ulink
     url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-ecn(5), shorewall-exclusion(5),
-    shorewall-hosts(5), shorewall_interfaces(5), shorewall-ipsets(5),
-    shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5),
-    shorewall-netmap(5), shorewall-params(5), shorewall-policy(5),
-    shorewall-providers(5), shorewall-proxyarp(5), shorewall-rtrules(5),
-    shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
-    shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
-    shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-tcinterfaces.xml

@@ -18,7 +18,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/tcinterfaces</command>
+      <command>/etc/shorewall[6]/tcinterfaces</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -201,7 +201,9 @@
   <refsect1>
     <title>FILES</title>
 
-    <para>/etc/shorewall/tcinterfaces.</para>
+    <para>/etc/shorewall/tcinterfaces</para>
+
+    <para>/etc/shorewall6/tcinterfaces</para>
   </refsect1>
 
   <refsect1>
@@ -213,14 +215,6 @@
     <para><ulink
     url="http://ace-host.stuart.id.au/russell/files/tc/doc/estimators.txt">http://ace-host.stuart.id.au/russell/files/tc/doc/estimators.txt</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
-    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
-    shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
-    shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5),
-    shorewall.conf(5), shorewall-secmarks(5), shorewall-tcpri(5),
-    shorewall-mangle(5), shorewall-tos(5), shorewall-tunnels(5),
-    shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-tcpri.xml

@@ -18,7 +18,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/tcpri</command>
+      <command>/etc/shorewall[6]/tcpri</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -148,6 +148,8 @@
     <title>FILES</title>
 
     <para>/etc/shorewall/tcpri</para>
+
+    <para>/etc/shorewall6/tcpri</para>
   </refsect1>
 
   <refsect1>
@@ -156,14 +158,6 @@
     <para><ulink
     url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
 
-    <para>prio(8), shorewall(8), shorewall-accounting(5),
-    shorewall-actions(5), shorewall-blacklist(5), shorewall-hosts(5),
-    shorewall_interfaces(5), shorewall-ipsets(5), shorewall-maclist(5),
-    shorewall-masq(5), shorewall-nat(5), shorewall-netmap(5),
-    shorewall-params(5), shorewall-policy(5), shorewall-providers(5),
-    shorewall-proxyarp(5), shorewall-rtrules(5), shorewall-routestopped(5),
-    shorewall-rules(5), shorewall.conf(5), shorewall-secmarks(5),
-    shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-mangle(5),
-    shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
+    <para>prio(8), shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-tunnels.xml

@@ -18,7 +18,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/tunnels</command>
+      <command>/etc/shorewall[6]/tunnels</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -173,7 +173,7 @@
 
     <variablelist>
       <varlistentry>
-        <term>Example 1:</term>
+        <term>IPv4 Example 1:</term>
 
         <listitem>
           <para>IPSec tunnel.</para>
@@ -187,7 +187,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 2:</term>
+        <term>IPv4 Example 2:</term>
 
         <listitem>
           <para>Road Warrior (LapTop that may connect from anywhere) where the
@@ -199,7 +199,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 3:</term>
+        <term>IPv4 Example 3:</term>
 
         <listitem>
           <para>Host 4.33.99.124 is a standalone system connected via an ipsec
@@ -211,7 +211,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 4:</term>
+        <term>IPv4 Example 4:</term>
 
         <listitem>
           <para>Road Warriors that may belong to zones vpn1, vpn2 or vpn3. The
@@ -225,7 +225,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 5:</term>
+        <term>IPv4 Example 5:</term>
 
         <listitem>
           <para>You run the Linux PPTP client on your firewall and connect to
@@ -237,7 +237,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 6:</term>
+        <term>IPv4 Example 6:</term>
 
         <listitem>
           <para>You run a PPTP server on your firewall.</para>
@@ -260,7 +260,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 8:</term>
+        <term>IPv4 Example 8:</term>
 
         <listitem>
           <para>You have a tunnel that is not one of the supported types. Your
@@ -273,7 +273,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Example 9:</term>
+        <term>IPv4 Example 9:</term>
 
         <listitem>
           <para>TINC tunnel where the remote gateways are not specified. If
@@ -284,6 +284,83 @@
         tinc             net     0.0.0.0/0</programlisting>
         </listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term>IPv6 Example 1:</term>
+
+        <listitem>
+          <para>IPSec tunnel.</para>
+
+          <para>The remote gateway is 2001:cec792b4:1::44. The tunnel does not
+          use the AH protocol</para>
+
+          <programlisting>        #TYPE           ZONE    GATEWAY
+        ipsec:noah      net     2002:cec792b4:1::44</programlisting>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>IPv6 Example 2:</term>
+
+        <listitem>
+          <para>Road Warrior (LapTop that may connect from anywhere) where the
+          "gw" zone is used to represent the remote LapTop</para>
+
+          <programlisting>        #TYPE           ZONE    GATEWAY                 GATEWAY ZONES
+        ipsec           net     ::/0                    gw</programlisting>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>IPv6 Example 3:</term>
+
+        <listitem>
+          <para>Host 2001:cec792b4:1::44 is a standalone system connected via
+          an ipsec tunnel to the firewall system. The host is in zone
+          gw.</para>
+
+          <programlisting>        #TYPE           ZONE    GATEWAY                 GATEWAY ZONES
+        ipsec           net     2001:cec792b4:1::44     gw</programlisting>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>IPv6 Example 4:</term>
+
+        <listitem>
+          <para>OPENVPN tunnel. The remote gateway is 2001:cec792b4:1::44 and
+          openvpn uses port 7777.</para>
+
+          <programlisting>        #TYPE           ZONE    GATEWAY                 GATEWAY ZONES
+        openvpn:7777    net     2001:cec792b4:1::44</programlisting>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>IPv6 Example 8:</term>
+
+        <listitem>
+          <para>You have a tunnel that is not one of the supported types. Your
+          tunnel uses UDP port 4444. The other end of the tunnel is
+          2001:cec792b4:1::44.</para>
+
+          <programlisting>        #TYPE            ZONE    GATEWAY                GATEWAY ZONES
+        generic:udp:4444 net     2001:cec792b4:1::44</programlisting>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>IPv6 Example 9:</term>
+
+        <listitem>
+          <para>TINC tunnel where the remote gateways are not specified. If
+          you wish to specify a list of gateways, you can do so in the GATEWAY
+          column.</para>
+
+          <programlisting>        #TYPE            ZONE    GATEWAY          GATEWAY ZONES
+        tinc             net     ::/0</programlisting>
+        </listitem>
+      </varlistentry>
     </variablelist>
   </refsect1>
 
@@ -291,6 +368,8 @@
     <title>FILES</title>
 
     <para>/etc/shorewall/tunnels</para>
+
+    <para>/etc/shorewall6/tunnels</para>
   </refsect1>
 
   <refsect1>
@@ -299,14 +378,6 @@
     <para><ulink
     url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
-    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
-    shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
-    shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5),
-    shorewall.conf(5), shorewall-secmarks(5), shorewall-tcclasses(5),
-    shorewall-tcdevices(5), shorewall-mangle(5), shorewall-tos(5),
-    shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-vardir.xml

@@ -18,7 +18,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>/etc/shorewall/vardir</command>
+      <command>/etc/shorewall[6]/vardir</command>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -28,7 +28,8 @@
     <para>This file does not exist by default. You may create the file if you
     want to change the directory used by Shorewall to store state information,
     including compiled firewall scripts. By default, the directory used is
-    <filename>/var/lib/shorewall/</filename>.</para>
+    <filename>/var/lib/shorewall/</filename> for IPv4 and /var/lib/shorewall6/
+    for IPv6</para>
 
     <para>The file contains a single variable assignment:</para>
 
@@ -50,19 +51,13 @@
     <title>FILES</title>
 
     <para>/etc/shorewall/vardir</para>
+
+    <para>/etc/shorewall6/vardir</para>
   </refsect1>
 
   <refsect1>
     <title>See ALSO</title>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
-    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
-    shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
-    shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5),
-    shorewall.conf(5), shorewall-secmarks(5), shorewall-tcclasses(5),
-    shorewall-tcdevices(5), shorewall-mangle(5), shorewall-tos(5),
-    shorewall-tunnels(5), shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall-zones.xml

@@ -55,14 +55,14 @@
             <para>The maximum length of an iptables log prefix is 29 bytes. As
             explained in <ulink
             url="/manpages/shorewall.conf.html">shorewall.conf</ulink> (5),
-            the default LOGPREFIX formatting string is “Shorewall:%s:%s:”
-            where the first %s is replaced by the chain name and the second is
-            replaced by the disposition.</para>
+            the legacy default LOGPREFIX formatting string is
+            “Shorewall:%s:%s:” where the first %s is replaced by the chain
+            name and the second is replaced by the disposition.</para>
 
             <itemizedlist>
               <listitem>
-                <para>The default formatting string has 12 fixed characters
-                ("Shorewall" and three colons).</para>
+                <para>The "Shorewall:%s:%s:" formatting string has 12 fixed
+                characters ("Shorewall" and three colons).</para>
               </listitem>
 
               <listitem>
@@ -90,6 +90,29 @@
                 </simplelist>
               </listitem>
             </itemizedlist>
+
+            <para>In Shorewall 5.1.0, the LOGFORMAT in the default and sample
+            shorewall.conf files was changed to "%s:%s ".</para>
+
+            <itemizedlist>
+              <listitem>
+                <para>That formatting string has 2 fixed characters (":" and a
+                space).</para>
+              </listitem>
+
+              <listitem>
+                <para>So the maximum zone name length M is calculated
+                as:</para>
+
+                <simplelist>
+                  <member>2 + 6 + 2*M + 1 = 29</member>
+
+                  <member>2M = 29 - 2 + 6 + 1 = 20</member>
+
+                  <member>M = 10</member>
+                </simplelist>
+              </listitem>
+            </itemizedlist>
           </blockquote>
 
           <para>The order in which Shorewall matches addresses from packets to
@@ -105,9 +128,9 @@
           <para>Example:</para>
 
           <programlisting>#ZONE     TYPE     OPTIONS         IN OPTIONS        OUT OPTIONS
-a         ipv4
-b         ipv4
-c:a,b     ipv4</programlisting>
+a         ip
+b         ip
+c:a,b     ip</programlisting>
 
           <para>Currently, Shorewall uses this information to reorder the zone
           list so that parent zones appear after their subzones in the list.
@@ -117,8 +140,8 @@ c:a,b     ipv4</programlisting>
 
           <para>Where an <emphasis role="bold">ipsec</emphasis> zone is
           explicitly included as a child of an <emphasis
-          role="bold">ipv4</emphasis> zone, the ruleset allows CONTINUE
-          policies (explicit or implicit) to work as expected.</para>
+          role="bold">ip</emphasis> zone, the ruleset allows CONTINUE policies
+          (explicit or implicit) to work as expected.</para>
 
           <para>In the future, Shorewall may make additional use of nesting
           information.</para>
@@ -131,7 +154,7 @@ c:a,b     ipv4</programlisting>
         <listitem>
           <variablelist>
             <varlistentry>
-              <term><emphasis role="bold">ipv4</emphasis></term>
+              <term><emphasis role="bold">ip</emphasis></term>
 
               <listitem>
                 <para>This is the standard Shorewall zone type and is the
@@ -139,17 +162,22 @@ c:a,b     ipv4</programlisting>
                 the column. Communication with some zone hosts may be
                 encrypted. Encrypted hosts are designated using the 'ipsec'
                 option in <ulink
-                url="/manpages/shorewall-hosts.html">shorewall-hosts</ulink>(5).</para>
+                url="/manpages/shorewall-hosts.html">shorewall-hosts</ulink>(5).
+                For clarity, this zone type may be specified as
+                <option>ipv4</option> in IPv4 configurations and
+                <option>ipv6</option> in IPv6 configurations.</para>
               </listitem>
             </varlistentry>
 
             <varlistentry>
-              <term><emphasis role="bold">ipsec</emphasis> (or <emphasis
-              role="bold">ipsec4</emphasis>)</term>
+              <term><emphasis role="bold">ipsec</emphasis></term>
 
               <listitem>
                 <para>Communication with all zone hosts is encrypted. Your
-                kernel and iptables must include policy match support.</para>
+                kernel and iptables must include policy match support. For
+                clarity, this zone type may be specified as
+                <option>ipsec4</option> in IPv4 configurations and
+                <option>ipsec6</option> in IPv6 configurations.</para>
               </listitem>
             </varlistentry>
 
@@ -167,12 +195,13 @@ c:a,b     ipv4</programlisting>
             </varlistentry>
 
             <varlistentry>
-              <term><emphasis role="bold">bport</emphasis> (or <emphasis
-              role="bold">bport4</emphasis>)</term>
+              <term><emphasis role="bold">bport</emphasis></term>
 
               <listitem>
                 <para>The zone is associated with one or more ports on a
-                single bridge.</para>
+                single bridge. For clarity, this zone type may be specified as
+                <option>bport4</option> in IPv4 configurations and
+                <option>bport6</option> in IPv6 configurations.</para>
               </listitem>
             </varlistentry>
 
@@ -401,6 +430,8 @@ c:a,b     ipv4</programlisting>
     <title>FILES</title>
 
     <para>/etc/shorewall/zones</para>
+
+    <para>/etc/shorewall6/zones</para>
   </refsect1>
 
   <refsect1>
@@ -412,13 +443,6 @@ c:a,b     ipv4</programlisting>
     <para><ulink
     url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-hosts(5), shorewall_interfaces(5), shorewall-ipsets(5),
-    shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5),
-    shorewall-nesting(8), shorewall-netmap(5), shorewall-params(5),
-    shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
-    shorewall-rtrules(5), shorewall-rules(5), shorewall.conf(5),
-    shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
-    shorewall-mangle(5), shorewall-tos(5), shorewall-tunnels(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall/manpages/shorewall.conf.xml

@@ -20,15 +20,24 @@
     <cmdsynopsis>
       <command>/etc/shorewall/shorewall.conf</command>
     </cmdsynopsis>
+
+    <cmdsynopsis>
+      <command>/etc/shorewall6/shorewall6.conf</command>
+    </cmdsynopsis>
   </refsynopsisdiv>
 
   <refsect1>
     <title>Description</title>
 
-    <para>This file sets options that apply to Shorewall as a whole.</para>
+    <para>The IPv4 and IPv6 environments each have their own configuration.
+    The IPv4 configuration resides in /etc/shorewall/ while the IPv6
+    configuration resides in /etc/shorewall6/.</para>
 
-    <para>The file consists of Shell comments (lines beginning with '#'),
-    blank lines and assignment statements
+    <para>The .conf files set options that apply to Shorewall and Shorewall6
+    as a whole.</para>
+
+    <para>The .conf files consist of Shell comments (lines beginning with
+    '#'), blank lines and assignment statements
     (<emphasis>variable</emphasis>=<emphasis>value</emphasis>). If the
     <emphasis>value</emphasis> contains shell meta characters or white-space,
     then it must be enclosed in quotes. Example:
@@ -65,16 +74,13 @@
     level to choose, 6 (info) is a safe bet. You may specify levels by name or
     by number.</para>
 
-    <para>If you have built your kernel with ULOG and/or NFLOG target support,
-    you may also specify a log level of ULOG and/or NFLOG (must be all caps).
-    Rather than log its messages to syslogd, Shorewall will direct netfilter
-    to log the messages via the ULOG or NFLOG target which will send them to a
-    process called 'ulogd'. ulogd is available with most Linux distributions
-    (although it probably isn't installed by default). Ulogd is also available
-    from <ulink
-    url="http://www.netfilter.org/projects/ulogd/index.html">http://www.netfilter.org/projects/ulogd/index.html</ulink>
-    and can be configured to log all Shorewall messages to their own log
-    file.</para>
+    <para>If you have built your kernel with ULOG (IPv4 only) and/or NFLOG
+    target support, you may also specify a log level of ULOG and/or NFLOG
+    (must be all caps). Rather than log its messages to syslogd, Shorewall
+    will direct netfilter to log the messages via the ULOG or NFLOG target
+    which will send them to a process called 'ulogd'. ulogd is available with
+    most Linux distributions (although it probably isn't installed by
+    default).</para>
 
     <note>
       <para>If you want to specify parameters to ULOG or NFLOG (e.g.,
@@ -82,7 +88,7 @@
 
       <para>Example:</para>
 
-      <programlisting>MACLIST_LOG_LEVEL="NFLOG(1,0,1)"</programlisting>
+      <programlisting>LOG_LEVEL="NFLOG(1,0,1)"</programlisting>
     </note>
 
     <para>Beginning with Shorewall 5.0.0, the log level may be followed by a
@@ -265,8 +271,9 @@
         <listitem>
           <para>This parameter determines whether Shorewall automatically adds
           the external address(es) in <ulink
-          url="/manpages/shorewall-nat.html">shorewall-nat</ulink>(5). If the
-          variable is set to <emphasis role="bold">Yes</emphasis> or <emphasis
+          url="/manpages/shorewall-nat.html">shorewall-nat</ulink>(5), and is
+          only available in IPv4 configurations. If the variable is set to
+          <emphasis role="bold">Yes</emphasis> or <emphasis
           role="bold">yes</emphasis> then Shorewall automatically adds these
           aliases. If it is set to <emphasis role="bold">No</emphasis> or
           <emphasis role="bold">no</emphasis>, you must add these aliases
@@ -293,13 +300,14 @@
         <listitem>
           <para>This parameter determines whether Shorewall automatically adds
           the SNAT ADDRESS in <ulink
-          url="/manpages/shorewall-masq.html">shorewall-masq</ulink>(5). If
-          the variable is set to <emphasis role="bold">Yes</emphasis> or
-          <emphasis role="bold">yes</emphasis> then Shorewall automatically
-          adds these addresses. If it is set to <emphasis
-          role="bold">No</emphasis> or <emphasis role="bold">no</emphasis>,
-          you must add these addresses yourself using your distribution's
-          network configuration tools.</para>
+          url="/manpages/shorewall-masq.html">shorewall-masq</ulink>(5), and
+          is only available in IPv4 configurations. If the variable is set to
+          <emphasis role="bold">Yes</emphasis> or <emphasis
+          role="bold">yes</emphasis> then Shorewall automatically adds these
+          addresses. If it is set to <emphasis role="bold">No</emphasis> or
+          <emphasis role="bold">no</emphasis>, you must add these addresses
+          yourself using your distribution's network configuration
+          tools.</para>
 
           <para>If this variable is not set or is given an empty value
           (ADD_SNAT_ALIASES="") then ADD_SNAT_ALIASES=No is assumed.</para>
@@ -321,9 +329,9 @@
         <listitem>
           <para>The value of this variable affects Shorewall's stopped state.
           The behavior differs depending on whether <ulink
-          url="shorewall-routestopped.html">shorewall-routestopped</ulink>(5)
+          url="/manpages/shorewall-routestopped.html">shorewall-routestopped</ulink>(5)
           or <ulink
-          url="shorewall-stoppedrules.html">shorewall-stoppedrules</ulink>(5)
+          url="/manpages/shorewall-stoppedrules.html">shorewall-stoppedrules</ulink>(5)
           is used:</para>
 
           <variablelist>
@@ -379,10 +387,10 @@
         role="bold">ARPTABLES=</emphasis>[<emphasis>pathname</emphasis>]</term>
 
         <listitem>
-          <para>Added in Shorewall 4.5.12. This parameter names the arptables
-          executable to be used by Shorewall. If not specified or if specified
-          as a null value, then the arptables executable located using the
-          PATH option is used.</para>
+          <para>Added in Shorewall 4.5.12 and available in IPv4 only. This
+          parameter names the arptables executable to be used by Shorewall. If
+          not specified or if specified as a null value, then the arptables
+          executable located using the PATH option is used.</para>
 
           <para>Regardless of how the arptables utility is located (specified
           via arptables= or located via PATH), Shorewall uses the
@@ -398,8 +406,9 @@
         <listitem>
           <para>Formerly named AUTO_COMMENT. If set, if there is not a current
           comment when a macro is invoked, the behavior is as if the first
-          line of the macro file was "COMMENT &lt;macro name&gt;". The
-          AUTO_COMMENT option has a default value of 'Yes'.</para>
+          line of the macro file was "COMMENT &lt;macro name&gt;". If not
+          specified, the AUTO_COMMENT option has a default value of
+          'Yes'.</para>
         </listitem>
       </varlistentry>
 
@@ -465,7 +474,7 @@
           command, then the compilation step is skipped and the compiled
           script that executed the last <command>start</command>, <emphasis
           role="bold">reload</emphasis> or <command>restart</command> command
-          is used. The default is AUTOMAKE=No.</para>
+          is used. If not specified, the default is AUTOMAKE=No.</para>
 
           <para>The setting of the AUTOMAKE option is ignored if the
           <command>start</command>, <emphasis role="bold">reload</emphasis> or
@@ -483,8 +492,8 @@
           <para>Added in Shorewall 5.1.1. When USE_DEFAULT_RT=Yes, this option
           determines whether the <option>balance</option> provider option (see
           <ulink
-          url="shorewall-providers.html">shorewall-providers(5)</ulink>) is
-          the default. When BALANCE_PROVIDERS=Yes, then the
+          url="/manpages/shorewall-providers.html">shorewall-providers(5)</ulink>)
+          is the default. When BALANCE_PROVIDERS=Yes, then the
           <option>balance</option> option is assumed unless the
           <option>fallback</option>, <option>loose</option>,
           <option>load</option> or <option>tproxy</option> option is
@@ -500,8 +509,8 @@
         <listitem>
           <para>Added in Shorewall-4.6.0. When set to <emphasis
           role="bold">Yes</emphasis>, causes entries in <ulink
-          url="shorewall-tcfilters.html">shorewall-tcfilters(5)</ulink> to
-          generate a basic filter rather than a u32 filter. This setting
+          url="/manpages/shorewall-tcfilters.html">shorewall-tcfilters(5)</ulink>
+          to generate a basic filter rather than a u32 filter. This setting
           requires the <firstterm>Basic Ematch</firstterm> capability in your
           kernel and iptables.</para>
 
@@ -624,6 +633,11 @@
           marking defined in <ulink
           url="/manpages/shorewall-tcrules.html">shorewall-tcrules</ulink>(5).
           If not specified, CLEAR_TC=Yes is assumed.</para>
+
+          <warning>
+            <para>When you specify TC_ENABLED=shared (see below), then you
+            should also specify CLEAR_TC=No.</para>
+          </warning>
         </listitem>
       </varlistentry>
 
@@ -662,17 +676,17 @@
         role="bold">CONFIG_PATH</emphasis>=[<emphasis>directory</emphasis>[:<emphasis>directory</emphasis>]...]</term>
 
         <listitem>
-          <para>Specifies where configuration files other than shorewall.conf
-          may be found. CONFIG_PATH is specifies as a list of directory names
-          separated by colons (":"). When looking for a configuration
-          file:</para>
+          <para>Specifies where configuration files other than
+          shorewall[6].conf may be found. CONFIG_PATH is specifies as a list
+          of directory names separated by colons (":"). When looking for a
+          configuration file:</para>
 
           <itemizedlist>
             <listitem>
               <para>If the command is "try" or a "&lt;configuration
               directory&gt;" was specified in the command (e.g.,
-              <command>shorewall check ./gateway</command>) then the directory
-              given in the command is searched first.</para>
+              <command>shorewall [-6] check ./gateway</command>) then the
+              directory given in the command is searched first.</para>
             </listitem>
 
             <listitem>
@@ -697,8 +711,8 @@
         <listitem>
           <para>Added in Shorewall 4.5.12. When set to 'Yes' (the default),
           DNS names are validated in the compiler and then passed on to the
-          generated script where they are resolved by iptables-restore. This
-          is an advantage if you use AUTOMAKE=Yes and the IP address
+          generated script where they are resolved by ip[6]tables-restore.
+          This is an advantage if you use AUTOMAKE=Yes and the IP address
           associated with the DNS name is subject to change. When
           DEFER_DNS_RESOLUTION=No, DNS names are converted into IP addresses
           by the compiler. This has the advantage that when AUTOMAKE=Yes, the
@@ -715,7 +729,7 @@
 
         <listitem>
           <para>If set to Yes (the default value), entries in the
-          /etc/shorewall/rtrules files cause an 'ip rule del' command to be
+          /etc/shorewall[6]/rtrules files cause an 'ip rule del' command to be
           generated in addition to an 'ip rule add' command. Setting this
           option to No, causes the 'ip rule del' command to be omitted.</para>
         </listitem>
@@ -726,6 +740,8 @@
         role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
 
         <listitem>
+          <para>IPv4 only.</para>
+
           <para>If set to <emphasis role="bold">Yes</emphasis> or <emphasis
           role="bold">yes</emphasis>, Shorewall will detect the first IP
           address of the interface to the source zone and will include this
@@ -742,6 +758,8 @@
         role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
 
         <listitem>
+          <para>IPv4 only.</para>
+
           <para>If set to <emphasis role="bold">Yes</emphasis> or <emphasis
           role="bold">yes</emphasis>, IPv6 traffic to, from and through the
           firewall system is disabled. If set to <emphasis
@@ -761,7 +779,8 @@
             </listitem>
 
             <listitem>
-              <para>Change DISABLE_IPV6=Yes to DISABLE_IPV6=No</para>
+              <para>Change DISABLE_IPV6=Yes to DISABLE_IPV6=No in
+              <filename>/etc/shorewall/shorewall.conf</filename>.</para>
             </listitem>
 
