Tom Eastep 2007 2009 Thomas M. Eastep Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of the license is included in the section entitled GNU Free Documentation License.

Shorewall version 4 represents a substantial shift in direction for Shorewall. Up to now Shorewall has been written entirely in Bourne Shell. Shorewall has run the iptables utility to add each Netfilter rule. Shorewall version 4 offers you a choice. You can continue to use the existing shell-based implementation or you can use a new implementation of the Shorewall compiler written in the Perl programming language. The new compiler: has a small disk footprint is very fast. generates a firewall script that uses iptables-restore; so the script is very fast. generates better and more consistent error messages. does a much more thorough job of checking the configuration to avoid run-time errors. supports creating either Ipv4 or Ipv6 firewalls (Shorewall 4.2.4 and later). Both compilers may be installed on your system and you can use whichever one suits you in a particular case.

Shorewall 4 contains six packages: Shorewall-shell - the old shell-based compiler and related components. Shorewall-perl - the new Perl-based compiler. Shorewall-common - the part of Shorewall common to both compilers. Shorewall-lite- same as the 3.4 version of Shorewall Lite. Can run scripts generated by either Shorewall-perl or Shorewall-shell. Shorewall6 - The utilities for creating and operating an Ipv6 firewall. Requires Shorewall-perl and Shorewall-common. Shorewall6-lite - Ipv6 equivalent of Shorewall Lite. Can run scripts generated by Shoreall-perl 4.2.4 and later. If you upgrade to Shorewall Version 4, you must install Shorewall-shell and/or Shorewall-perl; in fact, if you are using the tarball for your installation, you must install Shorewall-shell and/or Shorewall-perl before you upgrade Shorewall. See the upgrade issues for details.

Perl (I use Perl 5.8.8 but other 5.8 versions should work fine). If you want to be able to use DNS names in your Shorewall6 configuration files, then Perl 5.10 is required together with the Perl Socket6 module. Perl Cwd Module Perl File::Basename Module Perl File::Temp Module Perl Getopt::Long Module Perl Carp Module Perl FindBin Module (Shorewall 4.0.3 and later) Perl Scalar::Util Module (Shorewall 4.0.6 and later)

The Shorewall-perl compiler is not 100% compatible with the Shorewall-shell version. See this document for details.

If you only install one compiler, then that compiler will be used. If you install both compilers, then the compiler actually used for IPv4 depends on the SHOREWALL_COMPILER setting in shorewall.conf. The value of this new option can be either 'perl' or 'shell'. If you add 'SHOREWALL_COMPILER=perl' to /etc/shorewall/shorewall.conf then by default, the new compiler will be used on the system. If you add it to shorewall.conf in a separate directory (such as a Shorewall-lite export directory) then the new compiler will only be used when you compile from that directory. If you only install one compiler, it is suggested that you do not set SHOREWALL_COMPILER. If both compilers are installed, you can select the compiler to use on the command line using the 'C option: '-C shell' means use the shell compiler '-C perl' means use the perl compiler The -C option overrides the setting in shorewall.conf. Example:shorewall restart -C perl When the Shorewall-perl compiler has been selected, the params file is processed using the shell -a option which causes all variables set within the file to be exported automatically by the shell. The Shorewall-perl compiler uses the current environmental variables to perform variable expansion within the other Shorewall configuration files.