forked from extern/shorewall_code
0f085fcf23
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@480 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
82 lines
2.7 KiB
Plaintext
Executable File
82 lines
2.7 KiB
Plaintext
Executable File
This is a major release of Shorewall.
|
|
|
|
Function from 1.3 that has been omitted from this version includes:
|
|
|
|
1) The MERGE_HOSTS variable in shorewall.conf is no longer
|
|
supported. Shorewall 1.4 behavior is the same as 1.3 with
|
|
MERGE_HOSTS=Yes.
|
|
|
|
2) Interface names of the form <device>:<integer> in
|
|
/etc/shorewall/interfaces now generate an error.
|
|
|
|
3) Shorewall 1.4 implements behavior consistent with
|
|
OLD_PING_HANDLING=No. OLD_PING_HANDLING=Yes will generate an error
|
|
at startup as will specification of the 'noping' or 'filterping'
|
|
interface options.
|
|
|
|
4) The 'routestopped' option in the /etc/shorewall/interfaces and
|
|
/etc/shorewall/hosts files is no longer supported and will generate
|
|
an error at startup if specified.
|
|
|
|
5) The Shorewall 1.2 syntax for DNAT and REDIRECT rules is no longer
|
|
accepted.
|
|
|
|
6) The ALLOWRELATED variable in shorewall.conf is no longer
|
|
supported. Shorewall 1.4 behavior is the same as 1.3 with
|
|
ALLOWRELATED=Yes.
|
|
|
|
7) The 'multi' interface option is no longer supported. Shorewall will
|
|
generate rules for sending packets back out the same interface
|
|
that they arrived on in two cases:
|
|
|
|
a) There is an _explicit_ policy for the source zone to the
|
|
destination zone. An explicit policy names both zones and does not
|
|
use the 'all' reserved word.
|
|
|
|
b) There are one or more rules for traffic for the source zone to
|
|
or from the destination zone including rules that use the 'all'
|
|
reserved word. Exception: If the source and the destination are
|
|
the same zone then the rule must be explicit - it must name the zone
|
|
in both the SOURCE and DESTINATION columns.
|
|
|
|
Changes for 1.4 include:
|
|
|
|
1) shorewall.conf has been completely reorganized into logical
|
|
sections.
|
|
|
|
2) LOG is now a valid action for a rule (/etc/shorewall/rules).
|
|
|
|
3) The firewall script and version file are now installed in
|
|
/usr/share/shorewall.
|
|
|
|
4. Late arriving DNS replies are now silently dropped in the common
|
|
chain by default.
|
|
|
|
5) In addition to behaving like OLD_PING_HANDLING=No, Shorewall 1.4 no
|
|
longer unconditionally accepts outbound ICMP packets. So if you want
|
|
to 'ping' from the firewall, you will need the appropriate rule or
|
|
policy.
|
|
|
|
6) CONTINUE is now a valid action for a rule (/etc/shorewall/rules).
|
|
|
|
7) 802.11b devices with names of the form wlan<n> now support the
|
|
'maclist' option.
|
|
|
|
8) IMPORTANT: Shorewall now REQUIRES the iproute package ('ip'
|
|
utility).
|
|
|
|
9) Explicit Congestion Notification (ECN - RFC 3168) may now be turned
|
|
off on a host or network basis using the new /etc/shorewall/ecn
|
|
file. To use this facility:
|
|
|
|
a) You must be running kernel 2.4.20
|
|
b) You must have applied the patch in
|
|
http://www.shorewall/net/pub/shorewall/ecn/patch.
|
|
c) You must have iptables 1.2.7a installed.
|
|
|
|
|
|
|
|
|
|
|
|
|