             <listitem>
@@ -807,20 +826,21 @@
         <listitem>
           <para>Added in Shorewall 4.4.7. When set to <emphasis
           role="bold">No</emphasis> or <emphasis role="bold">no</emphasis>,
-          chain-based dynamic blacklisting using <command>shorewall
-          drop</command>, <command>shorewall reject</command>,
-          <command>shorewall logdrop</command> and <command>shorewall
-          logreject</command> is disabled. Default is <emphasis
+          chain-based dynamic blacklisting using <command>shorewall [-6] [-l]
+          drop</command>, <command>shorewall [-6] [-l] reject</command>,
+          <command>shorewall logdrop</command> and <command>shorewall [-6]
+          [-l] logreject</command> is disabled. Default is <emphasis
           role="bold">Yes</emphasis>. Beginning with Shorewall 5.0.8,
           ipset-based dynamic blacklisting using the <command>shorewall
           blacklist</command> command is also supported. The name of the set
           (<replaceable>setname</replaceable>) and the level
           (<replaceable>log_level</replaceable>), if any, at which blacklisted
-          traffic is to be logged may also be specified. The default set name
-          is SW_DBL4 and the default log level is <option>none</option> (no
-          logging). If <option>ipset-only</option> is given, then chain-based
-          dynamic blacklisting is disabled just as if DYNAMIC_BLACKLISTING=No
-          had been specified.</para>
+          traffic is to be logged may also be specified. The default IPv4 set
+          name is SW_DBL4 and the default IPv6 set name is SW_DBL6. The
+          default log level is <option>none</option> (no logging). If
+          <option>ipset-only</option> is given, then chain-based dynamic
+          blacklisting is disabled just as if DYNAMIC_BLACKLISTING=No had been
+          specified.</para>
 
           <para>Possible <replaceable>option</replaceable>s are:</para>
 
@@ -866,9 +886,9 @@
                 <important>
                   <para>Once the dynamic blacklisting ipset has been created,
                   changing this option setting requires a complete restart of
-                  the firewall; <command>shorewall restart</command> if
-                  RESTART=restart, otherwise <command>shorewall stop
-                  &amp;&amp; shorewall start</command></para>
+                  the firewall; <command>shorewall [-6] restart</command> if
+                  RESTART=restart, otherwise <command>shorewall [-6] [-l] stop
+                  &amp;&amp; shorewall [-6] [-l] start</command></para>
                 </important>
               </listitem>
             </varlistentry>
@@ -910,13 +930,15 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
 
         <listitem>
           <para>Added in Shorewall 4.4.17. When set to Yes when compiling for
-          use by Shorewall Lite (<command>shorewall load</command>,
-          <command>shorewall reload </command>or <command>shorewall
+          use by Shorewall Lite (<command>shorewall [-6]
+          remote-start</command>, <command>shorewall [-6] remote-reload,
+          shorewall [-6] remote-restart </command>or <command>shorewall [-6]
           export</command> commands), the compiler will copy the modules or
           helpers file from the administrative system into the script. When
           set to No or not specified, the compiler will not copy the modules
-          or helpers file from <filename>/usr/share/shorewall</filename> but
-          will copy those found in another location on the CONFIG_PATH.</para>
+          or helpers file from <filename>/usr/share/shorewall[6]</filename>
+          but will copy those found in another location on the
+          CONFIG_PATH.</para>
 
           <para>When compiling for direct use by Shorewall, causes the
           contents of the local module or helpers file to be copied into the
@@ -1114,10 +1136,12 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
           specificaitons</ulink> on the right.. When INLINE_MATCHES=Yes is
           specified, the specifications on the right are interpreted as if
           INLINE had been specified in the ACTION column. This also applies to
-          <ulink url="shorewall-masq.html">shorewall-masq(5)</ulink> and
-          <ulink url="shorewall-mangle.html">shorewall-mangle(5</ulink>) which
-          also support INLINE. If not specified or if specified as the empty
-          value, the value 'No' is assumed for backward compatibility.</para>
+          <ulink url="/manpages/shorewall-masq.html">shorewall-masq(5)</ulink>
+          and <ulink
+          url="/manpages/shorewall-mangle.html">shorewall-mangle(5</ulink>)
+          which also support INLINE. If not specified or if specified as the
+          empty value, the value 'No' is assumed for backward
+          compatibility.</para>
 
           <para>Beginning with Shorewall 5.0.0, it is no longer necessary to
           set INLINE_MATCHES=Yes in order to be able to specify your own
@@ -1176,9 +1200,13 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
         role="bold">Keep</emphasis>]</term>
 
         <listitem>
-          <para>This parameter determines whether Shorewall enables or
-          disables IPV4 Packet Forwarding (/proc/sys/net/ipv4/ip_forward).
-          Possible values are:</para>
+          <para>This IPv4 parameter determines whether Shorewall enables or
+          disables IPv4 Packet Forwarding
+          (<filename>/proc/sys/net/ipv4/ip_forward</filename>). In an IPv6
+          configuration, this parameter determines the setting of
+          <filename>/proc/sys/net/ipv6/config/all/ip_forwarding</filename>.</para>
+
+          <para>Possible values are:</para>
 
           <variablelist>
             <varlistentry>
@@ -1210,12 +1238,8 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
             </varlistentry>
           </variablelist>
 
-          <para/>
-
-          <blockquote>
-            <para>If this variable is not set or is given an empty value
-            (IP_FORWARD="") then IP_FORWARD=On is assumed.</para>
-          </blockquote>
+          <para>If this variable is not set or is given an empty value
+          (IP_FORWARD="") then IP_FORWARD=On is assumed.</para>
         </listitem>
       </varlistentry>
 
@@ -1258,6 +1282,8 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
         role="bold">IPTABLES=</emphasis>[<emphasis>pathname</emphasis>]</term>
 
         <listitem>
+          <para>IPv4 only.</para>
+
           <para>This parameter names the iptables executable to be used by
           Shorewall. If not specified or if specified as a null value, then
           the iptables executable located using the PATH option is
@@ -1270,22 +1296,71 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><emphasis
+        role="bold">IP6TABLES=</emphasis>[<emphasis>pathname</emphasis>]</term>
+
+        <listitem>
+          <para>IPv6 only.</para>
+
+          <para>This parameter names the ip6tables executable to be used by
+          Shorewall6. If not specified or if specified as a null value, then
+          the ip6tables executable located using the PATH option is
+          used.</para>
+
+          <para>Regardless of how the ip6tables utility is located (specified
+          via IP6TABLES= or located via PATH), Shorewall6 uses the
+          ip6tables-restore and ip6tables-save utilities from that same
+          directory.</para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><emphasis role="bold">KEEP_RT_TABLES=</emphasis>{<emphasis
         role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>}</term>
 
         <listitem>
-          <para>When set to <option>Yes</option>, this option prevents
-          generated scripts from altering the /etc/iproute2/rt_tables database
-          when there are entries in
-          <filename>/etc/shorewall/providers</filename>. If you set this
-          option to <option>Yes</option> while Shorewall (Shorewall-lite) is
-          running, you should remove the file
-          <filename>/var/lib/shorewall/rt_tables</filename>
-          (<filename>/var/lib/shorewall-lite/rt_tables</filename>) before your
-          next <command>stop</command>, <command>refresh</command>,
-          <command>restore</command>, <emphasis role="bold">reload</emphasis>
-          or <command>restart</command> command.</para>
+          <para>IPv4:</para>
+
+          <blockquote>
+            <para>When set to <option>Yes</option>, this option prevents
+            generated scripts from altering the /etc/iproute2/rt_tables
+            database when there are entries in
+            <filename>/etc/shorewall/providers</filename>. If you set this
+            option to <option>Yes</option> while Shorewall (Shorewall-lite) is
+            running, you should remove the file
+            <filename>/var/lib/shorewall/rt_tables</filename>
+            (<filename>/var/lib/shorewall-lite/rt_tables</filename>) before
+            your next <command>stop</command>, <command>refresh</command>,
+            <command>restore</command>, <emphasis
+            role="bold">reload</emphasis> or <command>restart</command>
+            command.</para>
+          </blockquote>
+
+          <para>IPv6:</para>
+
+          <blockquote>
+            <para>When set to <option>Yes</option>, this option prevents
+            scripts generated by Shorewall6 from altering the
+            /etc/iproute2/rt_tables database when there are entries in
+            <filename>/etc/shorewall6/providers</filename>. If you set this
+            option to <option>Yes</option> while Shorewall6 (Shorewall6-lite)
+            is running, you should remove the file
+            <filename>/var/lib/shorewall6/rt_tables</filename>
+            (<filename>/var/lib/shorewall6-lite/rt_tables</filename>) before
+            your next <command>stop</command>, <command>refresh</command>,
+            <command>restore</command>, <emphasis
+            role="bold">reload</emphasis> or <command>restart</command>
+            command.</para>
+          </blockquote>
+
+          <important>
+            <para>When both IPv4 and IPv6 Shorewall configurations are
+            present, KEEP_RT_TABLES=No should be specified in only one of the
+            two configurations unless the two provider configurations are
+            identical with respect to interface and provider names and
+            numbers.</para>
+          </important>
 
           <para>The default is KEEP_RT_TABLES=No.</para>
         </listitem>
@@ -1298,9 +1373,9 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
         <listitem>
           <para>Added in Shorewall 4.4.7. When set to Yes, restricts the set
           of modules loaded by shorewall to those listed in
-          /var/lib/shorewall/helpers and those that are actually used. When
-          not set, or set to the empty value, LOAD_HELPERS_ONLY=No is
-          assumed.</para>
+          <filename>/var/lib/shorewall[6]/helpers</filename> and those that
+          are actually used. When not set, or set to the empty value,
+          LOAD_HELPERS_ONLY=No is assumed.</para>
         </listitem>
       </varlistentry>
 
@@ -1309,11 +1384,11 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
         role="bold">LOCKFILE</emphasis>=[<emphasis>pathname</emphasis>]</term>
 
         <listitem>
-          <para>Specifies the name of the Shorewall lock file, used to prevent
-          simultaneous state-changing commands. If not specified,
-          ${VARDIR}/shorewall/lock is assumed (${VARDIR} is normally /var/lib
-          but can be changed when Shorewall-core is installed -- see the
-          output of <command>shorewall show vardir</command>).</para>
+          <para>Specifies the name of the Shorewall[6] lock file, used to
+          prevent simultaneous state-changing commands. If not specified,
+          ${VARDIR}/shorewall[6]/lock is assumed (${VARDIR} is normally
+          /var/lib but can be changed when Shorewall-core is installed -- see
+          the output of <command>shorewall show vardir</command>).</para>
         </listitem>
       </varlistentry>
 
@@ -1341,6 +1416,8 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
               <term>ULOG</term>
 
               <listitem>
+                <para>IPv4 only.</para>
+
                 <para>Use ULOG logging to ulogd.</para>
               </listitem>
             </varlistentry>
@@ -1365,8 +1442,8 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
           sample configurations use this as the default log level and changing
           it will change all packet logging done by the configuration. In any
           configuration file (except <ulink
-          url="shorewall-params.html">shorewall-params(5)</ulink>), $LOG_LEVEL
-          will expand to this value.</para>
+          url="/manpages/shorewall-params.html">shorewall-params(5)</ulink>),
+          $LOG_LEVEL will expand to this value.</para>
         </listitem>
       </varlistentry>
 
@@ -1376,6 +1453,8 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
         role="bold">No</emphasis>|Keep]</term>
 
         <listitem>
+          <para>IPv4 only.</para>
+
           <para>If set to <emphasis role="bold">Yes</emphasis> or <emphasis
           role="bold">yes</emphasis>, sets
           <filename>/proc/sys/net/ipv4/conf/*/log_martians</filename> to 1
@@ -1443,15 +1522,20 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
             </listitem>
           </itemizedlist>
 
-          <para/>
-
           <blockquote>
             <para>For example, using the default LOGFORMAT, the log prefix for
-            logging from the nat table's PREROUTING chain is:</para>
+            logging from the nat table's PREROUTING chain is as follows in
+            versions prior to 5.1.0:</para>
 
             <programlisting>    Shorewall:nat:PREROUTING
  </programlisting>
 
+            <para>In Shorewall 5.1.0 and later releases, the log prefix
+            is:</para>
+
+            <programlisting>    nat:PREROUTING
+ </programlisting>
+
             <important>
               <para>To help insure that all packets in the NEW state are
               logged, rate limiting (LOGLIMIT) should be disabled when using
@@ -1482,7 +1566,7 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
           log</emphasis>, and <emphasis role="bold">hits</emphasis> commands.
           If not assigned or if assigned an empty value, /var/log/messages is
           assumed. For further information, see <ulink
-          url="/shorewall_logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.
+          url="/manpages/shorewall_logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.
           Beginning with Shorewall 5.0.10.1, you may specify
           <option>systemd</option> to use <command>journelctl -r</command> to
           read the log.</para>
@@ -1515,6 +1599,33 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
             url="/manpages/shorewall-zones.html">shorewall-zones</ulink>
             (5).</para>
           </note>
+
+          <caution>
+            <para>Beginning with Shorewall 5.1.0, the default and sample
+            shorewall[6].conf files set LOGFORMAT="%s %s ".</para>
+
+            <para>Regardless of the LOGFORMAT setting, Shorewall IPv4 log
+            messages that use this LOGFORMAT can be uniquely identified using
+            the following regular expression:</para>
+
+            <simplelist>
+              <member>'IN=.* OUT=.* SRC=.*\..* DST='</member>
+            </simplelist>
+
+            <para>and Shorewall IPv6 log messages can be uniquely identified
+            using the following regular expression:</para>
+
+            <simplelist>
+              <member>'IN=.* OUT=.* SRC=.*:.* DST='</member>
+            </simplelist>
+
+            <para>To match all Netfilter log messages (Both IPv4 and IPv6 and
+            regardless of the LOGFORMAT setting), use:</para>
+
+            <simplelist>
+              <member>'IN=.* OUT=.* SRC=.* DST='</member>
+            </simplelist>
+          </caution>
         </listitem>
       </varlistentry>
 
@@ -1551,8 +1662,8 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
         role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
 
         <listitem>
-          <para>Using the default LOGFORMAT, chain names may not exceed 11
-          characters or truncation of the log prefix may occur. Longer chain
+          <para>Using LOGFORMAT=“Shorewall:%s:%s:”, chain names may not exceed
+          5 characters or truncation of the log prefix may occur. Longer chain
           names may be used with log tags if you set LOGTAGONLY=Yes. With
           LOGTAGONLY=Yes, if a log tag is specified then the tag is included
           in the log prefix in place of the chain name.</para>
@@ -1564,10 +1675,10 @@ net     all  DROP   info</programlisting>then the chain name is 'net-all'
           separated by a comma. So this rule:</para>
 
           <programlisting>#ACTION                                SOURCE         DEST
-LOG:info:foo,bar                 net                   fw</programlisting>
+LOG:info:foo,bar                       net            fw</programlisting>
 
-          <para>would generate the following log prefix when using the default
-          LOGFORMAT setting:</para>
+          <para>would generate the following log prefix when using
+          LOGFORMAT=“Shorewall:%s:%s:”:</para>
 
           <simplelist>
             <member>Shorewall:foo:bar:</member>
@@ -1602,7 +1713,7 @@ LOG:info:,bar                        net                    fw</programlisting>
 
           <para>A_DROP and A_REJECT are audited versions of DROP and REJECT
           respectively and were added in Shorewall 4.4.20. They require
-          AUDIT_TARGET in the kernel and iptables.</para>
+          AUDIT_TARGET in the kernel and ip[6]tables.</para>
         </listitem>
       </varlistentry>
 
@@ -1645,7 +1756,7 @@ LOG:info:,bar                        net                    fw</programlisting>
           entries in <ulink
           url="/manpages/shorewall-maclist.html">shorewall-maclist</ulink>(5)
           can be improved by setting the MACLIST_TTL variable in <ulink
-          url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5).</para>
+          url="/manpages/shorewall.conf.html">shorewall[6].conf</ulink>(5).</para>
 
           <para>If your iptables and kernel support the "Recent Match" (see
           the output of "shorewall check" near the top), you can cache the
@@ -1687,6 +1798,8 @@ LOG:info:,bar                        net                    fw</programlisting>
         role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
 
         <listitem>
+          <para>IPv4 only.</para>
+
           <para>This option is included for compatibility with old Shorewall
           configuration. New installs should always have
           MAPOLDACTIONS=No.</para>
@@ -1717,11 +1830,11 @@ LOG:info:,bar                        net                    fw</programlisting>
           PREROUTING chain. This permits you to mark inbound traffic based on
           its destination address when DNAT is in use. To determine if your
           kernel has a FORWARD chain in the mangle table, use the <emphasis
-          role="bold">shorewall show mangle</emphasis> command; if a FORWARD
-          chain is displayed then your kernel will support this option. If
-          this option is not specified or if it is given the empty value
-          (e.g., MARK_IN_FORWARD_CHAIN="") then MARK_IN_FORWARD_CHAIN=No is
-          assumed.</para>
+          role="bold">shorewall [-6] show mangle</emphasis> command; if a
+          FORWARD chain is displayed then your kernel will support this
+          option. If this option is not specified or if it is given the empty
+          value (e.g., MARK_IN_FORWARD_CHAIN="") then MARK_IN_FORWARD_CHAIN=No
+          is assumed.</para>
         </listitem>
       </varlistentry>
 
@@ -1803,7 +1916,8 @@ LOG:info:,bar                        net                    fw</programlisting>
           "/lib/modules/$uname/kernel/net/ipv${g_family}/netfilter:/lib/modules/$uname/kernel/net/netfilter:/lib/modules/$uname/kernel/net/sched:/lib/modules/$uname/extra:/lib/modules/$uname/extra/ipset"
           where <emphasis role="bold">uname</emphasis> holds the output of
           '<command>uname -r</command>' and <emphasis
-          role="bold">g_family</emphasis> holds '4'.</para>
+          role="bold">g_family</emphasis> holds '4' in IPv4 configurations and
+          '6' in IPv6 configurations.</para>
 
           <para>The option plus sign ('+') was added in Shorewall 5.0.3 and
           causes the listed pathnames to be appended to the default list
@@ -1816,6 +1930,8 @@ LOG:info:,bar                        net                    fw</programlisting>
         role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
 
         <listitem>
+          <para>IPv4 only.</para>
+
           <para>This option will normally be set to 'No' (the default). It
           should be set to 'Yes' under the following circumstances:</para>
 
@@ -1842,17 +1958,18 @@ LOG:info:,bar                        net                    fw</programlisting>
 
         <listitem>
           <para>The value of this variable determines the number of seconds
-          that programs will wait for exclusive access to the Shorewall lock
-          file. After the number of seconds corresponding to the value of this
-          variable, programs will assume that the last program to hold the
-          lock died without releasing the lock.</para>
+          that programs will wait for exclusive access to the Shorewall[6]
+          lock file. After the number of seconds corresponding to the value of
+          this variable, programs will assume that the last program to hold
+          the lock died without releasing the lock.</para>
 
           <para>If not set or set to the empty value, a value of 60 (60
           seconds) is assumed.</para>
 
           <para>An appropriate value for this parameter would be twice the
           length of time that it takes your firewall system to process a
-          <emphasis role="bold">shorewall restart</emphasis> command.</para>
+          <emphasis role="bold">shorewall [-6] restart</emphasis>
+          command.</para>
         </listitem>
       </varlistentry>
 
@@ -1876,6 +1993,8 @@ LOG:info:,bar                        net                    fw</programlisting>
         role="bold">prohibit</emphasis>]</term>
 
         <listitem>
+          <para>IPv4 only.</para>
+
           <para>When set to Yes, causes Shorewall to null-route the IPv4
           address ranges reserved by RFC1918. The default value is
           'No'.</para>
@@ -1912,13 +2031,11 @@ LOG:info:,bar                        net                    fw</programlisting>
           <itemizedlist>
             <listitem>
               <para>Optimization category 1 - Traditionally, Shorewall has
-              created rules for <ulink
-              url="/ScalabilityAndPerformance.html">the complete matrix of
-              host groups defined by the zones, interfaces and hosts
-              files</ulink>. Any traffic that didn't correspond to an element
-              of that matrix was rejected in one of the built-in chains. When
-              the matrix is sparse, this results in lots of largely useless
-              rules.</para>
+              created rules for the complete matrix of host groups defined by
+              the zones, interfaces and hosts files. Any traffic that didn't
+              correspond to an element of that matrix was rejected in one of
+              the built-in chains. When the matrix is sparse, this results in
+              lots of largely useless rules.</para>
 
               <para>These extra rules can be eliminated by setting the 1 bit
               in OPTIMIZE.</para>
@@ -2096,8 +2213,9 @@ LOG:info:,bar                        net                    fw</programlisting>
             </listitem>
           </itemizedlist>
 
-          <para>The default value is zero which disables all
-          optimizations.</para>
+          <para>In versions prior to 5.1.0, the default value is zero which
+          disables all optimizations. Beginning with Shorewall 5.1.0, the
+          default value is All which enables all optimizations.</para>
         </listitem>
       </varlistentry>
 
@@ -2153,6 +2271,21 @@ LOG:info:,bar                        net                    fw</programlisting>
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><emphasis role="bold">PERL_HASH_SEED=</emphasis><emphasis
+        role="bold"><replaceable>seed</replaceable><emphasis
+        role="bold">|random</emphasis></emphasis></term>
+
+        <listitem>
+          <para>Added in Shorewall 5.1.4. Sets the Perl hash
+          <replaceable>seed</replaceable> (an integer in the range 0-99999)
+          when running the Shorewall rules compiler. If not specified, the
+          value 0 is assumed. If <option>random</option> is specified, a
+          random seed will be chosed by Perl. See perlsec(1) for additional
+          information.</para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><emphasis
         role="bold">PROVIDER_BITS</emphasis>=[<replaceable>number</replaceable>]</term>
@@ -2279,7 +2412,7 @@ RCP_COMMAND: scp ${files} ${root}@${system}:${destination}</programlisting>
 
             <listitem>
               <para>if the protocol is UDP (17) then the packet is rejected
-              with an 'port-unreachable' ICMP (ICMP6).</para>
+              with an 'port-unreachable' ICMP.</para>
             </listitem>
 
             <listitem>
@@ -2287,6 +2420,11 @@ RCP_COMMAND: scp ${files} ${root}@${system}:${destination}</programlisting>
               with a 'host-unreachable' ICMP.</para>
             </listitem>
 
+            <listitem>
+              <para>if the protocol is ICMP6 (1) then the packet is rejected
+              with a 'icmp6-addr-unreachable' ICMP6.</para>
+            </listitem>
+
             <listitem>
               <para>otherwise, the packet is rejected with a 'host-prohibited'
               ICMP.</para>
@@ -2296,11 +2434,12 @@ RCP_COMMAND: scp ${files} ${root}@${system}:${destination}</programlisting>
           <para>You can modify this behavior by implementing your own
           <replaceable>action</replaceable> that handles REJECT and specifying
           it's name in this option. The <emphasis role="bold">nolog</emphasis>
-          and <emphasis role="bold">inline</emphasis> options will
+          and <emphasis role="bold">noinline</emphasis> options will
           automatically be assumed for the specified
           <replaceable>action</replaceable>.</para>
 
-          <para>The following action implements the standard behavior:</para>
+          <para>The following action implements the default reject
+          action:</para>
 
           <programlisting>?format 2
 #TARGET         SOURCE  DEST    PROTO
@@ -2400,10 +2539,10 @@ INLINE          -       -       -       ;; -j REJECT
         <listitem>
           <para>Specifies the simple name of a file in /var/lib/shorewall to
           be used as the default restore script in the <emphasis
-          role="bold">shorewall save</emphasis>, <emphasis
-          role="bold">shorewall restore</emphasis>, <emphasis
-          role="bold">shorewall forget </emphasis>and <emphasis
-          role="bold">shorewall -f start</emphasis> commands.</para>
+          role="bold">shorewall [-6] save</emphasis>, <emphasis
+          role="bold">shorewall [-6] restore</emphasis>, <emphasis
+          role="bold">shorewall [-6] forget </emphasis>and <emphasis
+          role="bold">shorewall [6] -f start</emphasis> commands.</para>
         </listitem>
       </varlistentry>
 
@@ -2412,6 +2551,8 @@ INLINE          -       -       -       ;; -j REJECT
         role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>}</term>
 
         <listitem>
+          <para>IPv4 only.</para>
+
           <para>During <emphasis role="bold">shorewall star</emphasis>t, IP
           addresses to be added as a consequence of ADD_IP_ALIASES=Yes and
           ADD_SNAT_ALIASES=Yes are quietly deleted when <ulink
@@ -2424,7 +2565,7 @@ INLINE          -       -       -       ;; -j REJECT
           not be deleted. Regardless of the setting of RETAIN_ALIASES,
           addresses added during <emphasis role="bold">shorewall
           start</emphasis> are still deleted at a subsequent <emphasis
-          role="bold">shorewall stop</emphasis>, <emphasis
+          role="bold">shorewall [stop</emphasis>, <emphasis
           role="bold">shorewall reload</emphasis> or <emphasis
           role="bold">shorewall restart</emphasis>.</para>
         </listitem>
@@ -2535,7 +2676,7 @@ INLINE          -       -       -       ;; -j REJECT
           the <option>routeback</option> option.<footnote>
               <para>Hairpin packets are packets that are routed out of the
               same interface that they arrived on.</para>
-            </footnote> interfaces without the routeback option.</para>
+            </footnote></para>
         </listitem>
       </varlistentry>
 
