The Shoreline Firewall, more commonly known as "Shorewall", is a Netfilter (iptables) based firewall that can be used on a dedicated firewall system, a multi-function gateway/router/server or on a standalone GNU/Linux system.

This program is free software; you can redistribute it and/or modify it under the terms of Version 2 of the GNU General Public License as published by the Free Software Foundation.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA

Copyright 2001, 2002, 2003 Thomas M. Eastep

This is the Shorewall 1.4 Web Site

• The 1.3 site is here.
• The 1.2 site is here.
  

Getting Started with Shorewall

Looking for Information?

Running Shorewall on Mandrake with a two-interface setup?

News

8/5/2003 - Shorewall-1.4.6b

1. Previously, if TC_ENABLED is set to yes in shorewall.conf then Shorewall would fail to start with the error "ERROR:  Traffic Control requires Mangle"; that problem has been corrected.
2. Corrected handling of MAC addresses in the SOURCE column of the tcrules file. Previously, these addresses resulted in an invalid iptables command.
3. The "shorewall stop" command is now disabled when /etc/shorewall/startup_disabled exists. This prevents people from shooting themselves in the foot prior to having configured Shorewall.
4. A change introduced in version 1.4.6 caused error messages during "shorewall [re]start" when ADD_IP_ALIASES=Yes and ip addresses were being added to a PPP interface; the addresses were successfully added in spite of the messages.
     
   The firewall script has been modified to eliminate the error messages.
   

7/31/2003 - Snapshot 1.4.6_20030731

http://shorewall.net/pub/shorewall/Snapshots/
ftp://shorewall.net/pub/shorewall/Snapshots/

1. Corrected problem in 1.4.6 where the MANGLE_ENABLED variable was being tested before it was set.
2. Corrected handling of MAC addresses in the SOURCE column of the tcrules file. Previously, these addresses resulted in an invalid iptables command.
   

1. Once you have installed this version of Shorewall, you must restart Shorewall before you may use the 'drop', 'reject', 'allow' or 'save' commands.
2. To maintain strict compatibility with previous versions, current uses of "shorewall drop" and "shorewall reject" should be replaced with "shorewall dropall" and "shorewall rejectall"

1. Shorewall now creates a dynamic blacklisting chain for each interface defined in /etc/shorewall/interfaces. The 'drop' and 'reject' commands use the routing table to determine which of these chains is to be used for blacklisting the specified IP address(es).
   
   Two new commands ('dropall' and 'rejectall') have been introduced that do what 'drop' and 'reject' used to do; namely, when an address is blacklisted using these new commands, it will be blacklisted on all of your firewall's interfaces.
2. Thanks to Steve Herber, the 'help' command can now give command-specific help (e.g., shorewall help <command>).
3. A new option "ADMINISABSENTMINDED" has been added to /etc/shorewall/shorewall.conf. This option has a default value of "No" for existing users which causes Shorewall's 'stopped' state  to continue as it has been; namely, in the stopped state only traffic to/from hosts listed in /etc/shorewall/routestopped is accepted.
   
   With ADMINISABSENTMINDED=Yes (the default for new installs), in addition to traffic to/from the hosts listed in /etc/shorewall/routestopped, Shorewall will allow:
   
      a) All traffic originating from the firewall itself; and
      b) All traffic that is part of or related to an already-existing connection.
   
    In particular, with ADMINISABSENTMINDED=Yes, a "shorewall stop" entered through an ssh session will not kill the session.
   
    Note though that even with ADMINISABSENTMINDED=Yes, it is still possible for people to shoot themselves in the foot.
   
    Example:
   
    /etc/shorewall/nat:
   
        206.124.146.178    eth0:0    192.168.1.5   
   
    /etc/shorewall/rules:
   
      ACCEPT    net    loc:192.168.1.5    tcp    22
      ACCEPT    loc    fw        tcp    22
   
   From a remote system, I ssh to 206.124.146.178 which establishes an SSH connection with local system 192.168.1.5. I then create a second SSH connection from that computer to the firewall and confidently type "shorewall stop". As part of its stop processing, Shorewall removes eth0:0 which kills my SSH connection to 192.168.1.5!!!
   

7/22/2003 - Shorewall-1.4.6a

1. Previously, if TC_ENABLED is set to yes in shorewall.conf then Shorewall would fail to start with the error "ERROR:  Traffic Control requires Mangle"; that problem has been corrected.

7/20/2003 - Shorewall-1.4.6

Problems Corrected:

1. A problem seen on RH7.3 systems where Shorewall encountered start errors when started using the "service" mechanism has been worked around.
   
   
2. Where a list of IP addresses appears in the DEST column of a DNAT[-] rule, Shorewall incorrectly created multiple DNAT rules in the nat table (one for each element in the list). Shorewall now correctly creates a single DNAT rule with multiple "--to-destination" clauses.
   
   
3. Corrected a problem in Beta 1 where DNS names containing a "-" were mis-handled when they appeared in the DEST column of a rule.
   
   
4. A number of problems with rule parsing have been corrected. Corrections involve the handling of "z1!z2" in the SOURCE column as well as lists in the ORIGINAL DESTINATION column.
   
