forked from extern/shorewall_code
745 lines
27 KiB
XML
745 lines
27 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
|
|
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
|
|
<article>
|
|
<!--$Id$-->
|
|
|
|
<articleinfo>
|
|
<title>Operating Shorewall and Shorewall Lite</title>
|
|
|
|
<authorgroup>
|
|
<author>
|
|
<firstname>Tom</firstname>
|
|
|
|
<surname>Eastep</surname>
|
|
</author>
|
|
</authorgroup>
|
|
|
|
<pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
|
|
|
|
<copyright>
|
|
<year>2004</year>
|
|
|
|
<year>2005</year>
|
|
|
|
<year>2006</year>
|
|
|
|
<year>2007</year>
|
|
|
|
<holder>Thomas M. Eastep</holder>
|
|
</copyright>
|
|
|
|
<legalnotice>
|
|
<para>Permission is granted to copy, distribute and/or modify this
|
|
document under the terms of the GNU Free Documentation License, Version
|
|
1.2 or any later version published by the Free Software Foundation; with
|
|
no Invariant Sections, with no Front-Cover, and with no Back-Cover
|
|
Texts. A copy of the license is included in the section entitled
|
|
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation
|
|
License</ulink></quote>.</para>
|
|
</legalnotice>
|
|
</articleinfo>
|
|
|
|
<caution>
|
|
<para><emphasis role="bold">This article applies to Shorewall 4.3 and
|
|
later. If you are running a version of Shorewall earlier than Shorewall
|
|
4.3.5 then please see the documentation for that
|
|
release</emphasis>.</para>
|
|
</caution>
|
|
|
|
<section id="CLI">
|
|
<title>/sbin/shorewall and /sbin/shorewall-lite</title>
|
|
|
|
<para><filename>/sbin/shorewall</filename> is the program that you use to
|
|
interact with Shorewall. Normally the root user's PATH includes
|
|
<filename>/sbin</filename> and the program can be run from a shell prompt
|
|
by simply typing <command>shorewall</command> followed by a
|
|
command.</para>
|
|
|
|
<warning>
|
|
<para>In some releases of KDE, the default configuration of the
|
|
<emphasis role="bold">konsole</emphasis> program is brain dead with
|
|
respect to the "Root Console". It executes the command "su" where it
|
|
should execute "su -"; the latter will cause a login shell to be created
|
|
which will in turn set PATH properly. You can correct this problem as
|
|
follows:</para>
|
|
|
|
<orderedlist>
|
|
<listitem>
|
|
<para>Click on "Settings" on the toolbar and select "Configure
|
|
Konsole"</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Select the "Session" tab.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Click on "Root Console"</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Change the Execute command from "su" to "su -"</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Click on "Save Session"</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Click on "Ok"</para>
|
|
</listitem>
|
|
</orderedlist>
|
|
</warning>
|
|
|
|
<para>To see a list of supported commands, use the <command>help</command>
|
|
command:</para>
|
|
|
|
<programlisting><command>shorewall help</command></programlisting>
|
|
|
|
<para>To get further information about a particular command, use the
|
|
<command>man</command> command:</para>
|
|
|
|
<programlisting><command>man shorewall</command>
|
|
</programlisting>
|
|
|
|
<para>The program <emphasis role="bold">/sbin/shorewall-lite</emphasis>
|
|
performs a similar role with Shorewall-lite.</para>
|
|
|
|
<para>For a more complete description of the files and directories
|
|
involved in Shorewall and Shorewall-lite, see the <ulink
|
|
url="Anatomy.html">Shorewall Anatomy article</ulink>.</para>
|
|
</section>
|
|
|
|
<section id="Starting">
|
|
<title>Starting, Stopping and Clearing</title>
|
|
|
|
<para>As explained in the <ulink
|
|
url="Introduction.html">Introduction</ulink>, Shorewall is not something
|
|
that runs all of the time in your system. Nevertheless, for integrating
|
|
Shorewall into your initialization scripts it is useful to speak of
|
|
<firstterm>starting</firstterm> Shorewall and
|
|
<emphasis>stopping</emphasis> Shorewall.</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>Shorewall is started using the <command>shorewall
|
|
start</command> command. Once the start command completes
|
|
successfully, Netfilter is configured as described in your Shorewall
|
|
configuration files. If there is an error during <command>shorewall
|
|
start</command>, then if you have a <firstterm>saved
|
|
configuration</firstterm> then that configuration is restored.