@@ -2551,9 +2692,9 @@ INLINE          -       -       -       ;; -j REJECT
           the <option>routeback</option> option.<footnote>
               <para>Hairpin packets are packets that are routed out of the
               same interface that they arrived on.</para>
-            </footnote> interfaces without the routeback option. The default
-          is <option>info</option>. If you don't wish for these packets to be
-          logged, use SFILTER_LOG_LEVEL=none.</para>
+            </footnote> The default is <option>info</option>. If you don't
+          wish for these packets to be logged, use
+          SFILTER_LOG_LEVEL=none.</para>
         </listitem>
       </varlistentry>
 
@@ -2906,7 +3047,7 @@ INLINE          -       -       -       ;; -j REJECT
             <listitem>
               <para>Packets are sent through the main routing table by a rule
               with priority 999. In <ulink
-              url="/manpages/shorewall-routing_rules.html">routing_rules</ulink>(5),
+              url="/manpages/shorewall-rtrules.html">shorewall-rtrules</ulink>(5),
               the range 1-998 may be used for inserting rules that bypass the
               main table.</para>
             </listitem>
@@ -2944,6 +3085,40 @@ INLINE          -       -       -       ;; -j REJECT
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><emphasis role="bold">USE_NFLOG_SIZE=</emphasis>[<emphasis
+        role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
+
+        <listitem>
+          <para>Added in Shorewall 5.1.5. The second parameter to the NFLOG
+          target specifies how many bytes of the packet to copy to the log; if
+          omitted or if supplied as zero, the entire packet is copied. This
+          feature has traditionally been implemented using the --nflog-range
+          option to the NFLOG iptables target. Unfortuntely, the --nflog-range
+          option never worked (the entire packet was always copied). To deal
+          with this issue, the Netfilter team:</para>
+
+          <itemizedlist>
+            <listitem>
+              <para>Added a warning message when --nflog-range is used</para>
+            </listitem>
+
+            <listitem>
+              <para>Added --nflog-size which works like --nflog-range was
+              intended to work.</para>
+            </listitem>
+          </itemizedlist>
+
+          <para>When USE_NFLOG_SIZE=Yes, Shorewall will attempt to use the new
+          --nflog-size feature. If that feature is not available in the
+          running kernel and ip[6]tables, an error is raised.</para>
+
+          <para>When USE_NFLOG_SIZE is not supplied, USE_NFLOG_SIZE=No is
+          assumed. When USE_NFLOG_SIZE is added by shorewall update, it is
+          added with setting No.</para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><emphasis role="bold">USE_PHYSICAL_NAMES=</emphasis>[<emphasis
         role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
@@ -3113,19 +3288,13 @@ INLINE          -       -       -       ;; -j REJECT
     <title>FILES</title>
 
     <para>/etc/shorewall/shorewall.conf</para>
+
+    <para>/etc/shorewall6/shorewall6.conf</para>
   </refsect1>
 
   <refsect1>
     <title>See ALSO</title>
 
-    <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
-    shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
-    shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
-    shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
-    shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
-    shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5),
-    shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcinterfaces(5),
-    shorewall-tcpri(5), shorewall-tcrules(5), shorewall-tos(5),
-    shorewall-tunnels(5), shorewall-zones(5)</para>
+    <para>shorewall(8)</para>
   </refsect1>
 </refentry>

Shorewall6-lite/shorewall6-lite.service

@@ -8,6 +8,7 @@
 Description=Shorewall IPv6 firewall (lite)
 Wants=network-online.target
 After=network-online.target
+After=shorewall-lite.service
 Conflicts=ip6tables.service firewalld.service
 
 [Service]

Shorewall6-lite/shorewall6-lite.service.debian

@@ -7,6 +7,7 @@
 Description=Shorewall IPv6 firewall (lite)
 Wants=network-online.target
 After=network-online.target
+After=shorewall-lite.service
 Conflicts=ip6tables.service firewalld.service
 
 [Service]

Shorewall6/Actions/action.A_AllowICMPs

@@ -1,38 +0,0 @@
-#
-# Shorewall6 -- /usr/share/shorewall6/action.A_AllowICMPs
-#
-# This action A_ACCEPTs needed ICMP types
-#
-###############################################################################
-#ACTION		SOURCE		DEST	PROTO		DPORT
-
-?comment Needed ICMP types (RFC4890)
-
-A_ACCEPT	-		-	ipv6-icmp	destination-unreachable
-A_ACCEPT	-		-	ipv6-icmp	packet-too-big
-A_ACCEPT	-		-	ipv6-icmp	time-exceeded
-A_ACCEPT	-		-	ipv6-icmp	parameter-problem
-
-# The following should have a ttl of 255 and must be allowed to transit a bridge
-A_ACCEPT	-		-	ipv6-icmp	router-solicitation
-A_ACCEPT	-		-	ipv6-icmp	router-advertisement
-A_ACCEPT	-		-	ipv6-icmp	neighbour-solicitation
-A_ACCEPT	-		-	ipv6-icmp	neighbour-advertisement
-A_ACCEPT	-		-	ipv6-icmp	137	# Redirect
-A_ACCEPT	-		-	ipv6-icmp	141	# Inverse neighbour discovery solicitation
-A_ACCEPT	-		-	ipv6-icmp	142	# Inverse neighbour discovery advertisement
-
-# The following should have a link local source address and must be allowed to transit a bridge
-A_ACCEPT	fe80::/10	-	ipv6-icmp	130	# Listener query
-A_ACCEPT	fe80::/10	-	ipv6-icmp	131	# Listener report
-A_ACCEPT	fe80::/10	-	ipv6-icmp	132	# Listener done
-A_ACCEPT	fe80::/10	-	ipv6-icmp	143	# Listener report v2
-
-# The following should be received with a ttl of 255 and must be allowed to transit a bridge
-A_ACCEPT	-		-	ipv6-icmp	148	# Certificate path solicitation
-A_ACCEPT	-		-	ipv6-icmp	149	# Certificate path advertisement
-
-# The following should have a link local source address and a ttl of 1 and must be allowed to transit abridge
-A_ACCEPT	fe80::/10	-	ipv6-icmp	151	# Multicast router advertisement
-A_ACCEPT	fe80::/10	-	ipv6-icmp	152	# Multicast router solicitation
-A_ACCEPT	fe80::/10	-	ipv6-icmp	153	# Multicast router termination

Shorewall6/Actions/action.AllowICMPs

@@ -1,40 +0,0 @@
-#
-# Shorewall6 -- /usr/share/shorewall6/action.AllowICMPs
-#
-# This action ACCEPTs needed ICMP types
-#
-###############################################################################
-#ACTION	SOURCE		DEST	PROTO		DPORT
-
-DEFAULTS ACCEPT
-
-?COMMENT Needed ICMP types (RFC4890)
-
-$1	-		-	ipv6-icmp	destination-unreachable
-$1	-		-	ipv6-icmp	packet-too-big
-$1	-		-	ipv6-icmp	time-exceeded
-$1	-		-	ipv6-icmp	parameter-problem
-
-# The following should have a ttl of 255 and must be allowed to transit a bridge
-$1	-		-	ipv6-icmp	router-solicitation
-$1	-		-	ipv6-icmp	router-advertisement
-$1	-		-	ipv6-icmp	neighbour-solicitation
-$1	-		-	ipv6-icmp	neighbour-advertisement
-$1	-		-	ipv6-icmp	137	# Redirect
-$1	-		-	ipv6-icmp	141	# Inverse neighbour discovery solicitation
-$1	-		-	ipv6-icmp	142	# Inverse neighbour discovery advertisement
-
-# The following should have a link local source address and must be allowed to transit a bridge
-$1	fe80::/10	-	ipv6-icmp	130	# Listener query
-$1	fe80::/10	-	ipv6-icmp	131	# Listener report
-$1	fe80::/10	-	ipv6-icmp	132	# Listener done
-$1	fe80::/10	-	ipv6-icmp	143	# Listener report v2
-
-# The following should be received with a ttl of 255 and must be allowed to transit a bridge
-$1	-		-	ipv6-icmp	148	# Certificate path solicitation
-$1	-		-	ipv6-icmp	149	# Certificate path advertisement
-
-# The following should have a link local source address and a ttl of 1 and must be allowed to transit abridge
-$1	fe80::/10	-	ipv6-icmp	151	# Multicast router advertisement
-$1	fe80::/10	-	ipv6-icmp	152	# Multicast router solicitation
-$1	fe80::/10	-	ipv6-icmp	153	# Multicast router termination

Shorewall6/Actions/action.Broadcast

@@ -1,65 +0,0 @@
-#
-# Shorewall6 -- /usr/share/shorewall6/action.Broadcast
-#
-# Multicast/Anycast IPv6 Action
-#
-# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
-#
-# (c) 2011-2016 Tom Eastep (teastep@shorewall.net)
-#
-# Complete documentation is available at http://shorewall.net
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of Version 2 of the GNU General Public License
-# as published by the Free Software Foundation.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Broadcast[([<action>|-[,{audit|-}])]
-#
-# Default action is DROP
-#
-###############################################################################
-
-DEFAULTS DROP,-
-
-?begin perl;
-
-use Shorewall::IPAddrs;
-use Shorewall::Config;
-use Shorewall::Chains;
-
-my $chainref           = get_action_chain;
-my ( $action, $audit ) = get_action_params( 2 );
-my ( $level, $tag )    = get_action_logging;
-my $target             = require_audit ( $action , $audit );
-
-fatal_error "Invalid parameter to action Broadcast"   if supplied $audit && $audit ne 'audit';
-
-if ( have_capability( 'ADDRTYPE' ) ) {
-    if ( $level ne '' ) {
-	log_rule_limit $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', ' -m addrtype --dst-type BROADCAST ';
-	log_rule_limit $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', ' -m addrtype --dst-type ANYCAST ';
-    }
-
-    add_jump $chainref, $target, 0, '-m addrtype --dst-type BROADCAST ';
-    add_jump $chainref, $target, 0, '-m addrtype --dst-type ANYCAST ';
-} else {
-    add_commands $chainref, 'for address in $ALL_ACASTS; do';
-    incr_cmd_level $chainref;
-    log_rule_limit $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', ' -d $address ' if $level ne '';
-    add_jump $chainref, $target, 0, "-d \$address ";
-    decr_cmd_level $chainref;
-    add_commands $chainref, 'done';
-}
-
-1;
-
-?end perl;

Shorewall6/Actions/action.Multicast

@@ -1,59 +0,0 @@
-#
-# Shorewall6 -- /usr/share/shorewall6/action.Multicast
-#
-# Multicast/Anycast IPv6 Action
-#
-# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
-#
-# (c) 2011-2016 Tom Eastep (teastep@shorewall.net)
-#
-# Complete documentation is available at http://shorewall.net
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of Version 2 of the GNU General Public License
-# as published by the Free Software Foundation.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Multicast[([<action>|-[,{audit|-}])]
-#
-# Default action is DROP
-#
-###############################################################################
-
-DEFAULTS DROP,-
-
-?begin perl;
-
-use Shorewall::IPAddrs;
-use Shorewall::Config;
-use Shorewall::Chains;
-
-my $chainref           = get_action_chain;
-my ( $action, $audit ) = get_action_params( 2 );
-my ( $level, $tag )    = get_action_logging;
-my $target             = require_audit ( $action , $audit );
-
-fatal_error "Invalid parameter to action Broadcast"   if supplied $audit && $audit ne 'audit';
-
-if ( have_capability( 'ADDRTYPE' ) ) {
-    if ( $level ne '' ) {
-	log_rule_limit $level, $chainref, 'Multicast' , $action, '', $tag, 'add', ' -m addrtype --dst-type MULTICAST ';
-    }
-
-    add_jump $chainref, $target, 0, '-m addrtype --dst-type MULTICAST ';
-} else {
-    log_rule_limit( $level, $chainref, 'Multicast' , $action, '', $tag, 'add', join( ' ', '-d', IPv6_MULTICAST . ' ' ) )  if $level ne '';
-    add_jump $chainref, $target, 0, join( ' ', '-d', IPv6_MULTICAST . ' ' );
-}
-
-1;
-
-?end perl;

Shorewall6/Samples6/Universal/shorewall6.conf

@@ -188,6 +188,8 @@ MANGLE_ENABLED=Yes
 
 MARK_IN_FORWARD_CHAIN=No
 
+MINIUPNPD=No
+
 MODULE_SUFFIX="ko ko.xz"
 
 MUTEX_TIMEOUT=60
@@ -196,12 +198,16 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
+PERL_HASH_SEED=0
+
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=Yes
 
 RESTART=restart
 
+RESTORE_DEFAULT_ROUTE=Yes
+
 RESTORE_ROUTEMARKS=Yes
 
 SAVE_IPSETS=No
@@ -218,6 +224,8 @@ TRACK_RULES=No
 
 USE_DEFAULT_RT=Yes
 
+USE_NFLOG_SIZE=No
+
 USE_PHYSICAL_NAMES=No
 
 USE_RT_NAMES=No

Shorewall6/Samples6/one-interface/shorewall6.conf

@@ -189,6 +189,8 @@ MANGLE_ENABLED=Yes
 
 MARK_IN_FORWARD_CHAIN=No
 
+MINIUPNPD=No
+
 MODULE_SUFFIX="ko ko.xz"
 
 MUTEX_TIMEOUT=60
@@ -197,12 +199,16 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
+PERL_HASH_SEED=0
+
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No
 
 RESTART=restart
 
+RESTORE_DEFAULT_ROUTE=Yes
+
 RESTORE_ROUTEMARKS=Yes
 
 SAVE_IPSETS=No
@@ -219,6 +225,8 @@ TRACK_RULES=No
 
 USE_DEFAULT_RT=Yes
 
+USE_NFLOG_SIZE=No
+
 USE_PHYSICAL_NAMES=No
 
 USE_RT_NAMES=No

Shorewall6/Samples6/three-interfaces/shorewall6.conf

@@ -188,6 +188,8 @@ MANGLE_ENABLED=Yes
 
 MARK_IN_FORWARD_CHAIN=No
 
+MINIUPNPD=No
+
 MODULE_SUFFIX="ko ko.xz"
 
 MUTEX_TIMEOUT=60
@@ -196,12 +198,16 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
+PERL_HASH_SEED=0
+
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No
 
 RESTART=restart
 
+RESTORE_DEFAULT_ROUTE=Yes
+
 RESTORE_ROUTEMARKS=Yes
 
 SAVE_IPSETS=No
@@ -218,6 +224,8 @@ TRACK_RULES=No
 
 USE_DEFAULT_RT=Yes
 
+USE_NFLOG_SIZE=No
+
 USE_PHYSICAL_NAMES=No
 
 USE_RT_NAMES=No

Shorewall6/Samples6/two-interfaces/shorewall6.conf

@@ -188,6 +188,8 @@ MANGLE_ENABLED=Yes
 
 MARK_IN_FORWARD_CHAIN=No
 
+MINIUPNPD=No
+
 MODULE_SUFFIX="ko ko.xz"
 
 MUTEX_TIMEOUT=60
@@ -196,12 +198,16 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
+PERL_HASH_SEED=0
+
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No
 
 RESTART=restart
 
+RESTORE_DEFAULT_ROUTE=Yes
+
 RESTORE_ROUTEMARKS=Yes
 
 SAVE_IPSETS=No
@@ -218,6 +224,8 @@ TRACK_RULES=No
 
 USE_DEFAULT_RT=Yes
 
+USE_NFLOG_SIZE=No
+
 USE_PHYSICAL_NAMES=No
 
 USE_RT_NAMES=No

Shorewall6/actions.std

@@ -17,9 +17,11 @@ allowInvalid inline		# Accepts packets in the INVALID conntrack state
 allowMcast   inline		# Silently Allow Multicast
 AutoBL       noinline           # Auto-blacklist IPs that exceed thesholds
 AutoBLL      noinline           # Helper for AutoBL
+BLACKLIST    logjump,section	# Add sender to the dynamic blacklist
 Broadcast    noinline      	# Handles Broadcast/Anycast
 Drop		        	# Default Action for DROP policy (deprecated)
 dropBcast    inline		# Silently Drop Broadcast
+dropBcasts   inline		# Silently Drop Broadcast
 dropInvalid  inline		# Drops packets in the INVALID conntrack state
 dropMcast    inline		# Silently Drop Multicast
 dropNotSyn   noinline		# Silently Drop Non-syn TCP packets
@@ -27,6 +29,8 @@ DropDNSrep   inline		# Drops DNS replies
 DropSmurfs   noinline     	# Handles packets with a broadcast source address
 Established  inline,\		# Handles packets in the ESTABLISHED state
 	     state=ESTABLISHED
+FIN	     inline,audit	# Handles ACK,FIN,PSH packets
+forwardUPnP  noinline		# Allow traffic that upnpd has redirected from 'upnp' interfaces.
 IfEvent      noinline           # Perform an action based on an event
 Invalid      inline,audit,\     # Handles packets in the INVALID conntrack state
              state=INVALID

Shorewall6/configfiles/disabled

@@ -0,0 +1,12 @@
+#
+# Shorewall6 -- /etc/shorewall6/disabled
+#
+# Add commands below that you want executed when an optional
+# interface is successfully disabled using the 'disable' command
+#
+# When the commands are invoked:
+#
+#  $1 contains the physical name of the interface
+#  $2 contains the logical name of the interface
+#  $3 contains the name of the provider associated with the interface,
+      if any

Shorewall6/configfiles/enabled

@@ -0,0 +1,12 @@
+#
+# Shorewall6 -- /etc/shorewall6/enabled
+#
+# Add commands below that you want executed when an optional
+# interface is successfully enabled using the 'enable' command
+#
+# When the commands are invoked:
+#
+#  $1 contains the physical name of the interface
+#  $2 contains the logical name of the interface
+#  $3 contains the name of the provider associated with the interface,
+      if any