   
5. The message "Adding rules for DHCP" is now suppressed if there are no DHCP rules to add.
   

Migration Issues:

1. In earlier versions, an undocumented feature allowed entries in the host file as follows:
   
       z    eth1:192.168.1.0/24,eth2:192.168.2.0/24
   
   This capability was never documented and has been removed in 1.4.6 to allow entries of the following format:
   
       z   eth1:192.168.1.0/24,192.168.2.0/24
   
   
2. The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT options have been removed from /etc/shorewall/shorewall.conf. These capabilities are now automatically detected by Shorewall (see below).
   

New Features:

1. A 'newnotsyn' interface option has been added. This option may be specified in /etc/shorewall/interfaces and overrides the setting NEWNOTSYN=No for packets arriving on the associated interface.
   
   
2. The means for specifying a range of IP addresses in /etc/shorewall/masq to use for SNAT is now documented. ADD_SNAT_ALIASES=Yes is enabled for address ranges.
   
   
3. Shorewall can now add IP addresses to subnets other than the first one on an interface.
   
   
4. DNAT[-] rules may now be used to load balance (round-robin) over a set of servers. Servers may be specified in a range of addresses given as <first address>-<last address>.
   
   Example:
   
       DNAT net loc:192.168.10.2-192.168.10.5 tcp 80
   
   
5. The NAT_ENABLED, MANGLE_ENABLED and MULTIPORT configuration options have been removed and have been replaced by code that detects whether these capabilities are present in the current kernel. The output of the start, restart and check commands have been enhanced to report the outcome:
   
   Shorewall has detected the following iptables/netfilter capabilities:
      NAT: Available
      Packet Mangling: Available
      Multi-port Match: Available
   Verifying Configuration...
   
   
6. Support for the Connection Tracking Match Extension has been added. This extension is available in recent kernel/iptables releases and allows for rules which match against elements in netfilter's connection tracking table. Shorewall automatically detects the availability of this extension and reports its availability in the output of the start, restart and check commands.
   
   Shorewall has detected the following iptables/netfilter capabilities:
      NAT: Available
      Packet Mangling: Available
      Multi-port Match: Available
      Connection Tracking Match: Available
   Verifying Configuration...
   
   If this extension is available, the ruleset generated by Shorewall is changed in the following ways:
• To handle 'norfc1918' filtering, Shorewall will not create chains in the mangle table but will rather do all 'norfc1918' filtering in the filter table (rfc1918 chain).
• Recall that Shorewall DNAT rules generate two netfilter rules; one in the nat table and one in the filter table. If the Connection Tracking Match Extension is available, the rule in the filter table is extended to check that the original destination address was the same as specified (or defaulted to) in the DNAT rule.
  
  
7. The shell used to interpret the firewall script (/usr/share/shorewall/firewall) may now be specified using the SHOREWALL_SHELL parameter in shorewall.conf.
   
   
8. An 'ipcalc' command has been added to /sbin/shorewall.
   
         ipcalc [ <address> <netmask> | <address>/<vlsm> ]
   
   Examples:
   
         [root@wookie root]# shorewall ipcalc 192.168.1.0/24
            CIDR=192.168.1.0/24
            NETMASK=255.255.255.0
            NETWORK=192.168.1.0
            BROADCAST=192.168.1.255
         [root@wookie root]#
   
         [root@wookie root]# shorewall ipcalc 192.168.1.0 255.255.255.0
            CIDR=192.168.1.0/24
            NETMASK=255.255.255.0
            NETWORK=192.168.1.0
            BROADCAST=192.168.1.255
         [root@wookie root]#
   
   Warning:
   
   If your shell only supports 32-bit signed arithmatic (ash or dash), then the ipcalc command produces incorrect information for IP addresses 128.0.0.0-1 and for /1 networks. Bash should produce correct information for all valid IP addresses.
   
   
9. An 'iprange' command has been added to /sbin/shorewall.
   
         iprange <address>-<address>
   
   This command decomposes a range of IP addressses into a list of network and host addresses. The command can be useful if you need to construct an efficient set of rules that accept connections from a range of network addresses.
   
   Note: If your shell only supports 32-bit signed arithmetic (ash or dash) then the range may not span 128.0.0.0.
   
   Example:
   
         [root@gateway root]# shorewall iprange 192.168.1.4-192.168.12.9
         192.168.1.4/30
         192.168.1.8/29
         192.168.1.16/28
         192.168.1.32/27
         192.168.1.64/26
         192.168.1.128/25
         192.168.2.0/23
         192.168.4.0/22
         192.168.8.0/22
         192.168.12.0/29
         192.168.12.8/31
         [root@gateway root]#
   
   
10. A list of host/net addresses is now allowed in an entry in /etc/shorewall/hosts.
    
    Example:
    
        foo    eth1:192.168.1.0/24,192.168.2.0/24
    
    
11. The "shorewall check" command now includes the chain name when printing the applicable policy for each pair of zones.
     
        Example:
     
            Policy for dmz to net is REJECT using chain all2all
     
    This means that the policy for connections from the dmz to the internet is REJECT and the applicable entry in the /etc/shorewall/policy was the all->all policy.
    
    
12. Support for the 2.6 Kernel series has been added.
    

More News

Jacques Nilo and Eric Wolzak have a LEAF (router/firewall/gateway on a floppy, CD or compact flash) distribution called Bering that features Shorewall-1.4.2 and Kernel-2.4.20. You can find their work at: http://leaf.sourceforge.net/devel/jnilo

Donations

Extended Search