Shorewall 1.3 - "iptables made easy"

What is it?

The Shoreline Firewall, more commonly known as "Shorewall", is a Netfilter (iptables) based firewall that can be used on a dedicated firewall system, a multi-function gateway/router/server or on a standalone GNU/Linux system.

This program is free software; you can redistribute it and/or modify it under the terms of Version 2 of the GNU General Public License as published by the Free Software Foundation.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA

Copyright 2001, 2002, 2003 Thomas M. Eastep

Jacques Nilo and Eric Wolzak have a LEAF (router/firewall/gateway on a floppy, CD or compact flash) distribution called Bering that features Shorewall-1.3.10 and Kernel-2.4.18. You can find their work at: http://leaf.sourceforge.net/devel/jnilo

Congratulations to Jacques and Eric on the recent release of Bering 1.0 Final!!!

This is a mirror of the main Shorewall web site at SourceForge (http://shorewall.sf.net)

News

2/8/2003 - Shorewall 1.3.14

New features include

1. An OLD_PING_HANDLING option has been added to shorewall.conf. When set to Yes, Shorewall ping handling is as it has always been (see http://www.shorewall.net/ping.html).
   
   When OLD_PING_HANDLING=No, icmp echo (ping) is handled via rules and policies just like any other connection request. The FORWARDPING=Yes option in shorewall.conf and the 'noping' and 'filterping' options in /etc/shorewall/interfaces will all generate an error.
   
   
2. It is now possible to direct Shorewall to create a "label" such as  "eth0:0" for IP addresses that it creates under ADD_IP_ALIASES=Yes and ADD_SNAT_ALIASES=Yes. This is done by specifying the label instead of just the interface name:
    
      a) In the INTERFACE column of /etc/shorewall/masq
      b) In the INTERFACE column of /etc/shorewall/nat
    
3. Support for OpenVPN Tunnels.
   
   
4. Support for VLAN devices with names of the form $DEV.$VID (e.g., eth0.0)
   
   
5. In /etc/shorewall/tcrules, the MARK value may be optionally followed by ":" and either 'F' or 'P' to designate that the marking will occur in the FORWARD or PREROUTING chains respectively. If this additional specification is omitted, the chain used to mark packets will be determined by the setting of the MARK_IN_FORWARD_CHAIN option in shorewall.conf.
   
   
6. When an interface name is entered in the SUBNET column of the /etc/shorewall/masq file, Shorewall previously masqueraded traffic from only the first subnet defined on that interface. It did not masquerade traffic from:
    
      a) The subnets associated with other addresses on the interface.
      b) Subnets accessed through local routers.
    
   Beginning with Shorewall 1.3.14, if you enter an interface name in the SUBNET column, shorewall will use the firewall's routing table to construct the masquerading/SNAT rules.
    
   Example 1 -- This is how it works in 1.3.14.
     
   

      [root@gateway test]# cat /etc/shorewall/masq
      #INTERFACE              SUBNET                  ADDRESS
      eth0                    eth2                    206.124.146.176
      #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE

      [root@gateway test]# ip route show dev eth2
      192.168.1.0/24  scope link
      192.168.10.0/24  proto kernel  scope link  src 192.168.10.254
   

      [root@gateway test]# shorewall start
      ...
      Masqueraded Subnets and Hosts:
          To 0.0.0.0/0 from 192.168.1.0/24 through eth0 using 206.124.146.176
          To 0.0.0.0/0 from 192.168.10.0/24 through eth0 using 206.124.146.176
      Processing /etc/shorewall/tos...

    
   When upgrading to Shorewall 1.3.14, if you have multiple local subnets connected to an interface that is specified in the SUBNET column of an /etc/shorewall/masq entry, your /etc/shorewall/masq file will need changing. In most cases, you will simply be able to remove redundant entries. In some cases though, you might want to change from using the interface name to listing specific subnetworks if the change described above will cause masquerading to occur on subnetworks that you don't wish to masquerade.
    
   Example 2 -- Suppose that your current config is as follows:
     
   

      [root@gateway test]# cat /etc/shorewall/masq
      #INTERFACE              SUBNET                  ADDRESS
      eth0                    eth2                    206.124.146.176
      eth0                    192.168.10.0/24         206.124.146.176
      #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE

      [root@gateway test]# ip route show dev eth2
      192.168.1.0/24  scope link
      192.168.10.0/24  proto kernel  scope link  src 192.168.10.254
      [root@gateway test]#

    
      In this case, the second entry in /etc/shorewall/masq is no longer required.
    
   Example 3 -- What if your current configuration is like this?
    
   

      [root@gateway test]# cat /etc/shorewall/masq
      #INTERFACE              SUBNET                  ADDRESS
      eth0                    eth2                    206.124.146.176
      #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE

      [root@gateway test]# ip route show dev eth2
      192.168.1.0/24  scope link
      192.168.10.0/24  proto kernel  scope link  src 192.168.10.254
      [root@gateway test]#

    
      In this case, you would want to change the entry in  /etc/shorewall/masq to:
   

      #INTERFACE              SUBNET                  ADDRESS
      eth0                    192.168.1.0/24          206.124.146.176
      #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE

2/5/2003 - Shorewall Support included in Webmin 1.060

More News

Donations