Shorewall6/configfiles/shorewall6.conf

@@ -188,6 +188,8 @@ MANGLE_ENABLED=Yes
 
 MARK_IN_FORWARD_CHAIN=No
 
+MINIUPNPD=No
+
 MODULE_SUFFIX=ko
 
 MUTEX_TIMEOUT=60
@@ -196,12 +198,16 @@ OPTIMIZE=All
 
 OPTIMIZE_ACCOUNTING=No
 
+PERL_HASH_SEED=0
+
 REJECT_ACTION=
 
 REQUIRE_INTERFACE=No
 
 RESTART=restart
 
+RESTORE_DEFAULT_ROUTE=Yes
+
 RESTORE_ROUTEMARKS=Yes
 
 SAVE_IPSETS=No
@@ -218,6 +224,8 @@ TRACK_RULES=No
 
 USE_DEFAULT_RT=Yes
 
+USE_NFLOG_SIZE=No
+
 USE_PHYSICAL_NAMES=No
 
 USE_RT_NAMES=No

Shorewall6/manpages/shorewall6-accounting.xml

@@ -1,851 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
-"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
-<refentry>
-  <refmeta>
-    <refentrytitle>shorewall6-accounting</refentrytitle>
-
-    <manvolnum>5</manvolnum>
-
-    <refmiscinfo>Configuration Files</refmiscinfo>
-  </refmeta>
-
-  <refnamediv>
-    <refname>accounting</refname>
-
-    <refpurpose>Shorewall6 Accounting file</refpurpose>
-  </refnamediv>
-
-  <refsynopsisdiv>
-    <cmdsynopsis>
-      <command>/etc/shorewall6/accounting</command>
-    </cmdsynopsis>
-  </refsynopsisdiv>
-
-  <refsect1>
-    <title>Description</title>
-
-    <para>Accounting rules exist simply to count packets and bytes in
-    categories that you define in this file. You may display these rules and
-    their packet and byte counters using the <command>shorewall6 show
-    accounting</command> command.</para>
-
-    <para>Beginning with Shorewall 4.4.18, the accounting structure can be
-    created with three root chains:</para>
-
-    <itemizedlist>
-      <listitem>
-        <para><emphasis role="bold">accountin</emphasis>: Rules that are valid
-        in the <emphasis role="bold">INPUT</emphasis> chain (may not specify
-        an output interface).</para>
-      </listitem>
-
-      <listitem>
-        <para><emphasis role="bold">accountout</emphasis>: Rules that are
-        valid in the OUTPUT chain (may not specify an input interface or a MAC
-        address).</para>
-      </listitem>
-
-      <listitem>
-        <para><emphasis role="bold">accounting</emphasis>: Other rules.</para>
-      </listitem>
-    </itemizedlist>
-
-    <para>The new structure is enabled by sectioning the accounting file in a
-    manner similar to the <ulink url="/manpages6/shorewall6-rules.html">rules
-    file</ulink>. The sections are <emphasis role="bold">INPUT</emphasis>,
-    <emphasis role="bold">OUTPUT</emphasis> and <emphasis
-    role="bold">FORWARD</emphasis> and must appear in that order (although any
-    of them may be omitted). The first non-commentary record in the accounting
-    file must be a section header when sectioning is used.</para>
-
-    <warning>
-      <para>If sections are not used, the Shorewall rules compiler cannot
-      detect certain violations of netfilter restrictions. These violations
-      can result in run-time errors such as the following:</para>
-
-      <blockquote>
-        <para><emphasis role="bold">ip6tables-restore v1.4.13: Can't use -o
-        with INPUT</emphasis></para>
-      </blockquote>
-    </warning>
-
-    <para>Beginning with Shorewall 4.4.20, the ACCOUNTING_TABLE setting was
-    added to shorewall.conf and shorewall6.conf. That setting determines the
-    Netfilter table (filter or mangle) where the accounting rules are added.
-    When ACCOUNTING_TABLE=mangle is specified, the available sections are
-    <emphasis role="bold">PREROUTING</emphasis>, <emphasis
-    role="bold">INPUT</emphasis>, <emphasis role="bold">OUTPUT</emphasis>,
-    <emphasis role="bold">FORWARD</emphasis> and <emphasis
-    role="bold">POSTROUTING</emphasis>.</para>
-
-    <para>Section headers have the form:</para>
-
-    <para><option>[?]SECTION</option>
-    <replaceable>section-name</replaceable></para>
-
-    <para>The optional "?" was added in Shorewalll 4.6.0 and is preferred.
-    Existing configurations may be converted to use this form using the
-    <command>shorewall6 update</command> command.</para>
-
-    <para>When sections are enabled:</para>
-
-    <itemizedlist>
-      <listitem>
-        <para>A jump to a user-defined accounting chain must appear before
-        entries that add rules to that chain. This eliminates loops and
-        unreferenced chains.</para>
-      </listitem>
-
-      <listitem>
-        <para>An output interface may not be specified in the <emphasis
-        role="bold">PREROUTING</emphasis> and <emphasis
-        role="bold">INPUT</emphasis> sections.</para>
-      </listitem>
-
-      <listitem>
-        <para>In the <emphasis role="bold">OUTPUT</emphasis> and <emphasis
-        role="bold">POSTROUTING</emphasis> sections:</para>
-
-        <itemizedlist>
-          <listitem>
-            <para>An input interface may not be specified</para>
-          </listitem>
-
-          <listitem>
-            <para>Jumps to a chain defined in the <emphasis
-            role="bold">INPUT</emphasis> or <emphasis
-            role="bold">PREROUTING</emphasis> sections that specifies an input
-            interface are prohibited</para>
-          </listitem>
-
-          <listitem>
-            <para>MAC addresses may not be used</para>
-          </listitem>
-
-          <listitem>
-            <para>Jump to a chain defined in the <emphasis
-            role="bold">INPUT</emphasis> or <emphasis
-            role="bold">PREROUTING</emphasis> section that specifies a MAC
-            address are prohibited.</para>
-          </listitem>
-        </itemizedlist>
-      </listitem>
-
-      <listitem>
-        <para>The default value of the CHAIN column is:</para>
-
-        <itemizedlist>
-          <listitem>
-            <para><emphasis role="bold">accountin</emphasis> in the <emphasis
-            role="bold">INPUT</emphasis> section</para>
-          </listitem>
-
-          <listitem>
-            <para><emphasis role="bold">accountout</emphasis> in the <emphasis
-            role="bold">OUTPUT</emphasis> section</para>
-          </listitem>
-
-          <listitem>
-            <para><emphasis role="bold">accountfwd</emphasis> in the <emphasis
-            role="bold">FORWARD</emphasis> section</para>
-          </listitem>
-
-          <listitem>
-            <para><emphasis role="bold">accountpre</emphasis> in the <emphasis
-            role="bold">PREROUTING</emphasis> section</para>
-          </listitem>
-
-          <listitem>
-            <para><emphasis role="bold">accountpost</emphasis> in the
-            <emphasis role="bold">POSTROUTING</emphasis> section</para>
-          </listitem>
-        </itemizedlist>
-      </listitem>
-
-      <listitem>
-        <para>Traffic addressed to the firewall goes through the rules defined
-        in the INPUT section.</para>
-      </listitem>
-
-      <listitem>
-        <para>Traffic originating on the firewall goes through the rules
-        defined in the OUTPUT section.</para>
-      </listitem>
-
-      <listitem>
-        <para>Traffic being forwarded through the firewall goes through the
-        rules from the FORWARD sections.</para>
-      </listitem>
-    </itemizedlist>
-
-    <para>The columns in the file are as follows (where the column name is
-    followed by a different name in parentheses, the different name is used in
-    the alternate specification syntax).</para>
-
-    <variablelist>
-      <varlistentry>
-        <term><emphasis role="bold">ACTION</emphasis> - {<emphasis
-        role="bold">COUNT</emphasis>|<emphasis
-        role="bold">DONE</emphasis>|<emphasis>chain</emphasis>[:<emphasis
-        role="bold">{COUNT|JUMP}</emphasis>]|[?]COMMENT
-        <replaceable>comment</replaceable>}</term>
-
-        <listitem>
-          <para>What to do when a matching packet is found.</para>
-
-          <variablelist>
-            <varlistentry>
-              <term><emphasis role="bold">COUNT</emphasis></term>
-
-              <listitem>
-                <para>Simply count the match and continue with the next
-                rule</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">DONE</emphasis></term>
-
-              <listitem>
-                <para>Count the match and don't attempt to match any other
-                accounting rules in the chain specified in the <emphasis
-                role="bold">CHAIN</emphasis> column.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis>chain</emphasis>[<emphasis
-              role="bold">:</emphasis><emphasis
-              role="bold">COUNT</emphasis>]</term>
-
-              <listitem>
-                <para>Where <emphasis>chain</emphasis> is the name of a chain;
-                shorewall6 will create the chain automatically if it doesn't
-                already exist. If a second chain is mentioned in the CHAIN
-                column, then a jump from this second chain to
-                <replaceable>chain</replaceable> is created. If no chain is
-                named in the CHAIN column, then a jump from the default chain
-                to <replaceable>chain</replaceable> is created. If <emphasis
-                role="bold">:COUNT</emphasis> is included, a counting rule
-                matching this entry will be added to
-                <emphasis>chain</emphasis>. The <emphasis>chain</emphasis> may
-                not exceed 29 characters in length and may be composed of
-                letters, digits, dash ('-') and underscore ('_').</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis>chain</emphasis>:JUMP</term>
-
-              <listitem>
-                <para>Like the previous option without the <emphasis
-                role="bold">:COUNT</emphasis> part.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">INLINE</emphasis></term>
-
-              <listitem>
-                <para>Added in Shorewall 4.5.16. Allows free form ip6tables
-                matches to be specified following a ';'. In the generated
-                ip6tables rule(s), the free form matches will follow any
-                matches that are generated by the column contents.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis
-              role="bold">NFACCT</emphasis>({<replaceable>object</replaceable>[!]}[,...])</term>
-
-              <listitem>
-                <para>Added in Shorewall 4.5.7. Provides a form of accounting
-                that survives <command>shorewall stop/shorewall</command>
-                start and <command>shorewall restart</command>. Requires the
-                NFaccnt Match capability in your kernel and iptables.
-                <replaceable>object</replaceable> names an nfacct object (see
-                man nfaccnt(8)). Multiple rules can specify the same
-                <replaceable>object</replaceable>; all packets that match any
-                of the rules increment the packet and bytes count of the
-                object.</para>
-
-                <para>Prior to Shorewall 4.5.16, only one
-                <replaceable>object</replaceable> could be specified.
-                Beginning with Shorewall 4.5.16, an arbitrary number of
-                objects may be given.</para>
-
-                <para>With Shorewall 4.5.16 or later, an nfacct
-                <replaceable>object</replaceable> in the list may optionally
-                be followed by <emphasis role="bold">!</emphasis> to indicate
-                that the nfacct <replaceable>object</replaceable> will be
-                incremented unconditionally for each packet. When <emphasis
-                role="bold">!</emphasis> is omitted, the
-                <replaceable>object</replaceable> will be incremented only if
-                all of the matches in the rule succeed.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">NFLOG</emphasis>[(nflog-parameters)]
-              - Added in Shorewall-4.4.20.</term>
-
-              <listitem>
-                <para>Causes each matching packet to be sent via the currently
-                loaded logging back end (usually nfnetlink_log) where it is
-                available to accounting daemons through a netlink
-                socket.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">?COMMENT</emphasis></term>
-
-              <listitem>
-                <para>The remainder of the line is treated as a comment which
-                is attached to subsequent rules until another ?COMMENT line is
-                found or until the end of the file is reached. To stop adding
-                comments to rules, use a line with only the word
-                ?COMMENT.</para>
-              </listitem>
-            </varlistentry>
-          </variablelist>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">CHAIN</emphasis> - {<emphasis
-        role="bold">-</emphasis>|<emphasis>chain</emphasis>}</term>
-
-        <listitem>
-          <para>The name of a <emphasis>chain</emphasis>. If specified as
-          <emphasis role="bold">-</emphasis> the <emphasis
-          role="bold">accounting</emphasis> chain is assumed when the file is
-          un-sectioned. When the file is sectioned, the default is one of
-          accountin, accountout, etc. depending on the section. This is the
-          chain where the accounting rule is added. The
-          <emphasis>chain</emphasis> will be created if it doesn't already
-          exist. The <emphasis>chain</emphasis> may not exceed 29 characters
-          in length.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">SOURCE</emphasis> - {<emphasis
-        role="bold">-</emphasis>|<emphasis
-        role="bold">any</emphasis>|<emphasis
-        role="bold">all</emphasis>|<emphasis>interface</emphasis>|<emphasis>interface</emphasis><emphasis
-        role="bold">:<option>[</option></emphasis><emphasis>address</emphasis><option>]</option>|<emphasis>address</emphasis>}</term>
-
-        <listitem>
-          <para>Packet Source.</para>
-
-          <para>The name of an <replaceable>interface</replaceable>, an
-          <replaceable>address</replaceable> (host or net) or an
-          <replaceable>interface</replaceable> name followed by ":" and a host
-          or net <replaceable>address</replaceable>. An ipset name is also
-          accepted as an <replaceable>address</replaceable>.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">DEST</emphasis> - {<emphasis
-        role="bold">-</emphasis>|<emphasis
-        role="bold">any</emphasis>|<emphasis
-        role="bold">all</emphasis>|<emphasis>interface</emphasis>|<emphasis>interface</emphasis><option>:[</option><emphasis>address</emphasis><option>]</option>|<emphasis>address</emphasis>}</term>
-
-        <listitem>
-          <para>Packet Destination.</para>
-
-          <para>Format same as <emphasis role="bold">SOURCE</emphasis>
-          column.</para>
-
-          <para>This column was formerly labelled DESTINATION.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">PROTO</emphasis> - {<emphasis
-        role="bold">-</emphasis>|<emphasis
-        role="bold">any</emphasis>|<emphasis
-        role="bold">all</emphasis>|<emphasis>protocol-name</emphasis>|<emphasis>protocol-number</emphasis>|<emphasis
-        role="bold">ipp2p</emphasis>[<emphasis
-        role="bold">:</emphasis>{<emphasis
-        role="bold">udp</emphasis>|<emphasis
-        role="bold">all</emphasis>}]}</term>
-
-        <listitem>
-          <para>A <emphasis>protocol-name</emphasis> (from protocols(5)), a
-          <emphasis>protocol-number</emphasis>, <emphasis
-          role="bold">ipp2p</emphasis>, <emphasis
-          role="bold">ipp2p:udp</emphasis> or <emphasis
-          role="bold">ipp2p:all</emphasis></para>
-
-          <para>Beginning with Shorewall 4.5.12, this column can accept a
-          comma-separated list of protocols.</para>
-
-          <para>This column was formerly labelled PROTOCOL.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">DPORT</emphasis> - {<emphasis
-        role="bold">-</emphasis>|<emphasis
-        role="bold">any</emphasis>|<emphasis
-        role="bold">all</emphasis>|<emphasis>ipp2p-option</emphasis>|<emphasis>port-name-or-number</emphasis>[,<emphasis>port-name-or-number</emphasis>]...}</term>
-
-        <listitem>
-          <para>Destination Port number. Service name from services(5) or
-          <emphasis>port number</emphasis>. May only be specified if the
-          protocol is TCP (6), UDP (17), DCCP (33), SCTP (132) or UDPLITE
-          (136).</para>
-
-          <para>You may place a comma-separated list of port names or numbers
-          in this column if your kernel and ip6tables include multi-port match
-          support.</para>
-
-          <para>If the PROTOCOL is <emphasis role="bold">ipp2p</emphasis> then
-          this column must contain an <emphasis>ipp2p-option</emphasis>
-          ("ip6tables -m ipp2p --help") without the leading "--". If no option
-          is given in this column, <emphasis role="bold">ipp2p</emphasis> is
-          assumed.</para>
-
-          <para>This column was formerly labelled DEST PORT(S).</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">SPORT</emphasis> - {<emphasis
-        role="bold">-</emphasis>|<emphasis
-        role="bold">any</emphasis>|<emphasis
-        role="bold">all</emphasis>|<emphasis>port-name-or-number</emphasis>[,<emphasis>port-name-or-number</emphasis>]...}</term>
-
-        <listitem>
-          <para>Service name from services(5) or <emphasis>port
-          number</emphasis>. May only be specified if the protocol is TCP (6),
-          UDP (17), DCCP (33), SCTP (132) or UDPLITE (136).</para>
-
-          <para>You may place a comma-separated list of port numbers in this
-          column if your kernel and ip6tables include multi-port match
-          support.</para>
-
-          <para>Beginning with Shorewall 4.5.15, you may place '=' in this
-          column, provided that the DPORT column is non-empty. This causes the
-          rule to match when either the source port or the destination port in
-          a packet matches one of the ports specified in DPORT. Use of '='
-          requires multi-port match in your iptables and kernel.</para>
-
-          <para>This column was formerly labelled SOURCE PORT(S).</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">USER</emphasis> - [<emphasis
-        role="bold">!</emphasis>][<emphasis>user-name-or-number</emphasis>][<emphasis
-        role="bold">:</emphasis><emphasis>group-name-or-number</emphasis>][<emphasis
-        role="bold">+</emphasis><emphasis>program-name</emphasis>]</term>
-
-        <listitem>
-          <para>This column may only be non-empty if the <emphasis
-          role="bold">CHAIN</emphasis> is <emphasis
-          role="bold">OUTPUT</emphasis>.</para>
-
-          <para>When this column is non-empty, the rule applies only if the
-          program generating the output is running under the effective
-          <emphasis>user</emphasis> and/or <emphasis>group</emphasis>
-          specified (or is NOT running under that id if "!" is given).</para>
-
-          <para>Examples:</para>
-
-          <variablelist>
-            <varlistentry>
-              <term>joe</term>
-
-              <listitem>
-                <para>program must be run by joe</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>:kids</term>
-
-              <listitem>
-                <para>program must be run by a member of the 'kids'
-                group</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>!:kids</term>
-
-              <listitem>
-                <para>program must not be run by a member of the 'kids'
-                group</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>+upnpd</term>
-
-              <listitem>
-                <para>#program named upnpd</para>
-
-                <important>
-                  <para>The ability to specify a program name was removed from
-                  Netfilter in kernel version 2.6.14.</para>
-                </important>
-              </listitem>
-            </varlistentry>
-          </variablelist>
-
-          <para>This column was formerly labelled USER/GROUP.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">MARK</emphasis> - [<emphasis
-        role="bold">!</emphasis>]<emphasis>value</emphasis>[/<emphasis>mask</emphasis>][<emphasis
-        role="bold">:C</emphasis>]</term>
-
-        <listitem>
-          <para>Defines a test on the existing packet or connection mark. The
-          rule will match only if the test returns true.</para>
-
-          <para>If you don't want to define a test but need to specify
-          anything in the following columns, place a "-" in this field.</para>
-
-          <variablelist>
-            <varlistentry>
-              <term>!</term>
-
-              <listitem>
-                <para>Inverts the test (not equal)</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis>value</emphasis></term>
-
-              <listitem>
-                <para>Value of the packet or connection mark.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis>mask</emphasis></term>
-
-              <listitem>
-                <para>A mask to be applied to the mark before testing.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">:C</emphasis></term>
-
-              <listitem>
-                <para>Designates a connection mark. If omitted, the packet
-                mark's value is tested.</para>
-              </listitem>
-            </varlistentry>
-          </variablelist>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">IPSEC - <emphasis>option-list</emphasis>
-        (Optional - Added in Shorewall 4.4.13 but broken until 4.5.4.1
-        )</emphasis></term>
-
-        <listitem>
-          <para>The option-list consists of a comma-separated list of options
-          from the following list. Only packets that will be encrypted or have
-          been decrypted via an SA that matches these options will have their
-          source address changed. May only be specified when sections are
-          used.</para>
-
-          <variablelist>
-            <varlistentry>
-              <term><emphasis
-              role="bold">reqid=</emphasis><emphasis>number</emphasis></term>
-
-              <listitem>
-                <para>where <emphasis>number</emphasis> is specified using
-                setkey(8) using the 'unique:<emphasis>number</emphasis> option
-                for the SPD level.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">spi=</emphasis>&lt;number&gt;</term>
-
-              <listitem>
-                <para>where <emphasis>number</emphasis> is the SPI of the SA
-                used to encrypt/decrypt packets.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">proto=</emphasis><emphasis
-              role="bold">ah</emphasis>|<emphasis
-              role="bold">esp</emphasis>|<emphasis
-              role="bold">ipcomp</emphasis></term>
-
-              <listitem>
-                <para>IPSEC Encapsulation Protocol</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis
-              role="bold">mss=</emphasis><emphasis>number</emphasis></term>
-
-              <listitem>
-                <para>sets the MSS field in TCP packets</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">mode=</emphasis><emphasis
-              role="bold">transport</emphasis>|<emphasis
-              role="bold">tunnel</emphasis></term>
-
-              <listitem>
-                <para>IPSEC mode</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis
-              role="bold">tunnel-src=</emphasis><emphasis>address</emphasis>[/<emphasis>mask</emphasis>]</term>
-
-              <listitem>
-                <para>only available with mode=tunnel</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis
-              role="bold">tunnel-dst=</emphasis><emphasis>address</emphasis>[/<emphasis>mask</emphasis>]</term>
-
-              <listitem>
-                <para>only available with mode=tunnel</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">strict</emphasis></term>
-
-              <listitem>
-                <para>Means that packets must match all rules.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">next</emphasis></term>
-
-              <listitem>
-                <para>Separates rules; can only be used with strict</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">yes</emphasis> or <emphasis
-              role="bold">ipsec</emphasis></term>
-
-              <listitem>
-                <para>When used by itself, causes all traffic that will be
-                encrypted/encapsulated or has been decrypted/un-encapsulated
-                to match the rule.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">no</emphasis> or <emphasis
-              role="bold">none</emphasis></term>
-
-              <listitem>
-                <para>When used by itself, causes all traffic that will not be
-                encrypted/encapsulated or has been decrypted/un-encapsulated
-                to match the rule.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">in</emphasis></term>
-
-              <listitem>
-                <para>May only be used in the FORWARD section and must be the
-                first or the only item the list. Indicates that matching
-                packets have been decrypted in input.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">out</emphasis></term>
-
-              <listitem>
-                <para>May only be used in the FORWARD section and must be the
-                first or the only item in the list. Indicates that matching
-                packets will be encrypted on output.</para>
-              </listitem>
-            </varlistentry>
-          </variablelist>
-
-          <para>If this column is non-empty and sections are not used,
-          then:</para>
-
-          <itemizedlist>
-            <listitem>
-              <para>A chain NAME appearing in the ACTION column must be a
-              chain branched either directly or indirectly from the <emphasis
-              role="bold">accipsecin</emphasis> or <emphasis
-              role="bold">accipsecout</emphasis> chain.</para>
-            </listitem>
-
-            <listitem>
-              <para>The CHAIN column must contain either <emphasis
-              role="bold">accipsecin</emphasis> or <emphasis
-              role="bold">accipsecout</emphasis> or a chain branched either
-              directly or indirectly from those chains.</para>
-            </listitem>
-
-            <listitem>
-              <para>These rules will NOT appear in the <emphasis
-              role="bold">accounting</emphasis> chain.</para>
-            </listitem>
-          </itemizedlist>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">HEADERS -
-        [!][any:|exactly:]</emphasis><replaceable>header-list
-        </replaceable>(Optional - Added in Shorewall 4.4.15)</term>
-
-        <listitem>
-          <para>The <replaceable>header-list</replaceable> consists of a
-          comma-separated list of headers from the following list.</para>
-
-          <variablelist>
-            <varlistentry>
-              <term><emphasis role="bold">auth</emphasis>, <emphasis
-              role="bold">ah</emphasis>, or <emphasis
-              role="bold">51</emphasis></term>
-
-              <listitem>
-                <para><firstterm>Authentication Headers</firstterm> extension
-                header.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">esp</emphasis>, or <emphasis
-              role="bold">50</emphasis></term>
-
-              <listitem>
-                <para><firstterm>Encrypted Security Payload</firstterm>
-                extension header.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">hop</emphasis>, <emphasis
-              role="bold">hop-by-hop</emphasis> or <emphasis
-              role="bold">0</emphasis></term>
-
-              <listitem>
-                <para>Hop-by-hop options extension header.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">route</emphasis>, <emphasis
-              role="bold">ipv6-route</emphasis> or <emphasis
-              role="bold">41</emphasis></term>
-
-              <listitem>
-                <para>IPv6 Route extension header.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">frag</emphasis>, <emphasis
-              role="bold">ipv6-frag</emphasis> or <emphasis
-              role="bold">44</emphasis></term>
-
-              <listitem>
-                <para>IPv6 fragmentation extension header.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">none</emphasis>, <emphasis
-              role="bold">ipv6-nonxt</emphasis> or <emphasis
-              role="bold">59</emphasis></term>
-
-              <listitem>
-                <para>No next header</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">proto</emphasis>, <emphasis
-              role="bold">protocol</emphasis> or <emphasis
-              role="bold">255</emphasis></term>
-
-              <listitem>
-                <para>Any protocol header.</para>
-              </listitem>
-            </varlistentry>
-          </variablelist>
-
-          <para>If <emphasis role="bold">any:</emphasis> is specified, the
-          rule will match if any of the listed headers are present. If
-          <emphasis role="bold">exactly:</emphasis> is specified, the will
-          match packets that exactly include all specified headers. If neither
-          is given, <emphasis role="bold">any:</emphasis> is assumed.</para>
-
-          <para>If <emphasis role="bold">!</emphasis> is entered, the rule
-          will match those packets which would not be matched when <emphasis
-          role="bold">!</emphasis> is omitted.</para>
-        </listitem>
-      </varlistentry>
-    </variablelist>
-
-    <para>In all of the above columns except <emphasis
-    role="bold">ACTION</emphasis> and <emphasis role="bold">CHAIN</emphasis>,
-    the values <emphasis role="bold">-</emphasis>, <emphasis
-    role="bold">any</emphasis> and <emphasis role="bold">all</emphasis> may be
-    used as wildcards. Omitted trailing columns are also treated as
-    wildcards.</para>
-  </refsect1>
-
-  <refsect1>
-    <title>FILES</title>
-
-    <para>/etc/shorewall6/accounting</para>
-  </refsect1>
-
-  <refsect1>
-    <title>See ALSO</title>
-
-    <para><ulink
-    url="/Accounting.html">http://www.shorewall.net/Accounting.html
-    </ulink></para>
-
-    <para><ulink
-    url="/shorewall_logging.html">http://www.shorewall.net/shorewall_logging.html</ulink></para>
-
-    <para><ulink
-    url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
-
-    <para>shorewall6(8), shorewall6-actions(5), shorewall6-blacklist(5),
-    shorewall6-hosts(5), shorewall6-interfaces(5), shorewall6-maclist(5),
-    shorewall6-netmap(5),shorewall6-params(5), shorewall6-policy(5),
-    shorewall6-providers(5), shorewall6-rtrules(5),
-    shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5),
-    shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5),
-    shorewall6-mangle(5), shorewall6-tos(5), shorewall6-tunnels(5),
-    shorewall6-zones(5)</para>
-  </refsect1>
-</refentry>

Shorewall6/manpages/shorewall6-actions.xml

@@ -1,260 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
-"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
-<refentry>
-  <refmeta>
-    <refentrytitle>shorewall6-actions</refentrytitle>
-
-    <manvolnum>5</manvolnum>
-
-    <refmiscinfo>Configuration Files</refmiscinfo>
-  </refmeta>
-
-  <refnamediv>
-    <refname>actions</refname>
-
-    <refpurpose>shorewall6 action declaration file</refpurpose>
-  </refnamediv>
-
-  <refsynopsisdiv>
-    <cmdsynopsis>
-      <command>/etc/shorewall6/actions</command>
-    </cmdsynopsis>
-  </refsynopsisdiv>
-
-  <refsect1>
-    <title>Description</title>
-
-    <para>This file allows you to define new ACTIONS for use in rules (see
-    <ulink
-    url="/manpages6/shorewall6-rules.html">shorewall6-rules(5)</ulink>). You
-    define the ip6tables rules to be performed in an ACTION in
-    /etc/shorewall6/action.<emphasis>action-name</emphasis>.</para>
-
-    <para>Columns are:</para>
-
-    <variablelist>
-      <varlistentry>
-        <term>NAME</term>
-
-        <listitem>
-          <para>The name of the action. ACTION names should begin with an
-          upper-case letter to distinguish them from Shorewall-generated chain
-          names and be composed of letters, digits or numbers. If you intend
-          to log from the action then the name must be no longer than 11
-          characters in length if you use the standard LOGFORMAT.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>OPTIONS</term>
-
-        <listitem>
-          <para>Added in Shorewall 4.5.10. Available options are:</para>
-
-          <variablelist>
-            <varlistentry>
-              <term><option>audit</option></term>
-
-              <listitem>
-                <para>Added in Shorewall 5.0.7. When this option is specified,
-                the action is expected to have at least two parameters; the
-                first is a target and the second is either 'audit' or omitted.
-                If the second is 'audit', then the first must be an auditable
-                target (ACCEPT, DROP or REJECT).</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>builtin</term>
-
-              <listitem>
-                <para>Added in Shorewall 4.5.16. Defines the action as a rule
-                target that is supported by your ip6tables but is not directly
-                supported by Shorewall. The action may be used as the rule
-                target in an INLINE rule in <ulink
-                url="/manpages6/shorewall6-rules.html">shorewall6-rules</ulink>(5).</para>
-
-                <para>Beginning with Shorewall 4.6.0, the Netfilter table(s)
-                in which the <emphasis role="bold">builtin</emphasis> can be
-                used may be specified: <emphasis
-                role="bold">filter</emphasis>, <emphasis
-                role="bold">nat</emphasis>, <emphasis
-                role="bold">mangle</emphasis> and <emphasis
-                role="bold">raw</emphasis>. If no table name(s) are given,
-                then <emphasis role="bold">filter</emphasis> is assumed. The
-                table names follow <emphasis role="bold">builtin</emphasis>
-                and are separated by commas; for example, "FOOBAR
-                builtin,filter,mangle" would specify FOOBAR as a builtin
-                target that can be used in the filter and mangle
-                tables.</para>
-
-                <para>Beginning with Shorewall 4.6.4, you may specify the
-                <emphasis role="bold">terminating</emphasis> option with
-                <emphasis role="bold">builtin</emphasis> to indicate to the
-                Shorewall optimizer that the action is terminating (the
-                current packet will not be passed to the next rule in the
-                chain).</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><option>inline</option></term>
-
-              <listitem>
-                <para>Causes the action body (defined in
-                action.<replaceable>action-name</replaceable>) to be expanded
-                in-line like a macro rather than in its own chain. You can
-                list Shorewall Standard Actions in this file to specify the
-                <option>inline</option> option.</para>
-
-                <caution>
-                  <para>Some of the Shorewall standard actions cannot be used
-                  in-line and will generate a warning and the compiler will
-                  ignore <option>inline</option> if you try to use them that
-                  way:</para>
-
-                  <simplelist>
-                    <member>DropSmurfs</member>
-
-                    <member>IfEvent</member>
-
-                    <member>Invalid (Prior to Shorewall 4.5.13)</member>
-
-                    <member>NotSyn (Prior to Shorewall 4.5.13)</member>
-
-                    <member>RST (Prior to Shorewall 4.5.13)</member>
-
-                    <member>TCPFlags</member>
-                  </simplelist>
-                </caution>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><option>logjump</option></term>
-
-              <listitem>
-                <para>Added in Shorewall 5.0.8. Performs the same function as
-                <option>nolog</option> (below), with the addition that the
-                jump to the actions chain is logged if a log level is
-                specified on the action invocation. For inline actions, this
-                option is identical to <option>nolog</option>.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><option>mangle</option></term>
-
-              <listitem>
-                <para>Added in Shorewall 5.0.7. Specifies that this action is
-                to be used in <ulink
-                url="shorewall6-mangle.html">shorewall6-mangle(5)</ulink>
-                rather than <ulink
-                url="shorewall6-rules.html">shorewall6-rules(5)</ulink>.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><option>nat</option></term>
-
-              <listitem>
-                <para>Added in Shorewall 5.0.13. Specifies that this action is
-                to be used in <ulink
-                url="shorewall6-snat.html">shorewall6-snat(5)</ulink> rather
-                than <ulink
-                url="shorewall6-rules.html">shorewall6-rules(5)</ulink>. The
-                <option>mangle</option> and <option>nat</option> options are
-                mutually exclusive.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><option>noinline</option></term>
-
-              <listitem>
-                <para>Causes any later <option>inline</option> option for the
-                same action to be ignored with a warning.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><option>nolog</option></term>
-
-              <listitem>
-                <para>Added in Shorewall 4.5.11. When this option is
-                specified, the compiler does not automatically apply the log
-                level and/or tag from the invocation of the action to all
-                rules inside of the action. Rather, it simply sets the
-                $_loglevel and $_logtag shell variables which can be used
-                within the action body to apply those logging options only to
-                a subset of the rules.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><option>section</option></term>
-
-              <listitem>
-                <para>Added in Shorewall 5.1.1. When specified, this option
-                causes the rules file section name and a comma to be prepended
-                to the parameters passed to the action (if any). Note that
-                this means that the first parameter passed to the action by
-                the user is actually the second parameter to the action. If
-                the action is invoked out of the blrules file, 'BLACKLIST' is
-                used as the section name.</para>
-
-                <para>Given that neither the <filename>snat</filename> nor the
-                <filename>mangle</filename> file is sectioned, this parameter
-                has no effect when <option>mangle</option> or
-                <option>nat</option> is specified.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><option>state</option>={<option>UNTRACKED</option>|<option>NEW</option>|<option>ESTABLISHED</option>|<option>RELATED</option>|<option>INVALID</option>}</term>
-
-              <listitem>
-                <para>Added in Shorewall 5.0.7. Reserved for use by Shorewall
-                in <filename>actions.std</filename>.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><option>terminating</option></term>
-
-              <listitem>
-                <para>Added in Shorewall 4.6.4. When used with
-                <option>builtin</option>, indicates that the built-in action
-                is termiating (i.e., if the action is jumped to, the next rule
-                in the chain is not evaluated).</para>
-              </listitem>
-            </varlistentry>
-          </variablelist>
-        </listitem>
-      </varlistentry>
-    </variablelist>
-  </refsect1>
-
-  <refsect1>
-    <title>FILES</title>
-
-    <para>/etc/shorewall6/actions</para>
-  </refsect1>
-
-  <refsect1>
-    <title>See ALSO</title>
-
-    <para><ulink
-    url="/Actions.html">http://www.shorewall.net/Actions.html</ulink></para>
-
-    <para>shorewall6(8), shorewall6-accounting(5), shorewall6-blacklist(5),
-    shorewall6-hosts(5), shorewall6-interfaces(5), shorewall6-maclist(5),
-    shorewall6-netmap(5),shorewall6-params(5), shorewall6-policy(5),
-    shorewall6-providers(5), shorewall6-rtrules(5),
-    shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5),
-    shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5),
-    shorewall6-mangle(5), shorewall6-tos(5), shorewall6-tunnels(5),
-    shorewall-zones(5)</para>
-  </refsect1>
-</refentry>