|
|
Otherwise, an implicit <command>shorewall stop</command> is
|
|
executed.</para>
|
|
|
|
<important>
|
|
<para><command>shorewall start</command> is implemented as a
|
|
<firstterm>compile and go</firstterm>; that is, the configuration is
|
|
compiled and if there are no compilation errors then the resulting
|
|
compiled script is executed. If there are compilation errors, the
|
|
command is aborted and the state of the firewall is not
|
|
altered.</para>
|
|
</important>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Shorewall is stopped using the <command>shorewall stop</command>
|
|
command.</para>
|
|
|
|
<important>
|
|
<para>The <command>shorewall stop</command> command does not remove
|
|
all Netfilter rules and open your firewall for all traffic to pass.
|
|
It rather places your firewall in a safe state defined by the
|
|
contents of your <ulink
|
|
url="manpages/shorewall-stoppedrules.html">/etc/shorewall/stoppedrules</ulink>
|
|
file and the setting of ADMINISABSENTMINDED in <ulink
|
|
url="manpages/shorewall.conf.html">/etc/shorewall/shorewall.conf</ulink>.</para>
|
|
</important>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>If you want to remove all Netfilter rules and open your firewall
|
|
for all traffic to pass, use the <command>shorewall clear</command>
|
|
command.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>If you change your configuration and want to install the
|
|
changes, use the <command>shorewall reload </command>command.</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
|
|
<para>For additional information, see the<link linkend="State"> Shorewall
|
|
State Diagram</link> section.</para>
|
|
</section>
|
|
|
|
<section id="Init">
|
|
<title>/etc/init.d/shorewall and /etc/init.d/shorewall-lite</title>
|
|
|
|
<para>Because of the different requirements of distribution packaging
|
|
systems, the behavior of <filename>/etc/init.d/shorewall</filename> and
|
|
<filename>/etc/init.d/shorewall-lite</filename> is not consistent between
|
|
distributions. As an example, when using the distribution Shorewall
|
|
packages on <trademark>Debian</trademark> and
|
|
<trademark>Ubuntu</trademark> systems, running
|
|
<command>/etc/init.d/shorewall stop</command> will actually execute the
|
|
command <command>/sbin/shorewall clear</command> rather than
|
|
<command>/sbin/shorewall stop</command>! So don't expect the meaning of
|
|
<emphasis>start</emphasis>, <emphasis>stop</emphasis>,
|
|
<emphasis>restart</emphasis>, etc. to be consistent between
|
|
<filename>/sbin/shorewall</filename> (or
|
|
<filename>/sbin/shorewall-lite</filename>) and your init scripts unless
|
|
you got your Shorewall package from shorewall.net.</para>
|
|
|
|
<para><emphasis role="bold">Update:</emphasis><blockquote>
|
|
<para>In Shorewall 4.4.0 and later, the tarballs from shorewall.net
|
|
follow the Debian convention when installed on a Debian or Ubuntu
|
|
system. Beginning with Shorewall 4.4.10, you can revert to the prior
|
|
behavior by setting SAFESTOP=1 in
|
|
<filename>/etc/default/shorewall</filename>,
|
|
<filename>/etc/default/shorewall6</filename>, etc.</para>
|
|
</blockquote></para>
|
|
</section>
|
|
|
|
<section id="Trace">
|
|
<title>Tracing Command Execution and other Debugging Aids</title>
|
|
|
|
<para>Shorewall includes features for tracing and debugging. Commands
|
|
involving the compiler can have the word <emphasis
|
|
role="bold">trace</emphasis> inserted immediately after the
|
|
command.</para>
|
|
|
|
<para>Example:</para>
|
|
|
|
<programlisting>shorewall trace check -r</programlisting>
|
|
|
|
<para>This produces a large amount of diagnostic output to standard out
|
|
during the compilation step. If entered on a command that doesn't invoke
|
|
the compiler, <emphasis role="bold">trace</emphasis> is ignored.</para>
|
|
|
|
<para>Commands that invoke a compiled fireawll script can have the word
|
|
debug inserted immediately after the command.</para>
|
|
|
|
<para>Example:</para>
|
|
|
|
<programlisting>shorewall debug restart</programlisting>
|
|
|
|
<para><emphasis role="bold">debug</emphasis> causes altered behavior of
|
|
scripts generated by the Shorewall compiler. These scripts normally use
|
|
ip[6]tables-restore to install the Netfilter ruleset, but with debug, the
|
|
commands normally passed to iptables-restore in its input file are passed
|
|
individually to ip[6]tables. This is a diagnostic aid which allows
|
|
identifying the individual command that is causing ip[6]tables-restore to
|
|
fail; it should be used when ip[6]tables-restore fails when executing a
|
|
