forked from extern/shorewall_code
a83fbadf98
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@7702 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
116 lines
4.1 KiB
Plaintext
116 lines
4.1 KiB
Plaintext
Shorewall 4.1 Patch Release 0.
|
|
|
|
----------------------------------------------------------------------------
|
|
R E L E A S E 4 . 1 H I G H L I G H T S
|
|
----------------------------------------------------------------------------
|
|
1) Support is included for multiple internet providers through the same
|
|
ethernet interface.
|
|
|
|
2) Support for NFLOG has been added.
|
|
|
|
Problems corrected in Shorewall 4.1.1.
|
|
|
|
1) Previously, incorrect output was generated by parameter lists to
|
|
ULOG or NFLOG.
|
|
|
|
2) Specifying NFQUEUE(<queue-number>) in the POLICY column of the
|
|
policy file resulted in an error.
|
|
|
|
|
|
Other changes in Shorewall 4.1.1.
|
|
|
|
None.
|
|
|
|
New Features in Shorewall 4.1.
|
|
|
|
1) Shorewall 4.1.0 contains experimental support for multiple Internet
|
|
providers through a single ethernet interface. Configuring two
|
|
providers through a single interface differs from two providers
|
|
through two interfaces in several ways.
|
|
|
|
a) Only ethernet (or ethernet-like) interfaces can be used. For
|
|
inbound traffic, the MAC addresses of the gateway routers is used
|
|
to determine which provider a packet was received through. Note
|
|
that only routed traffic can be categorized using this technique.
|
|
|
|
b) The 'shared' provider option must be specified for both providers.
|
|
|
|
c) Entries in /etc/shorewall/masq must be qualified by the provider
|
|
name (or number).
|
|
|
|
d) This feature requires Realm Match support in your kernel and
|
|
iptables. If you use a capabilities file, you need to regenerate
|
|
the file with Shorewall 4.0.6 or Shorewall-lite 4.0.6.
|
|
|
|
Example:
|
|
|
|
Providers Blarg (1) and Avvanta (2) are both connected to
|
|
eth0. The firewall's IP address with Blarg is 206.124.146.176
|
|
(gateway 206.124.146.254) and the IP address from Avvanta is
|
|
130.252.144.8 (gateway 130.252.144.254).
|
|
|
|
/etc/shorewall/providers:
|
|
|
|
#PROVIDER NUMBER MARK DUPLICATE GATEWAY OPTIONS
|
|
Blarg 1 1 main 206.124.146.254 shared,...
|
|
Avvanta 2 2 main 130.252.144.254 shared,...
|
|
|
|
/etc/shorewall/masq:
|
|
|
|
#INTERFACE SOURCE ADDRESS
|
|
eth0(Blarg) 130.252.144.254 206.124.146.176
|
|
eth0(Avvanta) 206.124.146.176 130.252.144.254
|
|
eth0(Blarg) eth1 206.124.146.176
|
|
eth0(Avvanta) eth1 130.252.144.254
|
|
|
|
2) You may now include the name of a table (nat, mangle or filter) in
|
|
a 'shorewall refresh' command by following the name with a colon
|
|
(e.g., mangle:). This causes all non-builtin chains in the table to
|
|
be reloaded.
|
|
|
|
Example:
|
|
|
|
shorewall refresh nat:
|
|
|
|
3) When no chain name is given to the 'shorewall refresh' command, the
|
|
mangle table is refreshed along with the blacklist chain (if
|
|
any). This allows you to modify /etc/shorewall/tcrules and install
|
|
the changes using 'shorewall refresh'.
|
|
|
|
4) Support for the NFLOG log target has been added. NFLOG is a
|
|
successor to ULOG. In addition, both ULOG and NFLOG may be followed
|
|
by a list of up to three numbers in parentheses.
|
|
|
|
The first number specifies the netlink group (1-32). If omitted
|
|
(e.g., NFLOG(,0,10)) then a value of 1 is assumed.
|
|
|
|
The second number specifies the maximum number of bytes to copy. If
|
|
omitted, 0 (no limit) is assumed.
|
|
|
|
The third number specifies the number of log messages that should
|
|
be buffered in the kernel before they are sent to user space. The
|
|
default is 1.
|
|
|
|
Examples:
|
|
|
|
/etc/shorewall/shorewall.conf:
|
|
|
|
MACLIST_LOG_LEVEL=NFLOG(1,0,1)
|
|
|
|
/etc/shorewall/rules:
|
|
|
|
ACCEPT:NFLOG(1,0,1) vpn fw tcp ssh,time,631,8080
|
|
|
|
5) Shorewall-perl 4.1.0 implements an alternative syntax for macro
|
|
parameters and for the NFQUEUE queue number. Rather than following
|
|
the macro name (or NFQUEUE) with a slash ("/") and the parameter,
|
|
the parameter may be enclosed in parentheses.
|
|
|
|
Examples -- each pair shown below are equivalent:
|
|
|
|
DNS/ACCEPT DNS(ACCEPT)
|
|
NFQUEUE/3 NFQUEUE(3)
|
|
|
|
The old syntax is still be accepted but will cease to be documented
|
|
in some future Shorewall release.
|