Shorewall6/manpages/shorewall6-blrules.xml

@@ -1,331 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
-"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
-<refentry>
-  <refmeta>
-    <refentrytitle>shorewall6-blrules</refentrytitle>
-
-    <manvolnum>5</manvolnum>
-
-    <refmiscinfo>Configuration Files</refmiscinfo>
-  </refmeta>
-
-  <refnamediv>
-    <refname>blrules</refname>
-
-    <refpurpose>shorewall6 Blacklist file</refpurpose>
-  </refnamediv>
-
-  <refsynopsisdiv>
-    <cmdsynopsis>
-      <command>/etc/shorewall6/blrules</command>
-    </cmdsynopsis>
-  </refsynopsisdiv>
-
-  <refsect1>
-    <title>Description</title>
-
-    <para>This file is used to perform zone-specific blacklisting and
-    whitelisting.</para>
-
-    <para>Rules in this file are applied depending on the setting of
-    BLACKLISTNEWONLY in <ulink
-    url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5). If
-    BLACKLISTNEWONLY=No, then they are applied regardless of the connection
-    tracking state of the packet. If BLACKLISTNEWONLY=Yes, they are applied to
-    connections in the NEW and INVALID states.</para>
-
-    <para>The format of rules in this file is the same as the format of rules
-    in <ulink
-    url="/manpages6/shorewall6-rules.html">shorewall6-rules</ulink>(5). The
-    difference in the two files lies in the ACTION (first) column.</para>
-
-    <variablelist>
-      <varlistentry>
-        <term><emphasis role="bold">ACTION- {<emphasis
-        role="bold">ACCEPT</emphasis>|BLACKLIST|blacklog|CONTINUE|DROP|A_DROP|REJECT|A_REJECT|<emphasis
-        role="bold">WHITELIST</emphasis>|<emphasis
-        role="bold">LOG</emphasis>|<emphasis
-        role="bold">QUEUE</emphasis>|<emphasis
-        role="bold">NFQUEUE</emphasis>[<emphasis
-        role="bold">(</emphasis><emphasis>queuenumber</emphasis><emphasis
-        role="bold">)</emphasis>]<emphasis
-        role="bold">|[?]COMMENT</emphasis>|<emphasis>action</emphasis>|<emphasis>macro</emphasis>[<emphasis
-        role="bold">(</emphasis><emphasis>target</emphasis><emphasis
-        role="bold">)</emphasis>]}<emphasis
-        role="bold">[:</emphasis>{<emphasis>log-level</emphasis>|<emphasis
-        role="bold">none</emphasis>}[<emphasis role="bold"><emphasis
-        role="bold">!</emphasis></emphasis>][<emphasis
-        role="bold">:</emphasis><emphasis>tag</emphasis>]]</emphasis></term>
-
-        <listitem>
-          <para>Specifies the action to be taken if the packet matches the
-          rule. Must be one of the following.</para>
-
-          <variablelist>
-            <varlistentry>
-              <term><emphasis role="bold">BLACKLIST</emphasis></term>
-
-              <listitem>
-                <para>Added in Shorewall 4.5.3. This is actually a macro that
-                expands as follows:</para>
-
-                <itemizedlist>
-                  <listitem>
-                    <para>If BLACKLIST_LOGLEVEL is specified in <ulink
-                    url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5),
-                    then the macro expands to <emphasis
-                    role="bold">blacklog</emphasis>.</para>
-                  </listitem>
-
-                  <listitem>
-                    <para>Otherwise it expands to the action specified for
-                    BLACKLIST_DISPOSITION in <ulink
-                    url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
-                  </listitem>
-                </itemizedlist>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">blacklog</emphasis></term>
-
-              <listitem>
-                <para>May only be used if BLACKLIST_LOGLEVEL is specified in
-                <ulink url="/manpages6/shorewall6.conf.html">shorewall6.conf
-                </ulink>(5). Logs, audits (if specified) and applies the
-                BLACKLIST_DISPOSITION specified in <ulink
-                url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>
-                (5).</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis
-              role="bold">ACCEPT|CONTINUE|WHITELIST</emphasis></term>
-
-              <listitem>
-                <para>Exempt the packet from the remaining rules in this
-                file.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">DROP</emphasis></term>
-
-              <listitem>
-                <para>Ignore the packet.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>A_DROP and A_DROP!</term>
-
-              <listitem>
-                <para>Audited versions of DROP. Requires AUDIT_TARGET support
-                in the kernel and ip6tables.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">REJECT</emphasis></term>
-
-              <listitem>
-                <para>disallow the packet and return an icmp-unreachable or an
-                RST packet.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>A_REJECT</term>
-
-              <listitem>
-                <para>Audited versions of REJECT. Require AUDIT_TARGET support
-                in the kernel and ip6tables.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">LOG</emphasis></term>
-
-              <listitem>
-                <para>Simply log the packet and continue with the next
-                rule.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">QUEUE</emphasis></term>
-
-              <listitem>
-                <para>Queue the packet to a user-space application such as
-                ftwall (http://p2pwall.sf.net). The application may reinsert
-                the packet for further processing.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis
-              role="bold">NFLOG</emphasis>[(<replaceable>nflog-parameters</replaceable>)]</term>
-
-              <listitem>
-                <para>queues matching packets to a back end logging daemon via
-                a netlink socket then continues to the next rule. See <ulink
-                url="/shorewall.logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">NFQUEUE</emphasis></term>
-
-              <listitem>
-                <para>Queues the packet to a user-space application using the
-                nfnetlink_queue mechanism. If a
-                <replaceable>queuenumber</replaceable> is not specified, queue
-                zero (0) is assumed.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">?COMMENT</emphasis></term>
-
-              <listitem>
-                <para>the rest of the line will be attached as a comment to
-                the Netfilter rule(s) generated by the following entries. The
-                comment will appear delimited by "/* ... */" in the output of
-                "shorewall6 show &lt;chain&gt;". To stop the comment from
-                being attached to further rules, simply include ?COMMENT on a
-                line by itself.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis>action</emphasis></term>
-
-              <listitem>
-                <para>The name of an <emphasis>action</emphasis> declared in
-                <ulink
-                url="/manpages6/shorewall6-actions.html">shorewall6-actions</ulink>(5)
-                or in /usr/share/shorewall6/actions.std.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis>macro</emphasis></term>
-
-              <listitem>
-                <para>The name of a macro defined in a file named
-                macro.<emphasis>macro</emphasis>. If the macro accepts an
-                action parameter (Look at the macro source to see if it has
-                PARAM in the TARGET column) then the
-                <emphasis>macro</emphasis> name is followed by the
-                parenthesized <emphasis>target</emphasis> (<emphasis
-                role="bold">ACCEPT</emphasis>, <emphasis
-                role="bold">DROP</emphasis>, <emphasis
-                role="bold">REJECT</emphasis>, ...) to be substituted for the
-                parameter.</para>
-
-                <para>Example: FTP(ACCEPT).</para>
-              </listitem>
-            </varlistentry>
-          </variablelist>
-
-          <para>The <emphasis role="bold">ACTION</emphasis> may optionally be
-          followed by ":" and a syslog log level (e.g, REJECT:info or
-          Web(ACCEPT):debug). This causes the packet to be logged at the
-          specified level.</para>
-
-          <para>If the <emphasis role="bold">ACTION</emphasis> names an
-          <emphasis>action</emphasis> declared in <ulink
-          url="/manpages6/shorewall6-actions.html">shorewall6-actions</ulink>(5)
-          or in /usr/share/shorewall6/actions.std then:</para>
-
-          <itemizedlist>
-            <listitem>
-              <para>If the log level is followed by "!' then all rules in the
-              action are logged at the log level.</para>
-            </listitem>
-
-            <listitem>
-              <para>If the log level is not followed by "!" then only those
-              rules in the action that do not specify logging are logged at
-              the specified level.</para>
-            </listitem>
-
-            <listitem>
-              <para>The special log level <emphasis
-              role="bold">none!</emphasis> suppresses logging by the
-              action.</para>
-            </listitem>
-          </itemizedlist>
-
-          <para>You may also specify <emphasis role="bold">NFLOG</emphasis>
-          (must be in upper case) as a log level.This will log to the NFLOG
-          target for routing to a separate log through use of ulogd (<ulink
-          url="http://www.netfilter.org/projects/ulogd/index.html">http://www.netfilter.org/projects/ulogd/index.html</ulink>).</para>
-
-          <para>Actions specifying logging may be followed by a log tag (a
-          string of alphanumeric characters) which is appended to the string
-          generated by the LOGPREFIX (in <ulink
-          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5)).</para>
-        </listitem>
-      </varlistentry>
-    </variablelist>
-
-    <para>For the remaining columns, see <ulink
-    url="/manpages6/shorewall6-rules.html">shorewall6-rules
-    (5)</ulink>.</para>
-  </refsect1>
-
-  <refsect1>
-    <title>Example</title>
-
-    <variablelist>
-      <varlistentry>
-        <term>Example 1:</term>
-
-        <listitem>
-          <para>Drop Teredo packets from the net.</para>
-
-          <programlisting>DROP          net:[2001::/32]            all</programlisting>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>Example 2:</term>
-
-        <listitem>
-          <para>Don't subject packets from 2001:DB8::/64 to the remaining
-          rules in the file.</para>
-
-          <programlisting>WHITELIST     net:[2001:DB8::/64]        all</programlisting>
-        </listitem>
-      </varlistentry>
-    </variablelist>
-  </refsect1>
-
-  <refsect1>
-    <title>FILES</title>
-
-    <para>/etc/shorewall6/blrules</para>
-  </refsect1>
-
-  <refsect1>
-    <title>See ALSO</title>
-
-    <para><ulink
-    url="/blacklisting_support.htm">http://www.shorewall.net/blacklisting_support.htm</ulink></para>
-
-    <para><ulink
-    url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
-
-    <para>shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5),
-    shorewall6-hosts(5), shorewall6-interfaces(5), shorewall6-maclist(5),
-    shorewall6-netmap(5),shorewall6-params(5), shorewall6-policy(5),
-    shorewall6-providers(5), shorewall6-rtrules(5),
-    shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5),
-    shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5),
-    shorewall6-mangle(5), shorewall6-tos(5), shorewall6-tunnels(5),
-    shorewall6-zones(5)</para>
-  </refsect1>
-</refentry>

Shorewall6/manpages/shorewall6-conntrack.xml

@@ -1,739 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
-"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
-<refentry>
-  <refmeta>
-    <refentrytitle>shorewall6-conntrack</refentrytitle>
-
-    <manvolnum>5</manvolnum>
-
-    <refmiscinfo>Configuration Files</refmiscinfo>
-  </refmeta>
-
-  <refnamediv>
-    <refname>conntrack</refname>
-
-    <refpurpose>shorewall6 conntrack file</refpurpose>
-  </refnamediv>
-
-  <refsynopsisdiv>
-    <cmdsynopsis>
-      <command>/etc/shorewall6/conntrack</command>
-    </cmdsynopsis>
-  </refsynopsisdiv>
-
-  <refsect1>
-    <title>Description</title>
-
-    <para>The original intent of the <emphasis role="bold">notrack</emphasis>
-    file was to exempt certain traffic from Netfilter connection tracking.
-    Traffic matching entries in the file were not to be tracked.</para>
-
-    <para>The role of the file was expanded in Shorewall 4.4.27 to include all
-    rules that can be added in the Netfilter <emphasis
-    role="bold">raw</emphasis> table. In 4.5.7, the file's name was changed to
-    <emphasis role="bold">conntrack</emphasis>.</para>
-
-    <para>The file supports two different column layouts: FORMAT 1, FORMAT 2,
-    and FORMAT 3, FORMAT 1 being the default. The three differ as
-    follows:</para>
-
-    <itemizedlist>
-      <listitem>
-        <para>in FORMAT 2 and 3, there is an additional leading ACTION
-        column.</para>
-      </listitem>
-
-      <listitem>
-        <para>in FORMAT 3, the SOURCE column accepts no zone name; rather the
-        ACTION column allows a SUFFIX that determines the chain(s) that the
-        generated rule will be added to.</para>
-      </listitem>
-    </itemizedlist>
-
-    <para>When an entry in the following form is encountered, the format of
-    the following entries are assumed to be of the specified
-    <replaceable>format</replaceable>.</para>
-
-    <simplelist>
-      <member><emphasis role="bold">?FORMAT</emphasis>
-      <replaceable>format</replaceable></member>
-    </simplelist>
-
-    <para>where <replaceable>format</replaceable> is either <emphasis
-    role="bold">1</emphasis>,<emphasis role="bold">2</emphasis> or <emphasis
-    role="bold">3</emphasis>.</para>
-
-    <para>Format 3 was introduced in Shorewall 4.5.10.</para>
-
-    <para>Comments may be attached to Netfilter rules generated from entries
-    in this file through the use of ?COMMENT lines. These lines begin with
-    ?COMMENT; the remainder of the line is treated as a comment which is
-    attached to subsequent rules until another ?COMMENT line is found or until
-    the end of the file is reached. To stop adding comments to rules, use a
-    line with only ?COMMENT.</para>
-
-    <para>The columns in the file are as follows (where the column name is
-    followed by a different name in parentheses, the different name is used in
-    the alternate specification syntax).</para>
-
-    <variablelist>
-      <varlistentry>
-        <term><emphasis role="bold">ACTION</emphasis> - {<emphasis
-        role="bold">NOTRACK</emphasis>|<emphasis
-        role="bold">CT</emphasis>:<emphasis
-        role="bold">helper</emphasis>:<replaceable>name</replaceable>[(<replaceable>arg</replaceable>=<replaceable>val</replaceable>[,...])|<emphasis
-        role="bold">CT:ctevents:<replaceable>event</replaceable>[,...]|CT:expevents:new|notrack</emphasis>|DROP|LOG|NFLOG(<replaceable>nflog-parameters</replaceable>)|IP6TABLES(<replaceable>target</replaceable>)}[:<replaceable>log-level</replaceable>[:<replaceable>log-tag</replaceable>]][:<replaceable>chain-designator</replaceable>]</term>
-
-        <listitem>
-          <para>This column is only present when FORMAT &gt;= 2. Values other
-          than NOTRACK require <firstterm>CT Target </firstterm>support in
-          your iptables and kernel.</para>
-
-          <itemizedlist>
-            <listitem>
-              <para><option>NOTRACK</option> or
-              <option>CT:notrack</option></para>
-
-              <para>Disables connection tracking for this packet. If a
-              <replaceable>log-level</replaceable> is specified, the packet
-              will also be logged at that level.</para>
-            </listitem>
-
-            <listitem>
-              <para><option>helper</option>:<replaceable>name</replaceable></para>
-
-              <para>Attach the helper identified by the
-              <replaceable>name</replaceable> to this connection. This is more
-              flexible than loading the conntrack helper with preset ports. If
-              a <replaceable>log-level</replaceable> is specified, the packet
-              will also be logged at that level.</para>
-
-              <para>At this writing, the available helpers are:</para>
-
-              <variablelist>
-                <varlistentry>
-                  <term>amanda</term>
-
-                  <listitem>
-                    <para>Requires that the amanda netfilter helper is
-                    present.</para>
-                  </listitem>
-                </varlistentry>
-
-                <varlistentry>
-                  <term>ftp</term>
-
-                  <listitem>
-                    <para>Requires that the FTP netfilter helper is
-                    present.</para>
-                  </listitem>
-                </varlistentry>
-
-                <varlistentry>
-                  <term>irc</term>
-
-                  <listitem>
-                    <para>Requires that the IRC netfilter helper is
-                    present.</para>
-                  </listitem>
-                </varlistentry>
-
-                <varlistentry>
-                  <term>netbios-ns</term>
-
-                  <listitem>
-                    <para>Requires that the netbios_ns (sic) helper is
-                    present.</para>
-                  </listitem>
-                </varlistentry>
-
-                <varlistentry>
-                  <term>RAS and Q.931</term>
-
-                  <listitem>
-                    <para>These require that the H323 netfilter helper is
-                    present.</para>
-                  </listitem>
-                </varlistentry>
-
-                <varlistentry>
-                  <term>pptp</term>
-
-                  <listitem>
-                    <para>Requires that the pptp netfilter helper is
-                    present.</para>
-                  </listitem>
-                </varlistentry>
-
-                <varlistentry>
-                  <term>sane</term>
-
-                  <listitem>
-                    <para>Requires that the SANE netfilter helper is
-                    present.</para>
-                  </listitem>
-                </varlistentry>
-
-                <varlistentry>
-                  <term>sip</term>
-
-                  <listitem>
-                    <para>Requires that the SIP netfilter helper is
-                    present.</para>
-                  </listitem>
-                </varlistentry>
-
-                <varlistentry>
-                  <term>snmp</term>
-
-                  <listitem>
-                    <para>Requires that the SNMP netfilter helper is
-                    present.</para>
-                  </listitem>
-                </varlistentry>
-
-                <varlistentry>
-                  <term>tftp</term>
-
-                  <listitem>
-                    <para>Requires that the TFTP netfilter helper is
-                    present.</para>
-                  </listitem>
-                </varlistentry>
-              </variablelist>
-
-              <para>May be followed by an option list of
-              <replaceable>arg</replaceable>=<replaceable>val</replaceable>
-              pairs in parentheses:</para>
-
-              <itemizedlist>
-                <listitem>
-                  <para><option>ctevents</option>=<replaceable>event</replaceable>[,...]</para>
-
-                  <para>Only generate the specified conntrack events for this
-                  connection. Possible event types are: <emphasis
-                  role="bold">new</emphasis>, <emphasis
-                  role="bold">related</emphasis>, <emphasis
-                  role="bold">destroy</emphasis>, <emphasis
-                  role="bold">reply</emphasis>, <emphasis
-                  role="bold">assured</emphasis>, <emphasis
-                  role="bold">protoinfo</emphasis>, <emphasis
-                  role="bold">helper</emphasis>, <emphasis
-                  role="bold">mark</emphasis> (this is connection mark, not
-                  packet mark), <emphasis role="bold">natseqinfo</emphasis>,
-                  and <emphasis role="bold">secmark</emphasis>. If more than
-                  one <emphasis>event</emphasis> is listed, the
-                  <replaceable>event</replaceable> list must be enclosed in
-                  parentheses (e.g., ctevents=(new,related)).</para>
-                </listitem>
-
-                <listitem>
-                  <para><option>expevents</option><option>=new</option></para>
-
-                  <para>Only generate <emphasis role="bold">new</emphasis>
-                  expectation events for this connection.</para>
-                </listitem>
-              </itemizedlist>
-            </listitem>
-
-            <listitem>
-              <para>ctevents:<replaceable>event</replaceable>[,...]</para>
-
-              <para>Added in Shorewall 4.6.10. Only generate the specified
-              conntrack events for this connection. Possible event types are:
-              <emphasis role="bold">new</emphasis>, <emphasis
-              role="bold">related</emphasis>, <emphasis
-              role="bold">destroy</emphasis>, <emphasis
-              role="bold">reply</emphasis>, <emphasis
-              role="bold">assured</emphasis>, <emphasis
-              role="bold">protoinfo</emphasis>, <emphasis
-              role="bold">helper</emphasis>, <emphasis
-              role="bold">mark</emphasis> (this is connection mark, not packet
-              mark), <emphasis role="bold">natseqinfo</emphasis>, and
-              <emphasis role="bold">secmark</emphasis>.</para>
-            </listitem>
-
-            <listitem>
-              <para>expevents=new</para>
-
-              <para>Added in Shorewall 4.6.10. Only generate <emphasis
-              role="bold">new</emphasis> expectation events for this
-              connection.</para>
-            </listitem>
-
-            <listitem>
-              <para><option>DROP</option></para>
-
-              <para>Added in Shorewall 4.5.10. Silently discard the packet. If
-              a <replaceable>log-level</replaceable> is specified, the packet
-              will also be logged at that level.</para>
-            </listitem>
-
-            <listitem>
-              <para><option>IP6TABLES</option>(<replaceable>target</replaceable>)</para>
-
-              <para>Added in Shorewall 4.6.0. Allows you to specify any
-              iptables <replaceable>target</replaceable> with target options
-              (e.g., "IP6TABLES(AUDIT --type drop)"). If the target is not one
-              recognized by Shorewall, the following error message will be
-              issued:</para>
-
-              <simplelist>
-                <member>ERROR: Unknown target
-                (<replaceable>target</replaceable>)</member>
-              </simplelist>
-
-              <para>This error message may be eliminated by adding
-              <replaceable>target</replaceable> as a builtin action in <ulink
-              url="/manpages6/shorewall6-actions.html">shorewall6-actions(5)</ulink>.</para>
-            </listitem>
-
-            <listitem>
-              <para><option>LOG</option></para>
-
-              <para>Added in Shoreawll 4.6.0. Logs the packet using the
-              specified <replaceable>log-level</replaceable> and<replaceable>
-              log-tag </replaceable>(if any). If no log-level is specified,
-              then 'info' is assumed.</para>
-            </listitem>
-
-            <listitem>
-              <para><option>NFLOG</option></para>
-
-              <para>Added in Shoreawll 4.6.0. Queues the packet to a backend
-              logging daemon using the NFLOG netfilter target with the
-              specified <replaceable>nflog-parameters</replaceable>.</para>
-            </listitem>
-          </itemizedlist>
-
-          <para>When FORMAT = 1, this column is not present and the rule is
-          processed as if NOTRACK had been entered in this column.</para>
-
-          <para>Beginning with Shorewall 4.5.10, when FORMAT = 3, this column
-          can end with a colon followed by a
-          <replaceable>chain-designator</replaceable>. The
-          <replaceable>chain-designator</replaceable> can be one of the
-          following:</para>
-
-          <variablelist>
-            <varlistentry>
-              <term>P</term>
-
-              <listitem>
-                <para>The rule is added to the raw table PREROUTING chain.
-                This is the default if no
-                <replaceable>chain-designator</replaceable> is present.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>O</term>
-
-              <listitem>
-                <para>The rule is added to the raw table OUTPUT chain.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>PO or OP</term>
-
-              <listitem>
-                <para>The rule is added to the raw table PREROUTING and OUTPUT
-                chains.</para>
-              </listitem>
-            </varlistentry>
-          </variablelist>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>SOURCE (formats 1 and 2) ‒
-        <emphasis>zone</emphasis>[:<emphasis>interface</emphasis>][:<emphasis>address-list</emphasis>]</term>
-
-        <listitem>
-          <para>where <replaceable>zone</replaceable> is the name of a zone,
-          <replaceable>interface</replaceable> is an interface to that zone,
-          and <replaceable>address-list</replaceable> is a comma-separated
-          list of addresses (may contain exclusion - see <ulink
-          url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>
-          (5)).</para>
-
-          <para>Beginning with Shorewall 4.5.7, <option>all</option> can be
-          used as the <replaceable>zone</replaceable> name to mean
-          <firstterm>all zones</firstterm>.</para>
-
-          <para>Beginning with Shorewall 4.5.10, <option>all-</option> can be
-          used as the <replaceable>zone</replaceable> name to mean all
-          <firstterm>off-firewall zone</firstterm>s.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>SOURCE (format 3 prior to Shorewall 5.1.0) ‒
-        {-|<emphasis>interface</emphasis>[:<emphasis>address-list</emphasis>]|<replaceable>address-list</replaceable>}</term>
-
-        <listitem>
-          <para>Where <replaceable>interface</replaceable> is an interface to
-          that zone, and <replaceable>address-list</replaceable> is a
-          comma-separated list of addresses (may contain exclusion - see
-          <ulink
-          url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>
-          (5)).</para>
-
-          <para>COMMENT is only allowed in format 1; the remainder of the line
-          is treated as a comment that will be associated with the generated
-          rule(s).</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">SOURCE (format 3 on Shorewall 5.1.0 and
-        later) -
-        {-|[<replaceable>source-spec</replaceable>[,...]]}</emphasis></term>
-
-        <listitem>
-          <para>where <replaceable>source-spec</replaceable> is one of the
-          following:</para>
-
-          <variablelist>
-            <varlistentry>
-              <term><replaceable>interface</replaceable></term>
-
-              <listitem>
-                <para>Where interface is the logical name of an interface
-                defined in <ulink
-                url="shorewall-interfaces.html">shorewall-interface</ulink>(5).</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>]</term>
-
-              <listitem>
-                <para>where <replaceable>address</replaceable> may be:</para>
-
-                <itemizedlist>
-                  <listitem>
-                    <para>A host or network IP address.</para>
-                  </listitem>
-
-                  <listitem>
-                    <para>A MAC address in Shorewall format (preceded by a
-                    tilde ("~") and using dash ("-") as a separator.</para>
-                  </listitem>
-
-                  <listitem>
-                    <para>The name of an ipset preceded by a plus sign ("+").
-                    See <ulink
-                    url="shorewall-ipsets.html">shorewall-ipsets</ulink>(5).</para>
-                  </listitem>
-                </itemizedlist>
-
-                <para><replaceable>exclusion</replaceable> is described in
-                <ulink
-                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5).</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><replaceable>interface</replaceable>:<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>]</term>
-
-              <listitem>
-                <para>This form combines the preceding two and requires that
-                both the incoming interace and source address match.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><replaceable>exclusion</replaceable></term>
-
-              <listitem>
-                <para>See <ulink
-                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>
-                (5)</para>
-              </listitem>
-            </varlistentry>
-          </variablelist>
-
-          <para>Beginning with Shorewall 5.1.0, multiple
-          <replaceable>source-spec</replaceable>s separated by commas may be
-          specified provided that the following alternative forms are
-          used:</para>
-
-          <blockquote>
-            <para>(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
-
-            <para><replaceable>interface</replaceable>:(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
-
-            <para>(<replaceable>exclusion</replaceable>)</para>
-          </blockquote>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>DEST (Prior to Shorewall 5.1.0) ‒
-        {-|<emphasis>interface</emphasis>[:<emphasis>address-list</emphasis>]|<replaceable>address-list</replaceable>}</term>
-
-        <listitem>
-          <para>where <replaceable>address-list</replaceable> is a
-          comma-separated list of addresses (may contain exclusion - see
-          <ulink
-          url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>
-          (5)).</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">DEST (Shorewall 5.1.0 and later) -
-        {-|<replaceable>dest-spec</replaceable>[,...]}</emphasis></term>
-
-        <listitem>
-          <para>where <replaceable>dest-spec</replaceable> is one of the
-          following:</para>
-
-          <variablelist>
-            <varlistentry>
-              <term><replaceable>interface</replaceable></term>
-
-              <listitem>
-                <para>Where interface is the logical name of an interface
-                defined in <ulink
-                url="shorewall-interfaces.html">shorewall-interface</ulink>(5).</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>]</term>
-
-              <listitem>
-                <para>where <replaceable>address</replaceable> may be:</para>
-
-                <itemizedlist>
-                  <listitem>
-                    <para>A host or network IP address.</para>
-                  </listitem>
-
-                  <listitem>
-                    <para>A MAC address in Shorewall format (preceded by a
-                    tilde ("~") and using dash ("-") as a separator.</para>
-                  </listitem>
-
-                  <listitem>
-                    <para>The name of an ipset preceded by a plus sign ("+").
-                    See <ulink
-                    url="shorewall-ipsets.html">shorewall-ipsets</ulink>(5).</para>
-                  </listitem>
-                </itemizedlist>
-
-                <para><replaceable>exclusion</replaceable> is described in
-                <ulink
-                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>(5).</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><replaceable>interface</replaceable>:<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>]</term>
-
-              <listitem>
-                <para>This form combines the preceding two and requires that
-                both the outgoing interace and destination address
-                match.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><replaceable>exclusion</replaceable></term>
-
-              <listitem>
-                <para>See <ulink
-                url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ulink>
-                (5)</para>
-              </listitem>
-            </varlistentry>
-          </variablelist>
-
-          <para>Beginning with Shorewall 5.1.0, multiple source-specs
-          separated by commas may be specified provided that the following
-          alternative forms are used:</para>
-
-          <blockquote>
-            <para>(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
-
-            <para><replaceable>interface</replaceable>:(<replaceable>address</replaceable>[,...][<replaceable>exclusion</replaceable>])</para>
-
-            <para>(<replaceable>exclusion</replaceable>)</para>
-          </blockquote>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>PROTO ‒
-        <replaceable>protocol-name-or-number</replaceable>[,...]</term>
-
-        <listitem>
-          <para>A protocol name from <filename>/etc/protocols</filename> or a
-          protocol number.</para>
-
-          <para>Beginning with Shorewall 4.5.12, this column can accept a
-          comma-separated list of protocols.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>DPORT -
-        {-|<replaceable>port-number/service-name-list</replaceable>|+<replaceable>ipset</replaceable>}</term>
-
-        <listitem>
-          <para>A comma-separated list of port numbers and/or service names
-          from <filename>/etc/services</filename>. May also include port
-          ranges of the form
-          <replaceable>low-port</replaceable>:<replaceable>high-port</replaceable>
-          if your kernel and iptables include port range support.</para>
-
-          <para>Beginning with Shorewall 4.6.0, an ipset name can be specified
-          in this column. This is intended to be used with
-          <firstterm>bitmap:port</firstterm> ipsets.</para>
-
-          <para>This column was formerly labelled DEST PORT(S).</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>SPORT -
-        {-|<replaceable>port-number/service-name-list</replaceable>|+<replaceable>ipset</replaceable>}</term>
-
-        <listitem>
-          <para>A comma-separated list of port numbers and/or service names
-          from <filename>/etc/services</filename>. May also include port
-          ranges of the form
-          <replaceable>low-port</replaceable>:<replaceable>high-port</replaceable>
-          if your kernel and iptables include port range support.</para>
-
-          <para>Beginning with Shorewall 4.5.15, you may place '=' in this
-          column, provided that the DPORT column is non-empty. This causes the
-          rule to match when either the source port or the destination port in
-          a packet matches one of the ports specified in DPORT.</para>
-
-          <para>Beginning with Shorewall 4.6.0, an ipset name can be specified
-          in this column. This is intended to be used with
-          <firstterm>bitmap:port</firstterm> ipsets.</para>
-
-          <para>This column was formerly labelled SOURCE PORT(S).</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>USER ‒
-        [<replaceable>user</replaceable>][:<replaceable>group</replaceable>]</term>
-
-        <listitem>
-          <para>May only be specified if the SOURCE
-          <replaceable>zone</replaceable> is $FW. Specifies the effective user
-          id and or group id of the process sending the traffic.</para>
-
-          <para>This column was formerly labelled USER/GROUP.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">SWITCH -
-        [!]<replaceable>switch-name</replaceable>[={0|1}]</emphasis></term>
-
-        <listitem>
-          <para>Added in Shorewall6 4.5.10 and allows enabling and disabling
-          the rule without requiring <command>shorewall6
-          restart</command>.</para>
-
-          <para>Enables the rule if the value stored in
-          <filename>/proc/net/nf_condition/<replaceable>switch-name</replaceable></filename>
-          is 1. Disables the rule if that file contains 0 (the default). If
-          '!' is supplied, the test is inverted such that the rule is enabled
-          if the file contains 0.</para>
-
-          <para>Within the <replaceable>switch-name</replaceable>, '@0' and
-          '@{0}' are replaced by the name of the chain to which the rule is a
-          added. The <replaceable>switch-name</replaceable> (after '@...'
-          expansion) must begin with a letter and be composed of letters,
-          decimal digits, underscores or hyphens. Switch names must be 30
-          characters or less in length.</para>
-
-          <para>Switches are normally <emphasis role="bold">off</emphasis>. To
-          turn a switch <emphasis role="bold">on</emphasis>:</para>
-
-          <simplelist>
-            <member><command>echo 1 &gt;
-            /proc/net/nf_condition/<replaceable>switch-name</replaceable></command></member>
-          </simplelist>
-
-          <para>To turn it <emphasis role="bold">off</emphasis> again:</para>
-
-          <simplelist>
-            <member><command>echo 0 &gt;
-            /proc/net/nf_condition/<replaceable>switch-name</replaceable></command></member>
-          </simplelist>
-
-          <para>Switch settings are retained over <command>shorewall6
-          restart</command>.</para>
-
-          <para>When the <replaceable>switch-name</replaceable> is followed by
-          <option>=0</option> or <option>=1</option>, then the switch is
-          initialized to off or on respectively by the
-          <command>start</command> command. Other commands do not affect the
-          switch setting.</para>
-        </listitem>
-      </varlistentry>
-    </variablelist>
-  </refsect1>
-
-  <refsect1>
-    <title>EXAMPLES</title>
-
-    <para>Example 1:</para>
-
-    <para>Use the FTP helper for TCP port 21 connections from the firewall
-    itself.</para>
-
-    <programlisting>FORMAT 2
-#ACTION                       SOURCE            DEST               PROTO            DPORT             SPORT               USER
-CT:helper:ftp(expevents=new)  fw                -                  tcp              21              </programlisting>
-
-    <para>Example 2 (Shorewall 4.5.10 or later):</para>
-
-    <para>Drop traffic to/from all zones to IP address 2001:1.2.3::4</para>
-
-    <programlisting>FORMAT 2
-#ACTION                       SOURCE             DEST               PROTO            DPORT             SPORT               USER
-DROP                          all-:2001:1.2.3::4 -
-DROP                          all                2001:1.2.3::4
-</programlisting>
-
-    <para>or<programlisting>FORMAT 3
-#ACTION                       SOURCE             DEST               PROTO            DPORT             SPORT               USER
-DROP:P                        2001:1.2.3::4      -
-DROP:PO                       -                  2001:1.2.3::4
-</programlisting></para>
-  </refsect1>
-
-  <refsect1>
-    <title>FILES</title>
-
-    <para>/etc/shorewall6/notrack</para>
-  </refsect1>
-
-  <refsect1>
-    <title>See ALSO</title>
-
-    <para><ulink
-    url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
-
-    <para>shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5),
-    shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-interfaces(5),
-    shorewall6-ipsec(5), shorewall6-netmap(5),shorewall6-params(5),
-    shorewall6-policy(5), shorewall6-providers(5), shorewall6-proxyarp(5),
-    shorewall6-rtrules(5), shorewall6-routestopped(5), shorewall6-rules(5),
-    shorewall6.conf(5), shorewall6-secmarks(5), shorewall6-tcclasses(5),
-    shorewall6-tcdevices(5), shorewall6-mangle(5), shorewall6-tos(5),
-    shorewall6-tunnels(5), shorewall-zones(5)</para>
-  </refsect1>
-</refentry>