COMMIT command.</para>
|
|
|
|
<warning>
|
|
<para>The debug feature is strictly for problem analysis. When debug is
|
|
used:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>The firewall is made 'wide open' before the rules are
|
|
applied.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>The <filename>stoppedrules</filename> file is not
|
|
consulted.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>The rules are applied in the canonical ip[6]tables-restore
|
|
order. So if you need critical hosts to be always available during
|
|
start/restart, you may not be able to use debug.</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</warning>
|
|
</section>
|
|
|
|
<section id="Boot">
|
|
<title>Having Shorewall Start Automatically at Boot Time</title>
|
|
|
|
<para>The .rpm, .deb and .tgz all try to configure your startup scripts so
|
|
that Shorewall will start automatically at boot time. If you are using the
|
|
<command>install.sh </command>script from the .tgz and it cannot determine
|
|
how to configure automatic startup, a message to that effect will be
|
|
displayed. You will need to consult your distribution's documentation to
|
|
see how to integrate the <filename>/etc/init.d/shorewall</filename> script
|
|
into the distribution's startup mechanism.<caution>
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>Shorewall startup is disabled by default. Once you have
|
|
configured your firewall, you can enable startup by editing
|
|
<filename>/etc/shorewall/shorewall.conf</filename> and setting
|
|
STARTUP_ENABLED=Yes.. Note: Users of the .deb package must rather
|
|
edit <filename>/etc/default/shorewall</filename> and set
|
|
<quote>startup=1</quote>.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>If you use dialup or some flavor of PPP where your IP
|
|
address can change arbitrarily, you may want to start the firewall
|
|
in your <command>/etc/ppp/ip-up.local</command> script. I
|
|
recommend just placing <quote><command>/sbin/shorewall
|
|
restart</command></quote> in that script.</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</caution></para>
|
|
</section>
|
|
|
|
<section id="Saved">
|
|
<title>Saving a Working Configuration for Error Recovery and Fast
|
|
Startup</title>
|
|
|
|
<para>Once you have Shorewall working the way that you want it to, you can
|
|
use <command>shorewall save</command> to <firstterm>save</firstterm> the
|
|
commands necessary to recreate that configuration in a <firstterm>restore
|
|
script</firstterm>.</para>
|
|
|
|
<para>In its simplest form, the save command is just:</para>
|
|
|
|
<programlisting><command>shorewall save</command></programlisting>
|
|
|
|
<para>That command creates the default restore script,
|
|
<filename>/var/lib/shorewall/restore</filename>. The default may be
|
|
changed using the RESTOREFILE option in <ulink
|
|
url="manpages/shorewall.conf.html">/etc/shorewall/shorewall.conf</ulink>.
|
|
A different file name may also be specified in the <command>save</command>
|
|
command:</para>
|
|
|
|
<programlisting><command>shorewall save <filename></command></programlisting>
|
|
|
|
<para>Where <<emphasis>filename</emphasis>> is a simple file name
|
|
(no slashes).</para>
|
|
|
|
<para>Once created, the default restore script serves several useful
|
|
purposes:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>If you change your configuration and there is an error when you
|
|
try to restart Shorewall, the restore script will be run to restore
|
|
your firewall to working order.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Bootup is faster (although with Shorewall-perl, the difference
|
|
is minimal). The -f option of the start command (e.g.,
|
|
<command>shorewall -f start</command>) causes Shorewall to look for
|
|
the default restore script and if it exists, the script is run. When
|
|
using Shorewall-shell, this is much faster than starting Shorewall
|
|
using the normal mechanism of reading the configuration files and
|
|
running <command>iptables</command> dozens or even hundreds of
|
|
times.</para>
|
|
|
|
<para>The default is to not use -f. If you wish to change the default,
|
|
you must set the OPTIONS shell variable in either
|
|
<filename>/etc/default/shorewall</filename> or
|
|
<filename>/etc/sysconfig/shorewall</filename> (if your distribution
|
|
provides neither of these files, you must create one or the
|
|
other).</para>
|
|
|
|
<para><emphasis role="bold">Update</emphasis>: In Shorewall 4.4.20, a
|
|
new LEGACY_FASTSTART option was added to <ulink
|
|
url="manpages/shorewall.conf.html">/etc/shorewall/shorewall.conf</ulink>.
