Shoreline Firewall (Shorewall) 1.3

What is it?

The Shoreline Firewall, more commonly known as "Shorewall", is a Netfilter (iptables) based firewall that can be used on a dedicated firewall system, a multi-function gateway/router/server or on a standalone GNU/Linux system.

This program is free software; you can redistribute it and/or modify it under the terms of Version 2 of the GNU General Public License as published by the Free Software Foundation.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA

Running Shorewall on Mandrake with a two-interface setup?

If so, almost NOTHING on this site will apply directly to your setup. If you want to use the documentation that you find here, it is best if you uninstall what you have and install a setup that matches the documentation on this site. See the Two-interface QuickStart Guide for details.

Getting Started with Shorewall

New to Shorewall? Start by selecting the QuickStart Guide that most closely match your environment and follow the step by step instructions.

News

5/20/2003 - Shorewall-1.4.3a

This version primarily corrects the documentation included in the .tgz and in the .rpm. In addition:

(This change is in 1.4.3 but is not documented) If you are running iptables 1.2.7a and kernel 2.4.20, then Shorewall will return reject replies as follows:
   a) tcp - RST
   b) udp - ICMP port unreachable
   c) icmp - ICMP host unreachable
   d) Otherwise - ICMP host prohibited
If you are running earlier software, Shorewall will follow it's traditional convention:
   a) tcp - RST
   b) Otherwise - ICMP port unreachable
UDP port 135 is now silently dropped in the common.def chain. Remember that this chain is traversed just before a DROP or REJECT policy is enforced.

5/18/2003 - Shorewall 1.4.3

Problems Corrected:

There were several cases where Shorewall would fail to remove a temporary directory from /tmp. These cases have been corrected.
The rules for allowing all traffic via the loopback interface have been moved to before the rule that drops status=INVALID packets. This insures that all loopback traffic is allowed even if Netfilter connection tracking is confused.

New Features:

IPV6-IPV4 (6to4) tunnels are now supported in the /etc/shorewall/tunnels file.
Shorewall can now be easily integrated with fireparse (http://www.fireparse.com) by setting LOGMARKER="fp=" in /etc/shorewall/shorewall.conf. Note: You may not use ULOG with fireparse unless you modify fireparse.

5/10/2003 - Shorewall Mirror in Asia

Ed Greshko has established a mirror in Taiwan -- Thanks Ed!

5/8/2003 - Shorewall Mirror in Chile

Thanks to Darcy Ganga, there is now an HTTP mirror in Santiago Chile.

4/26/2003 - lists.shorewall.net Downtime

The list server will be down this morning for upgrade to RH9.0.

4/21/2003 - Samples updated for Shorewall version 1.4.2

Thanks to Francesca Smith, the sample configurations are now upgraded to Shorewall version 1.4.2.

4/12/2002 - Greater Seattle Linux Users Group Presentation

This morning, I gave a Shorewall presentation to GSLUG. The presentation is in HTML format but was generated from Microsoft PowerPoint and is best viewed using Internet Explorer (although Konqueror also seems to work reasonably well as does Opera 7.1.0). Neither Opera 6 nor Netscape work well to view the presentation.

More News

Jacques Nilo and Eric Wolzak have a LEAF (router/firewall/gateway on a floppy, CD or compact flash) distribution called Bering that features Shorewall-1.3.14 and Kernel-2.4.20. You can find their work at: http://leaf.sourceforge.net/devel/jnilo

Congratulations to Jacques and Eric on the recent release of Bering 1.2!!!

This site is hosted by the generous folks at SourceForge.net

Donations