Shorewall6/manpages/shorewall6-exclusion.xml

@@ -1,115 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
-"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
-<refentry>
-  <refmeta>
-    <refentrytitle>shorewall6-exclusion</refentrytitle>
-
-    <manvolnum>5</manvolnum>
-
-    <refmiscinfo>Configuration Files</refmiscinfo>
-  </refmeta>
-
-  <refnamediv>
-    <refname>exclusion</refname>
-
-    <refpurpose>Exclude a set of hosts from a definition in a shorewall6
-    configuration file.</refpurpose>
-  </refnamediv>
-
-  <refsynopsisdiv>
-    <cmdsynopsis>
-      <arg choice="plain"
-      rep="repeat"><option>!</option><replaceable>address-or-range</replaceable>[,<replaceable>address-or-range</replaceable>]</arg>
-    </cmdsynopsis>
-
-    <cmdsynopsis>
-      <arg choice="plain"
-      rep="repeat"><option>!</option><replaceable>zone-name</replaceable>[,<replaceable>zone-name</replaceable>]</arg>
-    </cmdsynopsis>
-  </refsynopsisdiv>
-
-  <refsect1>
-    <title>Description</title>
-
-    <para>Exclusion is used when you wish to exclude one or more addresses
-    from a definition. An exclamation point is followed by a comma-separated
-    list of addresses. The addresses may be single host addresses (e.g.,
-    fe80::2a0:ccff:fedb:31c4) or they may be network addresses in CIDR format
-    (e.g., fe80::2a0:ccff:fedb:31c4/64). If your kernel and ip6tables include
-    iprange support, you may also specify ranges of ip addresses of the form
-    <emphasis>lowaddress</emphasis>-<emphasis>highaddress</emphasis></para>
-
-    <para>No embedded white-space is allowed.</para>
-
-    <para>Exclusion can appear after a list of addresses and/or address
-    ranges. In that case, the final list of address is formed by taking the
-    first list and then removing the addresses defined in the
-    exclusion.</para>
-
-    <para>Beginning in Shorewall 4.4.13, the second form of exclusion is
-    allowed after <emphasis role="bold">all</emphasis> and <emphasis
-    role="bold">any</emphasis> in the SOURCE and DEST columns of
-    /etc/shorewall/rules. It allows you to omit arbitrary zones from the list
-    generated by those key words.</para>
-
-    <warning>
-      <para>If you omit a sub-zone and there is an explicit or explicit
-      CONTINUE policy, a connection to/from that zone can still be matched by
-      the rule generated for a parent zone.</para>
-
-      <para>For example:</para>
-
-      <blockquote>
-        <para>/etc/shorewall6/zones:</para>
-
-        <programlisting>#ZONE          TYPE
-z1             ip
-z2:z1          ip
-...</programlisting>
-
-        <para>/etc/shorewall6/policy:</para>
-
-        <programlisting>#SOURCE         DEST          POLICY
-z1              net           CONTINUE
-z2              net           REJECT</programlisting>
-
-        <para>/etc/shorewall6/rules:</para>
-
-        <programlisting>#ACTION         SOURCE        DEST        PROTO         DEST
-#                                                       PORT(S)
-ACCEPT          all!z2        net         tcp           22</programlisting>
-
-        <para>In this case, SSH connections from <emphasis
-        role="bold">z2</emphasis> to <emphasis role="bold">net</emphasis> will
-        be accepted by the generated <emphasis role="bold">z1</emphasis> to
-        net ACCEPT rule.</para>
-      </blockquote>
-    </warning>
-  </refsect1>
-
-  <refsect1>
-    <title>FILES</title>
-
-    <para>/etc/shorewall6/hosts</para>
-
-    <para>/etc/shorewall6/masq</para>
-
-    <para>/etc/shorewall6/rules</para>
-
-    <para>/etc/shorewall6/tcrules</para>
-  </refsect1>
-
-  <refsect1>
-    <title>See ALSO</title>
-
-    <para>shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5),
-    shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-interfaces(5),
-    shorewall6-maclist(5), shorewall6-netmap(5),shorewall6-params(5),
-    shorewall6-policy(5), shorewall6-providers(5), shorewall6-rtrules(5),
-    shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5),
-    shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5),
-    shorewall6-mangle(5), shorewall6-tos(5), shorewall6-tunnels(5),
-    shorewall-zones(5)</para>
-  </refsect1>
-</refentry>

Shorewall6/manpages/shorewall6-hosts.xml

@@ -1,210 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
-"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
-<refentry>
-  <refmeta>
-    <refentrytitle>shorewall6-hosts</refentrytitle>
-
-    <manvolnum>5</manvolnum>
-
-    <refmiscinfo>Configuration Files</refmiscinfo>
-  </refmeta>
-
-  <refnamediv>
-    <refname>hosts</refname>
-
-    <refpurpose>shorewall6 file</refpurpose>
-  </refnamediv>
-
-  <refsynopsisdiv>
-    <cmdsynopsis>
-      <command>/etc/shorewall6/hosts</command>
-    </cmdsynopsis>
-  </refsynopsisdiv>
-
-  <refsect1>
-    <title>Description</title>
-
-    <para>This file is used to define zones in terms of subnets and/or
-    individual IP addresses. Most simple setups don't need to (should not)
-    place anything in this file.</para>
-
-    <para>The order of entries in this file is not significant in determining
-    zone composition. Rather, the order that the zones are declared in <ulink
-    url="/manpages6/shorewall6-zones.html">shorewall6-zones</ulink>(5)
-    determines the order in which the records in this file are
-    interpreted.</para>
-
-    <warning>
-      <para>The only time that you need this file is when you have more than
-      one zone connected through a single interface.</para>
-    </warning>
-
-    <warning>
-      <para>If you have an entry for a zone and interface in <ulink
-      url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5)
-      then do not include any entries in this file for that same (zone,
-      interface) pair.</para>
-    </warning>
-
-    <para>The columns in the file are as follows (where the column name is
-    followed by a different name in parentheses, the different name is used in
-    the alternate specification syntax).</para>
-
-    <variablelist>
-      <varlistentry>
-        <term><emphasis role="bold">ZONE</emphasis> -
-        <emphasis>zone-name</emphasis></term>
-
-        <listitem>
-          <para>The name of a zone declared in <ulink
-          url="/manpages6/shorewall6-zones.html">shorewall6-zones</ulink>(5).
-          You may not list the firewall zone in this column.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">HOST(S)</emphasis> (hosts)-
-        <emphasis>interface</emphasis>:{<replaceable>address-or-range</replaceable>[,<replaceable>address-or-range</replaceable>]...|+<replaceable>ipset</replaceable>|<option>dynamic</option>}[<replaceable>exclusion</replaceable>]</term>
-
-        <listitem>
-          <para>The name of an interface defined in the <ulink
-          url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5)
-          file followed by a colon (":") and a comma-separated list whose
-          elements are either:</para>
-
-          <orderedlist numeration="loweralpha">
-            <listitem>
-              <para>The IPv6 <replaceable>address</replaceable> of a
-              host.</para>
-            </listitem>
-
-            <listitem>
-              <para>A network in CIDR format.</para>
-            </listitem>
-
-            <listitem>
-              <para>An IP address range of the form
-              [<emphasis>low.address</emphasis>]-[<emphasis>high.address</emphasis>].
-              Your kernel and ip6tables must have iprange match
-              support.</para>
-            </listitem>
-
-            <listitem>
-              <para>The name of an <emphasis>ipset</emphasis>.</para>
-            </listitem>
-
-            <listitem>
-              <para>The word <option>dynamic</option> which makes the zone
-              dynamic in that you can use the <command>shorewall add</command>
-              and <command>shorewall delete</command> commands to change to
-              composition of the zone. This capability was added in Shorewall
-              4.4.21.</para>
-            </listitem>
-          </orderedlist>
-
-          <blockquote>
-            <para>You may also exclude certain hosts through use of an
-            <emphasis>exclusion</emphasis> (see <ulink
-            url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5).</para>
-          </blockquote>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>OPTIONS - [<emphasis>option</emphasis>[<emphasis
-        role="bold">,</emphasis><emphasis>option</emphasis>]...]</term>
-
-        <listitem>
-          <para>An optional comma-separated list of options from the following
-          list. The order in which you list the options is not significant but
-          the list must have no embedded white-space.</para>
-
-          <variablelist>
-            <varlistentry>
-              <term><emphasis role="bold">blacklist</emphasis></term>
-
-              <listitem>
-                <para>Check packets arriving on this port against the <ulink
-                url="/manpages6/shorewall6-blacklist.html">shorewall6-blacklist</ulink>(5)
-                file.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">ipsec</emphasis></term>
-
-              <listitem>
-                <para>The zone is accessed via a kernel 2.6 ipsec SA. Note
-                that if the zone named in the ZONE column is specified as an
-                IPSEC zone in the <ulink
-                url="/manpages6/shorewall6-zones.html">shorewall6-zones</ulink>(5)
-                file then you do NOT need to specify the 'ipsec' option
-                here.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis
-              role="bold">mss</emphasis>=<replaceable>mss</replaceable></term>
-
-              <listitem>
-                <para>Added in Shorewall 4.5.2. When present, causes the TCP
-                mss for new connections to/from the hosts given in the HOST(S)
-                column to be clamped at the specified
-                <replaceable>mss</replaceable>.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">routeback</emphasis></term>
-
-              <listitem>
-                <para>shorewall6 should set up the infrastructure to pass
-                packets from this/these address(es) back to themselves. This
-                is necessary if hosts in this group use the services of a
-                transparent proxy that is a member of the group or if DNAT is
-                used to send requests originating from this group to a server
-                in the group.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">tcpflags</emphasis></term>
-
-              <listitem>
-                <para>Packets arriving from these hosts are checked for
-                certain illegal combinations of TCP flags. Packets found to
-                have such a combination of flags are handled according to the
-                setting of TCP_FLAGS_DISPOSITION after having been logged
-                according to the setting of TCP_FLAGS_LOG_LEVEL.</para>
-              </listitem>
-            </varlistentry>
-          </variablelist>
-        </listitem>
-      </varlistentry>
-    </variablelist>
-  </refsect1>
-
-  <refsect1>
-    <title>FILES</title>
-
-    <para>/etc/shorewall6/hosts</para>
-  </refsect1>
-
-  <refsect1>
-    <title>See ALSO</title>
-
-    <para><ulink
-    url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
-
-    <para>shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5),
-    shorewall6-blacklist(5), shorewall6-interfaces(5), shorewall6-maclist(5),
-    shorewall6-netmap(5),shorewall6-params(5), shorewall6-policy(5),
-    shorewall6-providers(5), shorewall6-rtrules(5),
-    shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5),
-    shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5),
-    shorewall6-mangle(5), shorewall6-tos(5), shorewall6-tunnels(5),
-    shorewall-zones(5)</para>
-  </refsect1>
-</refentry>