|
|
When LEGACY_FASTSTART=No, the compiled script that did the last
|
|
successful <command role="bold">start</command> or <command
|
|
role="bold">restart</command> will be used.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>The <command>shorewall restore</command> command can be used at
|
|
any time to quickly configure the firewall.</para>
|
|
|
|
<programlisting><command>shorewall restore [ <filename> ]</command></programlisting>
|
|
|
|
<para>If no <<emphasis>filename</emphasis>> is given, the
|
|
default restore script is used. Otherwise, the script
|
|
<filename>/var/lib/shorewall/<filename></filename> is
|
|
used.</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
|
|
<para>The ability to have multiple restore scripts means that you can save
|
|
different Shorewall firewall configurations and switch between them
|
|
quickly using the <command>restore</command> command.</para>
|
|
|
|
<para>Restore scripts may be removed using the <command>shorewall
|
|
forget</command> command:</para>
|
|
|
|
<programlisting><command>shorewall forget [ <filename> ]</command></programlisting>
|
|
|
|
<para>If no <<emphasis>filename</emphasis>> is given, the default
|
|
restore script is removed. Otherwise,
|
|
<filename>/var/lib/shorewall/<filename></filename> is removed (of
|
|
course, you can also use the Linux <command>rm</command> command from the
|
|
shell prompt to remove these files).</para>
|
|
</section>
|
|
|
|
<section id="AddDirectories">
|
|
<title>Additional Configuration Directories</title>
|
|
|
|
<para>The CONFIG_PATH setting in
|
|
<filename>/etc/shorewall/shorewall.conf</filename> determines where
|
|
Shorewall looks for configuration files. The default setting is
|
|
CONFIG_PATH=<filename
|
|
class="directory">/etc/shorewall</filename>:<filename
|
|
class="directory">/usr/share/shorewall</filename> which means that
|
|
<filename class="directory">/etc/shorewall</filename> is searched first
|
|
and if the file is not found then <filename
|
|
class="directory">/usr/share/shorewall</filename> is searched. You can
|
|
change the value of CONFIG_PATH to cause additional directories to be
|
|
searched but CONFIG_PATH should <emphasis>always</emphasis> include both
|
|
<filename class="directory">/etc/shorewall</filename> and <filename
|
|
class="directory">/usr/share/shorewall</filename>.</para>
|
|
|
|
<para>When an alternate configuration directory is specified as described
|
|
in the <link linkend="AddDirectories">next section</link>, that directory
|
|
is searched <emphasis>before</emphasis> those directories listed in
|
|
CONFIG_PATH.</para>
|
|
|
|
<para>Example - Search <filename
|
|
class="directory">/etc/shorewall</filename>, <filename
|
|
class="directory">/etc/shorewall/actiondir</filename> and <filename
|
|
class="directory">/usr/share/shorewall</filename> in that order:</para>
|
|
|
|
<programlisting>CONFIG_PATH=/etc/shorewall:/etc/shorewall/actiondir:/usr/share/shorewall</programlisting>
|
|
|
|
<para>The above is the setting that I once used to allow me to place all
|
|
of my user-defined 'action.' files in <filename
|
|
class="directory">/etc/shorewall/actiondir</filename>.</para>
|
|
</section>
|
|
|
|
<section id="AltConfig">
|
|
<title>Alternate Configuration Directories</title>
|
|
|
|
<para>As explained <link linkend="AddDirectories">above</link>, Shorewall
|
|
normally looks for configuration files in the directories specified by the
|
|
CONFIG_PATH option in <filename
|
|
class="directory">/etc/shorewall/shorewall.conf</filename>. The
|
|
<command>shorewall start</command>, <command>shorewall restart</command>,
|
|
<command>shorewall check</command>, and <command>shorewall try
|
|
</command>commands allow you to specify an additional directory for
|
|
Shorewall to check before looking in the directories listed in
|
|
CONFIG_PATH.</para>
|
|
|
|
<programlisting> <command>shorewall {start|restart|check} <configuration-directory></command>
|
|
<command>shorewall try <configuration-directory> [ <timeout> ]</command></programlisting>
|
|
|
|
<para>If a <emphasis><configuration-directory</emphasis>> is
|
|
specified, each time that Shorewall is going to read a file, it will first
|
|
look in the<emphasis> <configuration-directory></emphasis> . If the
|
|
file is present in the
|
|
<emphasis><configuration-directory>,</emphasis> that file will be
|
|
used; otherwise, the directories in the CONFIG_PATH will be searched. When
|
|
changing the configuration of a production firewall, I recommend the
|
|
following:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>If you haven't saved the current working configuration, do so
|
|
using <command>shorewall save</command>.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para><command>mkdir /etc/test</command></para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para><command>cd /etc/test</command></para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para><copy any files that you need to change from /etc/shorewall
|
|
to . and change them here></para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para><command>shorewall check ./</command></para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para><correct any errors found by check and check again></para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para><command>shorewall restart ./</command></para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
|
|
<para>If the <command>restart</command> fails, your configuration will be
|
|
restored to its state at the last <command>shorewall
|
|
save</command>.</para>
|
|
|
|
<para>When the new configuration works then just:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para><command>cp -f * /etc/shorewall</command></para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para><command>cd</command></para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para><command>rm -rf /etc/test</command></para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para><command>shorewall save</command></para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
|
|
<important>
|
|
<para>Shorewall requires that the file
|
|
<filename>/etc/shorewall/shorewall.conf</filename> to always exist.
