Shorwall Logo Shorewall 1.4 - "iptables made easy"

Shorewall 1.3 Site here

What is it?

The Shoreline Firewall, more commonly known as "Shorewall", is a Netfilter (iptables) based firewall that can be used on a dedicated firewall system, a multi-function gateway/router/server or on a standalone GNU/Linux system.

This program is free software; you can redistribute it and/or modify it under the terms of Version 2 of the GNU General Public License as published by the Free Software Foundation.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA

Copyright 2001, 2002, 2003 Thomas M. Eastep

Jacques Nilo and Eric Wolzak have a LEAF (router/firewall/gateway on a floppy, CD or compact flash) distribution called Bering that features Shorewall-1.3.14 and Kernel-2.4.20. You can find their work at: http://leaf.sourceforge.net/devel/jnilo

Congratulations to Jacques and Eric on the recent release of Bering 1.1!!!

This is a mirror of the main Shorewall web site at SourceForge (http://shorewall.sf.net)

News

3/14/2003 - Shorewall 1.4.0 (New)

Shorewall 1.4 represents the next step in the evolution of Shorewall. The main thrust of the initial release is simply to remove the cruft that has accumulated in Shorewall over time.
 
IMPORTANT: Shorewall 1.4.0 requires the iproute package ('ip' utility).

Function from 1.3 that has been omitted from this version include:
  1. The MERGE_HOSTS variable in shorewall.conf is no longer supported. Shorewall 1.4 behavior is the same as 1.3 with MERGE_HOSTS=Yes.

  2. Interface names of the form <device>:<integer> in /etc/shorewall/interfaces now generate an error.

  3. Shorewall 1.4 implements behavior consistent with OLD_PING_HANDLING=No. OLD_PING_HANDLING=Yes will generate an error at startup as will specification of the 'noping' or 'filterping' interface options.

  4. The 'routestopped' option in the /etc/shorewall/interfaces and /etc/shorewall/hosts files is no longer supported and will generate an error at startup if specified.

  5. The Shorewall 1.2 syntax for DNAT and REDIRECT rules is no longer accepted.

  6. The ALLOWRELATED variable in shorewall.conf is no longer supported. Shorewall 1.4 behavior is the same as 1.3 with ALLOWRELATED=Yes.

  7. The icmp.def file has been removed.

  8. The 'multi' interface option is no longer supported.  Shorewall will generate rules for sending packets back out the same interface that they arrived on in two cases:
  • There is an explicit policy for the source zone to or from the destination zone. An explicit policy names both zones and does not use the 'all' reserved word.
  • There are one or more rules for traffic for the source zone to or from the destination zone including rules that use the 'all' reserved word. Exception: if the source zone and destination zone are the same then the rule must be explicit - it must name the zone in both the SOURCE and DESTINATION columns.
Changes for 1.4 include:
  1. The /etc/shorewall/shorewall.conf file has been completely reorganized into logical sections.

  2. LOG is now a valid action for a rule (/etc/shorewall/rules).

  3. The firewall script and version file are now installed in /usr/share/shorewall.

  4. Late arriving DNS replies are now silently dropped in the common chain by default.

  5. In addition to behaving like OLD_PING_HANDLING=No, Shorewall 1.4 no longer unconditionally accepts outbound ICMP packets. So if you want to 'ping' from the firewall, you will need the appropriate rule or policy.

  6. CONTINUE is now a valid action for a rule (/etc/shorewall/rules).

  7. 802.11b devices with names of the form wlan<n> now support the 'maclist' option.

  8. Explicit Congestion Notification (ECN - RFC 3168) may now be turned off on a host or network basis using the new /etc/shorewall/ecn file. To use this facility:

       a) You must be running kernel 2.4.20
       b) You must have applied the patch in
       http://www.shorewall/net/pub/shorewall/ecn/patch.
       c) You must have iptables 1.2.7a installed.

  9. The /etc/shorewall/params file is now processed first so that variables may be used in the /etc/shorewall/shorewall.conf file.

More News

Donations

 M

 

Shorewall is free but if you try it and find it useful, please consider making a donation to Starlight Children's Foundation. Thanks!

Updated 3/5/2003 - Tom Eastep