Shorewall6/manpages/shorewall6-interfaces.xml

@@ -1,733 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
-"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
-<refentry>
-  <refmeta>
-    <refentrytitle>shorewall6-interfaces</refentrytitle>
-
-    <manvolnum>5</manvolnum>
-
-    <refmiscinfo>Configuration Files</refmiscinfo>
-  </refmeta>
-
-  <refnamediv>
-    <refname>interfaces</refname>
-
-    <refpurpose>shorewall6 interfaces file</refpurpose>
-  </refnamediv>
-
-  <refsynopsisdiv>
-    <cmdsynopsis>
-      <command>/etc/shorewall6/interfaces</command>
-    </cmdsynopsis>
-  </refsynopsisdiv>
-
-  <refsect1>
-    <title>Description</title>
-
-    <para>The interfaces file serves to define the firewall's network
-    interfaces to shorewall6. The order of entries in this file is not
-    significant in determining zone composition.</para>
-
-    <para>Beginning with Shorewall 4.5.3, the interfaces file supports two
-    different formats:</para>
-
-    <variablelist>
-      <varlistentry>
-        <term>FORMAT 1 (default - deprecated)</term>
-
-        <listitem>
-          <para>There is a ANYCAST column which provides compatibility with
-          older versions of Shorewall..</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>FORMAT 2</term>
-
-        <listitem>
-          <para>The BROADCAST column is omitted.</para>
-        </listitem>
-      </varlistentry>
-    </variablelist>
-
-    <para>The format is specified by a line as follows:</para>
-
-    <blockquote>
-      <para><emphasis role="bold">?FORMAT {1|2}</emphasis></para>
-    </blockquote>
-
-    <para>The columns in the file are as follows.</para>
-
-    <variablelist>
-      <varlistentry>
-        <term><emphasis role="bold">ZONE</emphasis> -
-        <emphasis>zone-name</emphasis></term>
-
-        <listitem>
-          <para>Zone for this interface. Must match the name of a zone
-          declared in /etc/shorewall6/zones. You may not list the firewall
-          zone in this column.</para>
-
-          <para>If the interface serves multiple zones that will be defined in
-          the <ulink
-          url="/manpages6/shorewall6-hosts.html">shorewall6-hosts</ulink>(5)
-          file, you should place "-" in this column.</para>
-
-          <para>If there are multiple interfaces to the same zone, you must
-          list them in separate entries.</para>
-
-          <para>Example:</para>
-
-          <blockquote>
-            <programlisting>#ZONE   INTERFACE       BROADCAST
-loc     eth1            -
-loc     eth2            -</programlisting>
-          </blockquote>
-
-          <para>Beginning with Shorewall 4.5.17, if you specify a zone for the
-          'lo' interface, then that zone must be defined as type
-          <option>local</option> in <ulink
-          url="/manpages6/shorewall6-zones.html">shorewall6-zones</ulink>(5).</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">INTERFACE</emphasis> -
-        <emphasis>interface</emphasis><emphasis
-        role="bold">[:</emphasis><emphasis>port</emphasis><emphasis
-        role="bold">]</emphasis></term>
-
-        <listitem>
-          <para>Logical name of interface. Each interface may be listed only
-          once in this file. You may NOT specify the name of a "virtual"
-          interface (e.g., eth0:0) here; see <ulink
-          url="/FAQ.htm#faq18">http://www.shorewall.net/FAQ.htm#faq18</ulink>.
-          If the <option>physical</option> option is not specified, then the
-          logical name is also the name of the actual interface.</para>
-
-          <para>You may use wildcards here by specifying a prefix followed by
-          the plus sign ("+"). For example, if you want to make an entry that
-          applies to all PPP interfaces, use 'ppp+'; that would match ppp0,
-          ppp1, ppp2, …Please note that the '+' means '<emphasis
-          role="bold">one</emphasis> or more additional characters' so 'ppp'
-          does not match 'ppp+'.</para>
-
-          <para>Care must be exercised when using wildcards where there is
-          another zone that uses a matching specific interface. See <ulink
-          url="/manpages6/shorewall6-nesting.html">shorewall6-nesting</ulink>(5)
-          for a discussion of this problem.</para>
-
-          <para>Shorewall6 allows '+' as an interface name.</para>
-
-          <para>There is no need to define the loopback interface (lo) in this
-          file.</para>
-
-          <para>If a <replaceable>port</replaceable> is given, then the
-          <replaceable>interface</replaceable> must have been defined
-          previously with the <option>bridge</option> option. The OPTIONS
-          column must be empty when a <replaceable>port</replaceable> is
-          given.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">ANYCAST</emphasis> - <emphasis
-        role="bold">-</emphasis></term>
-
-        <listitem>
-          <para>Enter '<emphasis role="bold">-'</emphasis> in this column. It
-          is here for compatibility between Shorewall6 and Shorewall and is
-          omitted if FORMAT is 2.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">OPTIONS</emphasis> (Optional) -
-        [<emphasis>option</emphasis>[<emphasis
-        role="bold">,</emphasis><emphasis>option</emphasis>]...]</term>
-
-        <listitem>
-          <para>A comma-separated list of options from the following list. The
-          order in which you list the options is not significant but the list
-          should have no embedded white-space.</para>
-
-          <variablelist>
-            <varlistentry>
-              <term><emphasis
-              role="bold">accept_ra</emphasis>[={0|1|2}]</term>
-
-              <listitem>
-                <para>Added in Shorewall 4.5.16. Values are:</para>
-
-                <variablelist>
-                  <varlistentry>
-                    <term>0</term>
-
-                    <listitem>
-                      <para>Do not accept Router Advertisements.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term>1</term>
-
-                    <listitem>
-                      <para>Accept Route Advertisements if forwarding is
-                      disabled.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term>2</term>
-
-                    <listitem>
-                      <para>Overrule forwarding behavior. Accept Route
-                      Advertisements even if forwarding is enabled.</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-
-                <para>If the option is specified without a value, then the
-                value 1 is assumed.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">blacklist</emphasis></term>
-
-              <listitem>
-                <para>Check packets arriving on this interface against the
-                <ulink
-                url="/manpages6/shorewall6-blacklist.html">shorewall6-blacklist</ulink>(5)
-                file.</para>
-
-                <para>Beginning with Shorewall 4.4.13:</para>
-
-                <itemizedlist>
-                  <listitem>
-                    <para>If a <replaceable>zone</replaceable> is given in the
-                    ZONES column, then the behavior is as if <emphasis
-                    role="bold">blacklist</emphasis> had been specified in the
-                    IN_OPTIONS column of <ulink
-                    url="/manpages6/shorewall6-zones.html">shorewall6-zones</ulink>(5).</para>
-                  </listitem>
-
-                  <listitem>
-                    <para>Otherwise, the option is ignored with a
-                    warning:</para>
-
-                    <blockquote>
-                      <para><emphasis role="bold">WARNING: The 'blacklist'
-                      option is ignored on multi-zone
-                      interfaces</emphasis></para>
-                    </blockquote>
-                  </listitem>
-                </itemizedlist>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">bridge</emphasis></term>
-
-              <listitem>
-                <para>Designates the interface as a bridge. Beginning with
-                Shorewall 4.4.7, setting this option also sets
-                <option>routeback</option>.</para>
-
-                <note>
-                  <para>If you have a bridge that you don't intend to define
-                  bport zones on, then it is best to omit this option and
-                  simply specify <option>routeback</option>.</para>
-                </note>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis
-              role="bold">dbl={none|src|dst|src-dst}</emphasis></term>
-
-              <listitem>
-                <para>Added in Shorewall 5.0.10. This option defined whether
-                or not dynamic blacklisting is applied to packets entering the
-                firewall through this interface and whether the source address
-                and/or destination address is to be compared against the
-                ipset-based dynamic blacklist (DYNAMIC_BLACKLIST=ipset... in
-                <ulink
-                url="manpages6/shorewall6.conf.html">shorewall6.conf(5)</ulink>).
-                The default is determine by the setting of
-                DYNAMIC_BLACKLIST:</para>
-
-                <variablelist>
-                  <varlistentry>
-                    <term>DYNAMIC_BLACKLIST=No</term>
-
-                    <listitem>
-                      <para>Default is <emphasis role="bold">none</emphasis>
-                      (e.g., no dynamic blacklist checking).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term>DYNAMIC_BLACKLIST=Yes</term>
-
-                    <listitem>
-                      <para>Default is <emphasis role="bold">src</emphasis>
-                      (e.g., the source IP address is checked against the
-                      ipset).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term>DYNAMIC_BLACKLIST=ipset[-only]</term>
-
-                    <listitem>
-                      <para>Default is <emphasis
-                      role="bold">src</emphasis>.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term>DYNAMIC_BLACKLIST=ipset[-only],src-dst...</term>
-
-                    <listitem>
-                      <para>Default is <emphasis
-                      role="bold">src-dst</emphasis> (e.g., the source IP
-                      addresses in checked against the ipset on input and the
-                      destination IP address is checked against the ipset on
-                      packets originating from the firewall and leaving
-                      through this interface).</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">destonly</emphasis></term>
-
-              <listitem>
-                <para>Added in Shorewall 4.5.17. Causes the compiler to omit
-                rules to handle traffic from this interface.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">dhcp</emphasis></term>
-
-              <listitem>
-                <para>Specify this option when any of the following are
-                true:</para>
-
-                <orderedlist spacing="compact">
-                  <listitem>
-                    <para>the interface gets its IP address via DHCP</para>
-                  </listitem>
-
-                  <listitem>
-                    <para>the interface is used by a DHCP server running on
-                    the firewall</para>
-                  </listitem>
-
-                  <listitem>
-                    <para>the interface has a static IP but is on a LAN
-                    segment with lots of DHCP clients.</para>
-                  </listitem>
-
-                  <listitem>
-                    <para>the interface is a <ulink
-                    url="/SimpleBridge.html">simple bridge</ulink> with a DHCP
-                    server on one port and DHCP clients on another
-                    port.</para>
-
-                    <note>
-                      <para>If you use <ulink
-                      url="/bridge-Shorewall-perl.html">Shorewall-perl for
-                      firewall/bridging</ulink>, then you need to include
-                      DHCP-specific rules in <ulink
-                      url="/manpages/shorewall-rules.html">shorewall-rules</ulink>(8).
-                      DHCP uses UDP ports 546 and 547.</para>
-                    </note>
-                  </listitem>
-                </orderedlist>
-
-                <para>This option allows DHCP datagrams to enter and leave the
-                interface.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">forward</emphasis>[={0|1}]</term>
-
-              <listitem>
-                <para>Sets the /proc/sys/net/ipv6/conf/interface/forwarding
-                option to the specified value. If no value is supplied, then 1
-                is assumed.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">ignore[=1]</emphasis></term>
-
-              <listitem>
-                <para>When specified, causes the generated script to ignore
-                up/down events from Shorewall-init for this device.
-                Additionally, the option exempts the interface from hairpin
-                filtering. When '=1' is omitted, the ZONE column must contain
-                '-' and <option>ignore</option> must be the only
-                OPTION.</para>
-
-                <para>Beginning with Shorewall 4.5.5, may be specified as
-                '<option>ignore=1</option>' which only causes the generated
-                script to ignore up/down events from Shorewall-init; hairpin
-                filtering is still applied. In this case, the above
-                restrictions on the ZONE and OPTIONS columns are
-                lifted.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">loopback</emphasis></term>
-
-              <listitem>
-                <para>Added in Shorewall 4.6.6. Designates the interface as
-                the loopback interface. This option is assumed if the
-                interface's physical name is 'lo'. Only one interface man have
-                the <option>loopback</option> option specified.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis
-              role="bold">mss</emphasis>=<emphasis>number</emphasis></term>
-
-              <listitem>
-                <para>Causes forwarded TCP SYN packets entering or leaving on
-                this interface to have their MSS field set to the specified
-                <replaceable>number</replaceable>.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis
-              role="bold">nets=(<emphasis>net</emphasis>[,...])</emphasis></term>
-
-              <listitem>
-                <para>Limit the zone named in the ZONE column to only the
-                listed networks. If you specify this option, be sure to
-                include the link-local network (ff80::/10).</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">nets=dynamic</emphasis></term>
-
-              <listitem>
-                <para>Added in Shorewall 4.4.21. Defines the zone as
-                <firstterm>dynamic</firstterm>. Requires ipset match support
-                in your iptables and kernel. See <ulink
-                url="/Dynamic.html">http://www.shorewall.net/Dynamic.html</ulink>
-                for further information.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">nodbl</emphasis></term>
-
-              <listitem>
-                <para>Added in Shorewall 5.0.8. When specified, dynamic
-                blacklisting is disabled on the interface. Beginning with
-                Shorewall 5.0.10, <emphasis role="bold">nodbl</emphasis> is
-                equivalent to <emphasis
-                role="bold">dbl=none</emphasis>.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">optional</emphasis></term>
-
-              <listitem>
-                <para>When <option>optional</option> is specified for an
-                interface, shorewall6 will be silent when:</para>
-
-                <itemizedlist>
-                  <listitem>
-                    <para>a <filename
-                    class="directory">/proc/sys/net/ipv6/conf/</filename>
-                    entry for the interface cannot be modified.</para>
-                  </listitem>
-
-                  <listitem>
-                    <para>The first global IPv6 address of the interface
-                    cannot be obtained.</para>
-                  </listitem>
-                </itemizedlist>
-
-                <para>This option may not be specified together with <emphasis
-                role="bold">required</emphasis>.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">physical</emphasis>=<emphasis
-              role="bold"><emphasis>name</emphasis></emphasis></term>
-
-              <listitem>
-                <para>Added in Shorewall 4.4.4. When specified, the interface
-                or port name in the INTERFACE column is a logical name that
-                refers to the name given in this option. It is useful when you
-                want to specify the same wildcard port name on two or more
-                bridges. See <ulink
-                url="/bridge-Shorewall-perl.html#Multiple">http://www.shorewall.net/bridge-Shorewall-perl.html#Multiple</ulink>.</para>
-
-                <para>If the <emphasis>interface</emphasis> name is a wildcard
-                name (ends with '+'), then the physical
-                <emphasis>name</emphasis> must also end in '+'.</para>
-
-                <para>If <option>physical</option> is not specified, then it's
-                value defaults to the <emphasis>interface</emphasis>
-                name.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">required</emphasis></term>
-
-              <listitem>
-                <para>Added in Shorewall 4.4.10. When specified, the firewall
-                will fail to start if the interface named in the INTERFACE
-                column is not usable. May not be specified together with
-                <emphasis role="bold">optional</emphasis>.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">routeback[={0|1}]</emphasis></term>
-
-              <listitem>
-                <para>If specified, indicates that shorewall6 should include
-                rules that allow traffic arriving on this interface to be
-                routed back out that same interface. This option is also
-                required when you have used a wildcard in the INTERFACE column
-                if you want to allow traffic between the interfaces that match
-                the wildcard.</para>
-
-                <para>If you specify this option, then you should also specify
-                <option>rpfilter</option> (see below) if you are running
-                Shorewall 4.5.7 or later; otherwise, you should specify
-                <option>sfilter</option> (see below).</para>
-
-                <para>Beginning with Shorewall 4.5.18, you may specify this
-                option to explicitly reset (e.g., <emphasis
-                role="bold">routeback=0</emphasis>). This can be used to
-                override Shorewall's default setting for bridge devices which
-                is <emphasis role="bold">routeback=1</emphasis>.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">rpfilter</emphasis></term>
-
-              <listitem>
-                <para>Added in Shorewall 4.5.7. This is an anti-spoofing
-                measure that requires the 'RPFilter Match' capability in your
-                iptables and kernel. It provides a more efficient alternative
-                to the <option>sfilter</option> option below.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis
-              role="bold">sourceroute[={0|1}]</emphasis></term>
-
-              <listitem>
-                <para>If this option is not specified for an interface, then
-                source-routed packets will not be accepted from that interface
-                unless explicitly enabled via sysconf. Only set this option to
-                1 (enable source routing) if you know what you are doing. This
-                might represent a security risk and is not usually
-                needed.</para>
-
-                <para>Only those interfaces with the
-                <option>sourceroute</option> option will have their setting
-                changed; the value assigned to the setting will be the value
-                specified (if any) or 1 if no value is given.</para>
-
-                <note>
-                  <para>This option does not work with a wild-card
-                  <replaceable>interface</replaceable> name (e.g., eth0.+) in
-                  the INTERFACE column.</para>
-                </note>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis
-              role="bold">sfilter=(<emphasis>net</emphasis>[,...])</emphasis></term>
-
-              <listitem>
-                <para>Added in Shorewall 4.4.20. At this writing (spring
-                2011), Linux does not support reverse path filtering (RFC3704)
-                for IPv6. In its absence, <option>sfilter</option> may be used
-                as an anti-spoofing measure.</para>
-
-                <para>This option should be used on bridges or other
-                interfaces with the <option>routeback</option> option. On
-                these interfaces, <option>sfilter</option> should list those
-                local networks that are connected to the firewall through
-                other interfaces.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">tcpflags[={0|1}]</emphasis></term>
-
-              <listitem>
-                <para>Packets arriving on this interface are checked for
-                certain illegal combinations of TCP flags. Packets found to
-                have such a combination of flags are handled according to the
-                setting of TCP_FLAGS_DISPOSITION after having been logged
-                according to the setting of TCP_FLAGS_LOG_LEVEL.</para>
-
-                <para>Beginning with Shorewall 4.6.0, tcpflags=1 is the
-                default. To disable this option, specify tcpflags=0.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">proxyndp</emphasis>[={0|1}]</term>
-
-              <listitem>
-                <para>Sets
-                /proc/sys/net/ipv6/conf/<emphasis>interface</emphasis>/proxy_ndp.</para>
-
-                <para><emphasis role="bold">Note</emphasis>: This option does
-                not work with a wild-card <replaceable>interface</replaceable>
-                name (e.g., eth0.+) in the INTERFACE column.</para>
-
-                <para>Only those interfaces with the <option>proxyndp</option>
-                option will have their setting changed; the value assigned to
-                the setting will be the value specified (if any) or 1 if no
-                value is given.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">unmanaged</emphasis></term>
-
-              <listitem>
-                <para>Added in Shorewall 4.5.18. Causes all traffic between
-                the firewall and hosts on the interface to be accepted. When
-                this option is given:</para>
-
-                <itemizedlist>
-                  <listitem>
-                    <para>The ZONE column must contain '-'.</para>
-                  </listitem>
-
-                  <listitem>
-                    <para>Only the following other options are allowed with
-                    <emphasis role="bold">unmanaged</emphasis>:</para>
-
-                    <simplelist>
-                      <member><emphasis
-                      role="bold">accept_ra</emphasis></member>
-
-                      <member><emphasis
-                      role="bold">forward</emphasis></member>
-
-                      <member><emphasis role="bold">ignore</emphasis></member>
-
-                      <member><emphasis
-                      role="bold">optional</emphasis></member>
-
-                      <member><emphasis
-                      role="bold">physical</emphasis></member>
-
-                      <member><emphasis
-                      role="bold">sourceroute</emphasis></member>
-
-                      <member><emphasis
-                      role="bold">proxyndp</emphasis></member>
-                    </simplelist>
-                  </listitem>
-                </itemizedlist>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis
-              role="bold">wait</emphasis>=<emphasis>seconds</emphasis></term>
-
-              <listitem>
-                <para>Added in Shorewall 4.4.10. Causes the generated script
-                to wait up to <emphasis>seconds</emphasis> seconds for the
-                interface to become usable before applying the <emphasis
-                role="bold">required</emphasis> or <emphasis
-                role="bold">optional</emphasis> options.</para>
-              </listitem>
-            </varlistentry>
-          </variablelist>
-        </listitem>
-      </varlistentry>
-    </variablelist>
-  </refsect1>
-
-  <refsect1>
-    <title>Example</title>
-
-    <variablelist>
-      <varlistentry>
-        <term>Example 1:</term>
-
-        <listitem>
-          <para>Suppose you have eth0 connected to a DSL modem and eth1
-          connected to your local network You have a DMZ using eth2.</para>
-
-          <para>Your entries for this setup would look like:</para>
-
-          <programlisting>FORMAT 2
-#ZONE   INTERFACE OPTIONS
-net     eth0      -
-loc     eth1      -
-dmz     eth2      -</programlisting>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>Example 4 (Shorewall 4.4.9 and later):</term>
-
-        <listitem>
-          <para>You have a bridge with no IP address and you want to allow
-          traffic through the bridge.</para>
-
-          <programlisting>FORMAT 2
-#ZONE   INTERFACE        OPTIONS
--       br0              bridge</programlisting>
-        </listitem>
-      </varlistentry>
-    </variablelist>
-  </refsect1>
-
-  <refsect1>
-    <title>FILES</title>
-
-    <para>/etc/shorewall6/interfaces</para>
-  </refsect1>
-
-  <refsect1>
-    <title>See ALSO</title>
-
-    <para><ulink
-    url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
-
-    <para>shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5),
-    shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-maclist(5),
-    shorewall6-netmap(5),shorewall6-params(5), shorewall6-policy(5),
-    shorewall6-providers(5), shorewall6-rtrules(5),
-    shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5),
-    shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5),
-    shorewall6-mangle(5), shorewall6-tos(5), shorewall6-tunnels(5),
-    shorewall6-zones(5)</para>
-  </refsect1>
-</refentry>

Shorewall6/manpages/shorewall6-ipsets.xml

@@ -1,274 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
-"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
-<refentry>
-  <refmeta>
-    <refentrytitle>shorewall-ipsets</refentrytitle>
-
-    <manvolnum>5</manvolnum>
-
-    <refmiscinfo>Configuration Files</refmiscinfo>
-  </refmeta>
-
-  <refnamediv>
-    <refname>ipsets</refname>
-
-    <refpurpose>Specifying the name if an ipset in Shorewall6 configuration
-    files</refpurpose>
-  </refnamediv>
-
-  <refsynopsisdiv>
-    <cmdsynopsis>
-      <command>+<replaceable>ipsetname</replaceable></command>
-    </cmdsynopsis>
-
-    <cmdsynopsis>
-      <command>+<replaceable>ipsetname</replaceable>[<replaceable>flag</replaceable>,...]</command>
-    </cmdsynopsis>
-
-    <cmdsynopsis>
-      <command>+[ipsetname,...]</command>
-    </cmdsynopsis>
-  </refsynopsisdiv>
-
-  <refsect1>
-    <title>Description</title>
-
-    <para>Note: In the above syntax descriptions, the square brackets ("[]")
-    are to be taken literally rather than as meta-characters.</para>
-
-    <para>In most places where a network address may be entered, an ipset may
-    be substituted. Set names must be prefixed by the character "+", must
-    start with a letter and may be composed of alphanumeric characters, "-"
-    and "_".</para>
-
-    <para>Whether the set is matched against the packet source or destination
-    is determined by which column the set name appears (SOURCE or DEST). For
-    those set types that specify a tuple, two alternative syntaxes are
-    available:</para>
-
-    <simplelist>
-      <member>[<replaceable>number</replaceable>] - Indicates that 'src' or
-      'dst' should repeated number times. Example: myset[2].</member>
-
-      <member>[<replaceable>flag</replaceable>,...] where
-      <replaceable>flag</replaceable> is <option>src</option> or
-      <option>dst</option>. Example: myset[src,dst].</member>
-    </simplelist>
-
-    <para>In a SOURCE or SPORT column, the following pairs are
-    equivalent:</para>
-
-    <itemizedlist>
-      <listitem>
-        <para>+myset[2] and +myset[src,src]</para>
-      </listitem>
-    </itemizedlist>
-
-    <para>In a DEST or DPORT column, the following pairs are
-    equivalent:</para>
-
-    <itemizedlist>
-      <listitem>
-        <para>+myset[2] and +myset[dst,dst]</para>
-      </listitem>
-    </itemizedlist>
-
-    <para>Beginning with Shorewall 4.4.14, multiple source or destination
-    matches may be specified by enclosing the set names within +[...]. The set
-    names need not be prefixed with '+'. When such a list of sets is
-    specified, matching packets must match all of the listed sets.</para>
-
-    <para>For information about set lists and exclusion, see <ulink
-    url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>
-    (5).</para>
-
-    <para>Beginning with Shorewall 4.5.16, you can increment one or more
-    nfacct objects each time a packet matches an ipset. You do that by listing
-    the objects separated by commas within parentheses.</para>
-
-    <para>Example:</para>
-
-    <simplelist>
-      <member>+myset[src](myobject)</member>
-    </simplelist>
-
-    <para>In that example, when the source address of a packet matches the
-    <emphasis role="bold">myset</emphasis> ipset, the <emphasis
-    role="bold">myobject</emphasis> nfacct counter will be incremented.</para>
-
-    <para>Beginning with Shorewall 4.6.0, an ipset name (and src/dst list, if
-    any) can be immediately be followed by a list of match options.</para>
-
-    <important>
-      <para>These additional match options are not available in <ulink
-      url="shorewall6-tcfilters.html">shorewall6-tcfilters(5)</ulink>.</para>
-    </important>
-
-    <para>Available options are:</para>
-
-    <variablelist>
-      <varlistentry>
-        <term>nomatch</term>
-
-        <listitem>
-          <para>If the set type supports the nomatch flag, then the matching
-          is reversed: a match with an element flagged with nomatch returns
-          true, while a match with a plain element returns false. This option
-          requires the 'Ipset Match nomatch' capability in your kernel and
-          ip[6]tables.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>no-update-counters</term>
-
-        <listitem>
-          <para>The packet and byte counters of the matching element in the
-          set won't be updated. By default, the packet and byte counters are
-          updated. This option and those that follow require the 'Ipset Match
-          counters' capability in your kernel and ip[6]tables.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>no-update-subcounters</term>
-
-        <listitem>
-          <para>The packet and byte counters of the matching element in the
-          member set of a list type of set won't be updated. Default the
-          packet and byte counters are updated.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>packets=<replaceable>value</replaceable></term>
-
-        <listitem>
-          <para>If the packet is matched an element in the set, match only if
-          the packet counter of the element matches the given
-          <replaceable>value</replaceable> also.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>packets&lt;<replaceable>value</replaceable></term>
-
-        <listitem>
-          <para>If the packet is matched an element in the set, match only if
-          the packet counter of the element is less than the given
-          <replaceable>value</replaceable> as well.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>packets&gt;<replaceable>value</replaceable></term>
-
-        <listitem>
-          <para>If the packet is matched an element in the set, match only if
-          the packet counter of the element is greater than the given
-          <replaceable>value</replaceable> as well.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>packets!=<replaceable>value</replaceable></term>
-
-        <listitem>
-          <para>If the packet is matched an element in the set, match only if
-          the packet counter of the element does not match the given
-          <replaceable>value</replaceable> also.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>bytes=<replaceable>value</replaceable></term>
-
-        <listitem>
-          <para>If the packet is matched an element in the set, match only if
-          the byte counter of the element matches the given
-          <replaceable>value</replaceable> also.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>bytes&lt;<replaceable>value</replaceable></term>
-
-        <listitem>
-          <para>If the packet is matched an element in the set, match only if
-          the byte counter of the element is less than the given
-          <replaceable>value</replaceable> as well.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>bytes&gt;<replaceable>value</replaceable></term>
-
-        <listitem>
-          <para>If the packet is matched an element in the set, match only if
-          the byte counter of the element is greater than the given
-          <replaceable>value</replaceable> as well.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>bytes&lt;&gt;<replaceable>value</replaceable></term>
-
-        <listitem>
-          <para>If the packet is matched an element in the set, match only if
-          the byte counter of the element does not match the given
-          <replaceable>value</replaceable> also.</para>
-        </listitem>
-      </varlistentry>
-    </variablelist>
-  </refsect1>
-
-  <refsect1>
-    <title>Examples</title>
-
-    <para>+myset</para>
-
-    <para>+myset[src]</para>
-
-    <para>+myset[2]</para>
-
-    <para>+[myset1,myset2[dst]]</para>
-
-    <para>+myset[src,nomatch,packets&gt;100]</para>
-
-    <para>+myset[nomatch,no-update-counters](myObject)</para>
-  </refsect1>
-
-  <refsect1>
-    <title>FILES</title>
-
-    <para>/etc/shorewall6/accounting</para>
-
-    <para>/etc/shorewall6/blrules</para>
-
-    <para>/etc/shorewall6/hosts -- <emphasis role="bold">Note:</emphasis>
-    Multiple matches enclosed in +[...] may not be used in this file.</para>
-
-    <para>/etc/shorewall6/maclist -- <emphasis role="bold">Note:</emphasis>
-    Multiple matches enclosed in +[...] may not be used in this file.</para>
-
-    <para>/etc/shorewall6/rules</para>
-
-    <para>/etc/shorewall6/secmarks</para>
-
-    <para>/etc/shorewall6/mangle</para>
-  </refsect1>
-
-  <refsect1>
-    <title>See ALSO</title>
-
-    <para>shorewall6(8), shorewall6-actions(5), shorewall6-blacklist(5),
-    shorewall6-hosts(5), shorewall6-interfaces(5), shorewall6-maclist(5),
-    shorewall6-netmap(5),shorewall6-params(5), shorewall6-policy(5),
-    shorewall6-providers(5), shorewall6-rtrules(5),
-    shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5),
-    shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5),
-    shorewall6-mangle(5), shorewall6-tos(5), shorewall6-tunnels(5),
-    shorewall6-zones(5)</para>
-  </refsect1>
-</refentry>