|
|
Certain global settings are always obtained from that file. If you
|
|
create alternative configuration directories, do not remove
|
|
/etc/shorewall/shorewall.conf.</para>
|
|
</important>
|
|
</section>
|
|
|
|
<section id="Commands">
|
|
<title>Commands</title>
|
|
|
|
<para>The general form of a command is:</para>
|
|
|
|
<blockquote>
|
|
<para><command>shorewall [ <options> ] <command> [
|
|
<command options> ] [ <argument> ... ]</command></para>
|
|
|
|
<para>Available options are:</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term>-c <directory></term>
|
|
|
|
<listitem>
|
|
<para>Specifies an <link linkend="AltConfig">alternate
|
|
configuration directory</link>. Use of this option is
|
|
deprecated.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>-f</term>
|
|
|
|
<listitem>
|
|
<para>Specifies fast restart. See the <command>start</command>
|
|
command below.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>-n</term>
|
|
|
|
<listitem>
|
|
<para>Prevents the command from changing the firewall system's
|
|
routing configuration.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>-q</term>
|
|
|
|
<listitem>
|
|
<para>Reduces the verbosity level (see VERBOSITY setting in <ulink
|
|
url="manpages/shorewall.conf.htmlig">shorewall.conf</ulink>). May
|
|
be repeated (e.g., "-qq") with each instance reducing the
|
|
verbosity level by one.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>-v</term>
|
|
|
|
<listitem>
|
|
<para>Increases the verbosity level (see VERBOSITY setting in
|
|
<ulink
|
|
url="manpages/shorewall.conf.htmlig">shorewall.conf</ulink>). May
|
|
be repeated (e.g., "-vv") with each instance increasing the
|
|
verbosity level by one.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>-x</term>
|
|
|
|
<listitem>
|
|
<para>Causes all iptables -L commands to display actual packet and
|
|
byte counts.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>-t</term>
|
|
|
|
<listitem>
|
|
<para>All progress messages are timestamped with the date and
|
|
time.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
|
|
<para>In addition, the <command>-q</command> and <command>-v</command>
|
|
options may be repeated to make the output less or more verbose
|
|
respectively. The default level of verbosity is determined by the
|
|
setting of the VERBOSITY option in
|
|
<filename>/etc/shorewall/shorewall.conf</filename>.</para>
|
|
|
|
<para>For Shorewall Lite, the general command form is:</para>
|
|
|
|
<para><command>shorewall-lite [ <options> ] <command> [
|
|
<command options> ] [ <argument> ... ]</command></para>
|
|
|
|
<para>where the options are the same as with Shorewall.</para>
|
|
|
|
<para>The complete documentation for each command may be found in the
|
|
<ulink url="manpages/shorewall.html">shorewall</ulink> and <ulink
|
|
url="manpages/shorewall-lite.html">shorewall-lite</ulink> man
|
|
pages.</para>
|
|
</blockquote>
|
|
</section>
|
|
|
|
<section id="State">
|
|
<title>Shorewall State Diagram</title>
|
|
|
|
<para>The Shorewall State Diagram is depicted below.</para>
|
|
|
|
<para><graphic align="center" fileref="images/State_Diagram.png"/></para>
|
|
|
|
<informaltable>
|
|
<tgroup cols="3">
|
|
<thead>
|
|
<row>
|
|
<entry align="center">/sbin/shorewall Command</entry>
|
|
|
|
<entry align="center">Resulting /var/lib/shorewall/firewall
|
|
Command</entry>
|
|
|
|
<entry align="center">Effect if the Command Succeeds</entry>
|
|
</row>
