Shoreline Firewall (Shorewall) 1.3

What is it?

The Shoreline Firewall, more commonly known as "Shorewall", is a Netfilter (iptables) based firewall that can be used on a dedicated firewall system, a multi-function gateway/router/server or on a standalone GNU/Linux system.

This program is free software; you can redistribute it and/or modify it under the terms of Version 2 of the GNU General Public License as published by the Free Software Foundation.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA

Jacques Nilo and Eric Wolzak have a LEAF (router/firewall/gateway on a floppy, CD or compact flash) distribution called Bering that features Shorewall-1.3.9b and Kernel-2.4.18. You can find their work at: http://leaf.sourceforge.net/devel/jnilo

Thinking of Downloading this Site for Offline Browsing?

You might want to reconsider -- this site is 213 MB!!! and you will almost certainly be blacklisted before you download the whole thing (my SDSL is only 384kbs so I'll have lots of time to catch you). Besides, if you simply download the product and install it, you get the essential parts of the site in a fraction of the time. And do you really want to download:

Both text and HTML versions of every post ever made on three different mailing lists (65 MB)?
Every .rpm, .tgz and .lrp ever released for both Shorewall and Seawall (92MB and 10MB respectively)?
A 2.2.17-14 i586 RedHat Kernel RPM (6.9MB)?
Several ancient RPMs for courier-imap and maildrop (1.5MB).

You get all that and more if you do a blind recurive copy of this site. Happy downloading!

News

11/09/2002 - Shorewall 1.3.10

In this version:

You may now define the contents of a zone dynamically with the "shorewall add" and "shorewall delete" commands. These commands are expected to be used primarily within FreeS/Wan updown scripts.
Shorewall can now do MAC verification on ethernet segments. You can specify the set of allowed MAC addresses on the segment and you can optionally tie each MAC address to one or more IP addresses.
PPTP Servers and Clients running on the firewall system may now be defined in the /etc/shorewall/tunnels file.
A new 'ipsecnat' tunnel type is supported for use when the remote IPSEC endpoint is behind a NAT gateway.
The PATH used by Shorewall may now be specified in /etc/shorewall/shorewall.conf.
The main firewall script is now /usr/lib/shorewall/firewall. The script in /etc/init.d/shorewall is very small and uses /sbin/shorewall to do the real work. This change makes custom distributions such as for Debian and for Gentoo easier to manage since it is /etc/init.d/shorewall that tends to have distribution-dependent code.

If you have installed the 1.3.10 Beta 1 RPM and are now upgrading to version 1.3.10, you will need to use the '--force' option:

rpm -Uvh --force shorewall-1.3.10-1.noarch.rpm

10/24/2002 - Shorewall is now in Gentoo Linux

Alexandru Hartmann reports that his Shorewall package is now a part of the Gentoo Linux distribution. Thanks Alex!

10/23/2002 - Shorewall 1.3.10 Beta 1

In this version:

You may now define the contents of a zone dynamically with the "shorewall add" and "shorewall delete" commands. These commands are expected to be used primarily within FreeS/Wan updown scripts.
Shorewall can now do MAC verification on ethernet segments. You can specify the set of allowed MAC addresses on the segment and you can optionally tie each MAC address to one or more IP addresses.
PPTP Servers and Clients running on the firewall system may now be defined in the /etc/shorewall/tunnels file.
A new 'ipsecnat' tunnel type is supported for use when the remote IPSEC endpoint is behind a NAT gateway.
The PATH used by Shorewall may now be specified in /etc/shorewall/shorewall.conf.
The main firewall script is now /usr/lib/shorewall/firewall. The script in /etc/init.d/shorewall is very small and uses /sbin/shorewall to do the real work. This change makes custom distributions such as for Debian and for Gentoo easier to manage since it is /etc/init.d/shorewall that tends to have distribution-dependent code.

You may download the Beta from:

10/10/2002 - Debian 1.3.9b Packages Available

Apt-get sources listed at http://security.dsi.unimi.it/~lorenzo/debian.html.

10/9/2002 - Shorewall 1.3.9b

This release rolls up fixes to the installer and to the firewall script.

10/6/2002 - Shorewall.net now running on RH8.0

The firewall and server here at shorewall.net are now running RedHat release 8.0.

9/30/2002 - Shorewall 1.3.9a

Roles up the fix for broken tunnels.

9/30/2002 - TUNNELS Broken in 1.3.9!!!

There is an updated firewall script at ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall -- copy that file to /usr/lib/shorewall/firewall.

9/28/2002 - Shorewall 1.3.9

In this version:

DNS Names are now allowed in Shorewall config files (although I recommend against using them).
The connection SOURCE may now be qualified by both interface and IP address in a Shorewall rule.
Shorewall startup is now disabled after initial installation until the file /etc/shorewall/startup_disabled is removed. This avoids nasty surprises at reboot for users who install Shorewall but don't configure it.
The 'functions' and 'version' files and the 'firewall' symbolic link have been moved from /var/lib/shorewall to /usr/lib/shorewall to appease the LFS police at Debian.

More News

Shorewall 1.3 - "iptables made easy"

What is it?

Thinking of Downloading this Site for Offline Browsing?

News

Donations