Shorewall6/manpages/shorewall6-maclist.xml

@@ -1,119 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
-"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
-<refentry>
-  <refmeta>
-    <refentrytitle>shorewall6-maclist</refentrytitle>
-
-    <manvolnum>5</manvolnum>
-
-    <refmiscinfo>Configuration Files</refmiscinfo>
-  </refmeta>
-
-  <refnamediv>
-    <refname>maclist</refname>
-
-    <refpurpose>shorewall6 MAC Verification file</refpurpose>
-  </refnamediv>
-
-  <refsynopsisdiv>
-    <cmdsynopsis>
-      <command>/etc/shorewall6/maclist</command>
-    </cmdsynopsis>
-  </refsynopsisdiv>
-
-  <refsect1>
-    <title>Description</title>
-
-    <para>This file is used to define the MAC addresses and optionally their
-    associated IPv6 addresses to be allowed to use the specified interface.
-    The feature is enabled by using the <emphasis
-    role="bold">maclist</emphasis> option in the <ulink
-    url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5)
-    or <ulink
-    url="/manpages6/shorewall6-hosts.html">shorewall6-hosts</ulink>(5)
-    configuration file.</para>
-
-    <para>The columns in the file are as follows.</para>
-
-    <variablelist>
-      <varlistentry>
-        <term><emphasis role="bold">DISPOSITION</emphasis> - {<emphasis
-        role="bold">ACCEPT</emphasis>|<emphasis
-        role="bold">DROP</emphasis>|<emphasis
-        role="bold">REJECT</emphasis>}[<option>:</option><replaceable>log-level</replaceable>]</term>
-
-        <listitem>
-          <para><emphasis role="bold">ACCEPT</emphasis> or <emphasis
-          role="bold">DROP</emphasis> (if MACLIST_TABLE=filter in <ulink
-          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5),
-          then REJECT is also allowed). If specified, the
-          <replaceable>log-level</replaceable> causes packets matching the
-          rule to be logged at that level.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">INTERFACE</emphasis> -
-        <emphasis>interface</emphasis></term>
-
-        <listitem>
-          <para>Network <emphasis>interface</emphasis> to a host.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">MAC</emphasis> -
-        <emphasis>address</emphasis></term>
-
-        <listitem>
-          <para>MAC <emphasis>address</emphasis> of the host -- you do not
-          need to use the shorewall6 format for MAC addresses here. If
-          <emphasis role="bold">IP ADDRESSES</emphasis> is supplied then
-          <emphasis role="bold">MAC</emphasis> can be supplied as a dash
-          (<emphasis role="bold">-</emphasis>)</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">IP ADDRESSES</emphasis> (Optional) -
-        [<emphasis>address</emphasis>[<emphasis
-        role="bold">,</emphasis><emphasis>address</emphasis>]...]</term>
-
-        <listitem>
-          <para>If specified, both the MAC and IP address must match. This
-          column can contain a comma-separated list of host and/or subnet
-          addresses. If your kernel and ip6tables have iprange match support
-          then IP address ranges are also allowed. Similarly, if your kernel
-          and ip6tables include ipset support than set names (prefixed by "+")
-          are also allowed.</para>
-        </listitem>
-      </varlistentry>
-    </variablelist>
-  </refsect1>
-
-  <refsect1>
-    <title>FILES</title>
-
-    <para>/etc/shorewall6/maclist</para>
-  </refsect1>
-
-  <refsect1>
-    <title>See ALSO</title>
-
-    <para><ulink
-    url="/MAC_Validation.html">http://www.shorewall.net/MAC_Validation.html</ulink></para>
-
-    <para><ulink
-    url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para>
-
-    <para>shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5),
-    shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-interfaces(5),
-    shorewall6-netmap(5),shorewall6-params(5), shorewall6-policy(5),
-    shorewall6-providers(5), shorewall6-rtrules(5),
-    shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5),
-    shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5),
-    shorewall6-mangle(5), shorewall6-tos(5), shorewall6-tunnels(5),
-    shorewall6-zones(5)</para>
-  </refsect1>
-</refentry>

Shorewall6/manpages/shorewall6-masq.xml

@@ -1,577 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
-"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
-<refentry>
-  <refmeta>
-    <refentrytitle>shorewall6-masq</refentrytitle>
-
-    <manvolnum>5</manvolnum>
-
-    <refmiscinfo>Configuration Files</refmiscinfo>
-  </refmeta>
-
-  <refnamediv>
-    <refname>masq</refname>
-
-    <refpurpose>Shorewall6 Masquerade/SNAT definition file</refpurpose>
-  </refnamediv>
-
-  <refsynopsisdiv>
-    <cmdsynopsis>
-      <command>/etc/shorewall6/masq</command>
-    </cmdsynopsis>
-  </refsynopsisdiv>
-
-  <refsect1>
-    <title>Description</title>
-
-    <para>Use this file to define Source NAT (SNAT). Requires Shorewall 4.5.14
-    or later.</para>
-
-    <warning>
-      <para>The entries in this file are order-sensitive. The first entry that
-      matches a particular connection will be the one that is used.</para>
-    </warning>
-
-    <warning>
-      <para>If you have more than one ISP link, adding entries to this file
-      will <emphasis role="bold">not</emphasis> force connections to go out
-      through a particular link. You must use entries in <ulink
-      url="/manpages6/shorewall6-rtrules.html">shorewall6-rtrules</ulink>(5)
-      or PREROUTING entries in <ulink
-      url="/manpages6/shorewall6-tcrules.html">shorewall-tcrules</ulink>(5) to
-      do that.</para>
-    </warning>
-
-    <para>The columns in the file are as follows.</para>
-
-    <variablelist>
-      <varlistentry>
-        <term><emphasis role="bold">INTERFACE:DEST</emphasis> - {[<emphasis
-        role="bold">+</emphasis>]<emphasis>interfacelist</emphasis>|[<emphasis
-        role="bold">:</emphasis>[<emphasis>dest-address</emphasis>[<emphasis
-        role="bold">,</emphasis><emphasis>dest-address</emphasis>]...[<emphasis>exclusion</emphasis>]]|?COMMENT}</term>
-
-        <listitem>
-          <para>Outgoing <emphasis>interfacelist</emphasis>. This may be a
-          comma-separated list of interface names. This is usually your
-          internet interface.</para>
-
-          <para>Each interface must match an entry in <ulink
-          url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5).
-          Shorewall allows loose matches to wildcard entries in <ulink
-          url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5).
-          For example, <filename class="devicefile">ppp0</filename> in this
-          file will match a <ulink
-          url="/manpages6/shorewall6-interfaces.html">shorewall6-interfaces</ulink>(5)
-          entry that defines <filename
-          class="devicefile">ppp+</filename>.</para>
-
-          <para>Where <ulink url="/4.4/MultiISP.html#Shared">more that one
-          internet provider share a single interface</ulink>, the provider is
-          specified by including the provider name or number in
-          parentheses:</para>
-
-          <programlisting>        eth0(Avvanta)</programlisting>
-
-          <para>In that case, you will want to specify the interface's address
-          for that provider in the ADDRESS column.</para>
-
-          <para>The interface may be qualified by adding the character ":"
-          followed by a comma-separated list of destination host or subnet
-          addresses to indicate that you only want to change the source IP
-          address for packets being sent to those particular destinations.
-          Exclusion is allowed (see <ulink
-          url="/manpages6/shorewall6-exclusion.html">shorewall6-exclusion</ulink>(5))
-          as are ipset names preceded by a plus sign '+'.</para>
-
-          <para>Comments may be attached to Netfilter rules generated from
-          entries in this file through the use of ?COMMENT lines. These lines
-          begin with ?COMMENT; the remainder of the line is treated as a
-          comment which is attached to subsequent rules until another ?COMMENT
-          line is found or until the end of the file is reached. To stop
-          adding comments to rules, use a line containing only
-          ?COMMENT.</para>
-
-          <para>Beginning with Shorewall 4.6.0, a new syntax is also accepted.
-          With the exception of the leading '+', the interfacelist and
-          qualifiers may appear within the parentheses of <emphasis
-          role="bold">INLINE</emphasis>(...).</para>
-
-          <para>Example:</para>
-
-          <programlisting>        +INLINE(eth0)</programlisting>
-
-          <para>When this is done, you may augment the rule generated by
-          Shorewall with iptables matches of your own. These matches appear
-          after a semicolon (';') at the end of the line.</para>
-
-          <para>See example 2 below.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">SOURCE</emphasis> (Optional) -
-        [<emphasis>interface</emphasis>|<emphasis>address</emphasis>[<emphasis
-        role="bold">,</emphasis><emphasis>address</emphasis>][<emphasis>exclusion</emphasis>]]</term>
-
-        <listitem>
-          <para>Set of hosts that you wish to SNAT; one or more host or
-          network addresses separated by comma. You may use ipset names
-          preceded by a plus sign (+) to specify a set of hosts.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">ADDRESS</emphasis> (Optional) - [<emphasis
-        role="bold">-</emphasis>|<emphasis
-        role="bold">NONAT</emphasis>|[<emphasis>address-or-address-range</emphasis>][:<emphasis>lowport</emphasis><emphasis
-        role="bold">-</emphasis><emphasis>highport</emphasis>][<emphasis
-        role="bold">:random</emphasis>][:persistent]|<emphasis
-        role="bold">detect</emphasis>|<emphasis
-        role="bold">random</emphasis>]</term>
-
-        <listitem>
-          <para>If you do not specify an address or address range,
-          masquerading will be performed. This requires <firstterm>Masquerade
-          Target</firstterm> support in your kernel and ip6tables.</para>
-
-          <para>If you specify an address here, SNAT will be used and this
-          will be the source address.</para>
-
-          <para>You may also specify a range of up to 256 IP addresses if you
-          want the SNAT address to be assigned from that range in a
-          round-robin fashion by connection. The range is specified by
-          <emphasis>first.ip.in.range</emphasis>-<emphasis>last.ip.in.range</emphasis>.
-          You may follow the port range with<emphasis
-          role="bold">:random</emphasis> in which case assignment of ports
-          from the list will be random. <emphasis
-          role="bold">random</emphasis> may also be specified by itself in
-          this column in which case random local port assignments are made for
-          the outgoing connections.</para>
-
-          <para>Example:
-          [2001:470:a:227::2]-[2001:470:a:227::10]:1000-1010</para>
-
-          <para>You may follow the port range (or <emphasis
-          role="bold">:random</emphasis>) with <emphasis
-          role="bold">:persistent</emphasis>. This is only useful when an
-          address range is specified and causes a client to be given the same
-          source/destination IP pair.</para>
-
-          <para>This column may not contain DNS Names.</para>
-
-          <para>Normally, Netfilter will attempt to retain the source port
-          number. You may cause netfilter to remap the source port by
-          following an address or range (if any) by ":" and a port range with
-          the format
-          <emphasis>lowport</emphasis>-<emphasis>highport</emphasis>. If this
-          is done, you must specify "tcp" or "udp" in the PROTO column.</para>
-
-          <para>Examples:</para>
-
-          <programlisting>        [2001:470:a:787::2]:5000-6000</programlisting>
-
-          <para>If you simply place <emphasis role="bold">NONAT</emphasis> in
-          this column, no rewriting of the source IP address or port number
-          will be performed. This is useful if you want particular traffic to
-          be exempt from the entries that follow in the file.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">PROTO</emphasis> (Optional) - {<emphasis
-        role="bold">-</emphasis>|[!]{<emphasis>protocol-name</emphasis>|<emphasis>protocol-number</emphasis>}[,...]|+<replaceable>ipset</replaceable>}</term>
-
-        <listitem>
-          <para>If you wish to restrict this entry to a particular protocol
-          then enter the protocol name (from protocols(5)) or number
-          here.</para>
-
-          <para>Beginning with Shorewall 4.5.12, this column can accept a
-          comma-separated list of protocols.</para>
-
-          <para>Beginning with Shorewall 4.6.0, an
-          <replaceable>ipset</replaceable> name can be specified in this
-          column. This is intended to be used with
-          <firstterm>bitmap:port</firstterm> ipsets.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">DPORT</emphasis> (Optional) -
-        {-|[!]<emphasis>port-name-or-number</emphasis>[,<emphasis>port-name-or-number</emphasis>]...|+<replaceable>ipset</replaceable>}</term>
-
-        <listitem>
-          <para>If the PROTO column specifies TCP (6), UDP (17), DCCP (33),
-          SCTP (132) or UDPLITE (136) then you may list one or more port
-          numbers (or names from services(5)) or port ranges separated by
-          commas.</para>
-
-          <para>Port ranges are of the form
-          <emphasis>lowport</emphasis>:<emphasis>highport</emphasis>.</para>
-
-          <para>Beginning with Shorewall 4.6.0, an
-          <replaceable>ipset</replaceable> name can be specified in this
-          column. This is intended to be used with
-          <firstterm>bitmap:port</firstterm> ipsets.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">IPSEC</emphasis> (Optional) -
-        [<emphasis>option</emphasis>[<emphasis
-        role="bold">,</emphasis><emphasis>option</emphasis>]...]</term>
-
-        <listitem>
-          <para>If you specify a value other than "-" in this column, you must
-          be running kernel 2.6 and your kernel and iptables must include
-          policy match support.</para>
-
-          <para>Comma-separated list of options from the following. Only
-          packets that will be encrypted via an SA that matches these options
-          will have their source address changed.</para>
-
-          <variablelist>
-            <varlistentry>
-              <term><emphasis
-              role="bold">reqid=</emphasis><emphasis>number</emphasis></term>
-
-              <listitem>
-                <para>where <emphasis>number</emphasis> is specified using
-                setkey(8) using the 'unique:<emphasis>number</emphasis> option
-                for the SPD level.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">spi=</emphasis>&lt;number&gt;</term>
-
-              <listitem>
-                <para>where <emphasis>number</emphasis> is the SPI of the SA
-                used to encrypt/decrypt packets.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">proto=</emphasis><emphasis
-              role="bold">ah</emphasis>|<emphasis
-              role="bold">esp</emphasis>|<emphasis
-              role="bold">ipcomp</emphasis></term>
-
-              <listitem>
-                <para>IPSEC Encapsulation Protocol</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis
-              role="bold">mss=</emphasis><emphasis>number</emphasis></term>
-
-              <listitem>
-                <para>sets the MSS field in TCP packets</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">mode=</emphasis><emphasis
-              role="bold">transport</emphasis>|<emphasis
-              role="bold">tunnel</emphasis></term>
-
-              <listitem>
-                <para>IPSEC mode</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis
-              role="bold">tunnel-src=</emphasis><emphasis>address</emphasis>[/<emphasis>mask</emphasis>]</term>
-
-              <listitem>
-                <para>only available with mode=tunnel</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis
-              role="bold">tunnel-dst=</emphasis><emphasis>address</emphasis>[/<emphasis>mask</emphasis>]</term>
-
-              <listitem>
-                <para>only available with mode=tunnel</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">strict</emphasis></term>
-
-              <listitem>
-                <para>Means that packets must match all rules.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">next</emphasis></term>
-
-              <listitem>
-                <para>Separates rules; can only be used with strict</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">yes</emphasis></term>
-
-              <listitem>
-                <para>When used by itself, causes all traffic that will be
-                encrypted/encapsulated to match the rule.</para>
-              </listitem>
-            </varlistentry>
-          </variablelist>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">MARK</emphasis> - [<emphasis
-        role="bold">!</emphasis>]<emphasis>value</emphasis>[/<emphasis>mask</emphasis>][<emphasis
-        role="bold">:C</emphasis>]</term>
-
-        <listitem>
-          <para>Defines a test on the existing packet or connection mark. The
-          rule will match only if the test returns true.</para>
-
-          <para>If you don't want to define a test but need to specify
-          anything in the following columns, place a "-" in this field.</para>
-
-          <variablelist>
-            <varlistentry>
-              <term>!</term>
-
-              <listitem>
-                <para>Inverts the test (not equal)</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis>value</emphasis></term>
-
-              <listitem>
-                <para>Value of the packet or connection mark.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis>mask</emphasis></term>
-
-              <listitem>
-                <para>A mask to be applied to the mark before testing.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><emphasis role="bold">:C</emphasis></term>
-
-              <listitem>
-                <para>Designates a connection mark. If omitted, the packet
-                mark's value is tested.</para>
-              </listitem>
-            </varlistentry>
-          </variablelist>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">USER</emphasis> (Optional) - [<emphasis
-        role="bold">!</emphasis>][<emphasis>user-name-or-number</emphasis>][<emphasis
-        role="bold">:</emphasis><emphasis>group-name-or-number</emphasis>][<emphasis
-        role="bold">+</emphasis><emphasis>program-name</emphasis>]</term>
-
-        <listitem>
-          <para>Only locally-generated connections will match if this column
-          is non-empty.</para>
-
-          <para>When this column is non-empty, the rule matches only if the
-          program generating the output is running under the effective
-          <emphasis>user</emphasis> and/or <emphasis>group</emphasis>
-          specified (or is NOT running under that id if "!" is given).</para>
-
-          <para>Examples:</para>
-
-          <variablelist>
-            <varlistentry>
-              <term>joe</term>
-
-              <listitem>
-                <para>program must be run by joe</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>:kids</term>
-
-              <listitem>
-                <para>program must be run by a member of the 'kids'
-                group</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>!:kids</term>
-
-              <listitem>
-                <para>program must not be run by a member of the 'kids'
-                group</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>+upnpd</term>
-
-              <listitem>
-                <para>#program named upnpd</para>
-
-                <important>
-                  <para>The ability to specify a program name was removed from
-                  Netfilter in kernel version 2.6.14.</para>
-                </important>
-              </listitem>
-            </varlistentry>
-          </variablelist>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">SWITCH -
-        [!]<replaceable>switch-name</replaceable>[={0|1}]</emphasis></term>
-
-        <listitem>
-          <para>Added in Shorewall 4.5.1 and allows enabling and disabling the
-          rule without requiring <command>shorewall restart</command>.</para>
-
-          <para>The rule is enabled if the value stored in
-          <filename>/proc/net/nf_condition/<replaceable>switch-name</replaceable></filename>
-          is 1. The rule is disabled if that file contains 0 (the default). If
-          '!' is supplied, the test is inverted such that the rule is enabled
-          if the file contains 0.</para>
-
-          <para>Within the <replaceable>switch-name</replaceable>, '@0' and
-          '@{0}' are replaced by the name of the chain to which the rule is a
-          added. The <replaceable>switch-name</replaceable> (after '@...'
-          expansion) must begin with a letter and be composed of letters,
-          decimal digits, underscores or hyphens. Switch names must be 30
-          characters or less in length.</para>
-
-          <para>Switches are normally <emphasis role="bold">off</emphasis>. To
-          turn a switch <emphasis role="bold">on</emphasis>:</para>
-
-          <simplelist>
-            <member><command>echo 1 &gt;
-            /proc/net/nf_condition/<replaceable>switch-name</replaceable></command></member>
-          </simplelist>
-
-          <para>To turn it <emphasis role="bold">off</emphasis> again:</para>
-
-          <simplelist>
-            <member><command>echo 0 &gt;
-            /proc/net/nf_condition/<replaceable>switch-name</replaceable></command></member>
-          </simplelist>
-
-          <para>Switch settings are retained over <command>shorewall
-          restart</command>.</para>
-
-          <para>Beginning with Shorewall 4.5.10, when the
-          <replaceable>switch-name</replaceable> is followed by
-          <option>=0</option> or <option>=1</option>, then the switch is
-          initialized to off or on respectively by the
-          <command>start</command> command. Other commands do not affect the
-          switch setting.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">ORIGDEST</emphasis> - [<emphasis
-        role="bold">-</emphasis>|<emphasis>address</emphasis>[,<emphasis>address</emphasis>]...[<emphasis>exclusion</emphasis>]|<emphasis>exclusion</emphasis>]</term>
-
-        <listitem>
-          <para>(Optional) This column may be included and may contain one or
-          more addresses (host or network) separated by commas. Address ranges
-          are not allowed. When this column is supplied, rules are generated
-          that require that the original destination address matches one of
-          the listed addresses. It is useful for specifying that SNAT should
-          occur only for connections that were acted on by a DNAT when they
-          entered the firewall.</para>
-
-          <para>This column was formerly labelled ORIGINAL DEST.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><emphasis role="bold">PROBABILITY</emphasis> -
-        [<replaceable>probability</replaceable>]</term>
-
-        <listitem>
-          <para>Added in Shorewall 5.0.0. When non-empty, requires the
-          <firstterm>Statistics Match</firstterm> capability in your kernel
-          and ip6tables and causes the rule to match randomly but with the
-          given <replaceable>probability</replaceable>. The
-          <replaceable>probability</replaceable> is a number 0 &lt;
-          <replaceable>probability</replaceable> &lt;= 1 and may be expressed
-          at up to 8 decimal points of precision.</para>
-        </listitem>
-      </varlistentry>
-    </variablelist>
-  </refsect1>
-
-  <refsect1>
-    <title>Examples</title>
-
-    <variablelist>
-      <varlistentry>
-        <term>Example 1:</term>
-
-        <listitem>
-          <para>You have a simple 'masquerading' setup where eth0 connects to
-          a DSL or cable modem and eth1 connects to your local network with
-          subnet 2001:470:b:787::0/64</para>
-
-          <para>Your entry in the file will be:</para>
-
-          <programlisting>        #INTERFACE   SOURCE                  ADDRESS
-        eth0         2001:470:b:787::0/64    -</programlisting>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>Example 2:</term>
-
-        <listitem>
-          <para>Your sit1 interface has two public IP addresses:
-          2001:470:a:227::1 and 2001:470:b:227::1. You want to use the
-          iptables statistics match to masquerade outgoing connections evenly
-          between these two addresses.</para>
-
-          <programlisting>/etc/shorewall/masq:
-
-       #INTERFACE    SOURCE         ADDRESS 
-       INLINE(sit1)  ::/0           2001:470:a:227::1 ;  -m statistic --mode random --probability 0.50
-       sit1          ::/0           2001:470:a:227::2 
-</programlisting>
-
-          <para>If INLINE_MATCHES=Yes in <ulink
-          url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5),
-          then these rules may be specified as follows:</para>
-
-          <programlisting>/etc/shorewall/masq:
-
-       #INTERFACE    SOURCE         ADDRESS 
-       sit1          ::/0           2001:470:a:227::1 ;  -m statistic --mode random --probability 0.50
-       sit1          ::/0           2001:470:a:227::2</programlisting>
-        </listitem>
-      </varlistentry>
-    </variablelist>
-  </refsect1>
-
-  <refsect1>
-    <title>FILES</title>
-
-    <para>/etc/shorewall6/masq</para>
-  </refsect1>
-</refentry>

Shorewall6/manpages/shorewall6-modules.xml

@@ -1,98 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
-"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
-<refentry>
-  <refmeta>
-    <refentrytitle>shorewall6-modules</refentrytitle>
-
-    <manvolnum>5</manvolnum>
-
-    <refmiscinfo>Configuration Files</refmiscinfo>
-  </refmeta>
-
-  <refnamediv>
-    <refname>modules</refname>
-
-    <refpurpose>shorewall6 file</refpurpose>
-  </refnamediv>
-
-  <refsynopsisdiv>
-    <cmdsynopsis>
-      <command>/usr/share/shorewall6/modules</command>
-    </cmdsynopsis>
-
-    <cmdsynopsis>
-      <command>/usr/share/shorewall6/helpers</command>
-    </cmdsynopsis>
-  </refsynopsisdiv>
-
-  <refsect1>
-    <title>Description</title>
-
-    <para>These files specify which kernel modules shorewall6 will load before
-    trying to determine your ip6tables/kernel's capabilities. The
-    <filename>modules</filename> file is used when LOAD_HELPERS_ONLY=No in
-    <ulink url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5);
-    the <filename>helpers</filename> file is used when
-    LOAD_HELPERS_ONLY=Yes.</para>
-
-    <para>Each record in the files has the following format:</para>
-
-    <cmdsynopsis>
-      <command>loadmodule</command>
-
-      <arg choice="plain"><replaceable
-      class="parameter">modulename</replaceable></arg>
-
-      <arg rep="repeat"><replaceable>moduleoption</replaceable></arg>
-    </cmdsynopsis>
-
-    <para>The <replaceable>modulename</replaceable> names a kernel module
-    (without suffix). shorewall6 will search for modules based on your
-    MODULESDIR and MODULE_SUFFIX settings in <ulink
-    url="/manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5). The
-    <replaceable>moduleoption</replaceable>s are passed to modprobe (if
-    installed) or to insmod.</para>
-
-    <para>The /usr/share/shorewall6/modules file contains a large number of
-    modules. Users are encouraged to copy the file to /etc/shorewall6/modules
-    and modify the copy to load only the modules required or use
-    LOAD_HELPERS_ONLY=Yes.<note>
-        <para>If you build monolithic kernels and have not installed
-        module-init-tools, then create an empty /etc/shorewall6/modules file;
-        that will prevent shorewall6 from trying to load modules at
-        all.</para>
-      </note></para>
-  </refsect1>
-
-  <refsect1>
-    <title>Example</title>
-
-    <para>loadmodule ip_conntrack_ftp ports=21,221</para>
-  </refsect1>
-
-  <refsect1>
-    <title>FILES</title>
-
-    <para>/usr/share/shorewall6/modules</para>
-
-    <para>/usr/share/shorewall6/helpers</para>
-
-    <para>/etc/shorewall6/modules</para>
-
-    <para>/etc/shorewall6/helpers</para>
-  </refsect1>
-
-  <refsect1>
-    <title>See ALSO</title>
-
-    <para>shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5),
-    shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-interfaces(5),
-    shorewall6-maclist(5), shorewall6-netmap(5),shorewall6-params(5),
-    shorewall6-policy(5), shorewall6-providers(5), shorewall6-rtrules(5),
-    shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5),
-    shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5),
-    shorewall6-mangle(5), shorewall6-tos(5), shorewall6-tunnels(5),
-    shorewall6-zones(5)</para>
-  </refsect1>
-</refentry>