|
|
</thead>
|
|
|
|
<tbody>
|
|
<row>
|
|
<entry>shorewall start</entry>
|
|
|
|
<entry>firewall start</entry>
|
|
|
|
<entry>The system filters packets based on your current Shorewall
|
|
Configuration</entry>
|
|
</row>
|
|
|
|
<row>
|
|
<entry>shorewall stop</entry>
|
|
|
|
<entry>firewall stop</entry>
|
|
|
|
<entry>Only traffic allowed by ACCEPT entries in
|
|
/etc/shorewall/stoppedrules is passed to/from/through the
|
|
firewall. If ADMINISABSENTMINDED=Yes in
|
|
/etc/shorewall/shorewall.conf then in addition, all existing
|
|
connections are retained and all connection requests from the
|
|
firewall are accepted.</entry>
|
|
</row>
|
|
|
|
<row>
|
|
<entry>shorewall reload</entry>
|
|
|
|
<entry>firewall reload</entry>
|
|
|
|
<entry>Very similar to start, replacing the existing ruleset with
|
|
one that reflects the current configuration file contents.</entry>
|
|
</row>
|
|
|
|
<row>
|
|
<entry>shorewall restart</entry>
|
|
|
|
<entry>firewall restart</entry>
|
|
|
|
<entry>Logically equivalent to <quote>firewall stop;firewall
|
|
start</quote></entry>
|
|
</row>
|
|
|
|
<row>
|
|
<entry>shorewall add</entry>
|
|
|
|
<entry>firewall add</entry>
|
|
|
|
<entry>Adds a host or subnet to a dynamic zone</entry>
|
|
</row>
|
|
|
|
<row>
|
|
<entry>shorewall delete</entry>
|
|
|
|
<entry>firewall delete</entry>
|
|
|
|
<entry>Deletes a host or subnet from a dynamic zone</entry>
|
|
</row>
|
|
|
|
<row>
|
|
<entry>shorewall refresh</entry>
|
|
|
|
<entry>firewall refresh</entry>
|
|
|
|
<entry>Reloads rules dealing with static blacklisting, traffic
|
|
control and ECN.</entry>
|
|
</row>
|
|
|
|
<row>
|
|
<entry>shorewall reset</entry>
|
|
|
|
<entry>firewall reset</entry>
|
|
|
|
<entry>Resets traffic counters</entry>
|
|
</row>
|
|
|
|
<row>
|
|
<entry>shorewall clear</entry>
|
|
|
|
<entry>firewall clear</entry>
|
|
|
|
<entry>Removes all Shorewall rules, chains, addresses, routes and
|
|
ARP entries.</entry>
|
|
</row>
|
|
|
|
<row>
|
|
<entry>shorewall try</entry>
|
|
|
|
<entry>firewall -c <new configuration> restart If
|
|
unsuccessful then firewall start (standard configuration) If
|
|
timeout then firewall restart (standard configuration)</entry>
|
|
|
|
<entry/>
|
|
</row>
|
|
</tbody>
|
|
</tgroup>
|
|
</informaltable>
|
|
|
|
<para>The only time that a program other than
|
|
<command>/usr/share/shorewall[-lite[/firewall</command> performs a state
|
|
transition itself is when the <command>shorewall[-lite] restore</command>
|
|
command is executed. In that case, the
|
|
<command>/var/lib/shorewall[-lite]/restore</command> program sets the
|
|
state to "Started".</para>
|
|
|
|
<para>With any command that involves compilation, there is no state
|
|
transition while the compiler is running. If compilation fails, the state
|
|
remains unchanged.</para>
|
|
|
|
<para>Also, <command>shorewall start</command>, <command>shorewall
|
|
reload</command> and <command>shorewall restart</command> involve
|
|
compilation followed by execution of the compiled script. So it is the
|
|
compiled script that performs the state transition in these commands
|
|
rather than <command>/usr/share/shorewall/firewall</command>.</para>
|
|
|
|
<para>The compiled script is placed in <filename
|
|
class="directory">/var/lib/shorewall</filename> and is named either
|
|
<filename>.start</filename>, .reload or <filename>.restart</filename>
|
|
depending on the command.</para>
|
|
</section>
|
|
</article>
|