forked from extern/shorewall_code
b56fd26640
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@427 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
2262 lines
122 KiB
HTML
2262 lines
122 KiB
HTML
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||
<html>
|
||
<head>
|
||
|
||
|
||
|
||
<meta http-equiv="Content-Type"
|
||
content="text/html; charset=windows-1252">
|
||
<title>Shorewall News</title>
|
||
|
||
|
||
|
||
|
||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||
|
||
|
||
|
||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||
</head>
|
||
<body>
|
||
|
||
|
||
<table border="0" cellpadding="0" cellspacing="0"
|
||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||
id="AutoNumber1" bgcolor="#400169" height="90">
|
||
<tbody>
|
||
<tr>
|
||
<td width="100%">
|
||
|
||
|
||
|
||
|
||
<h1 align="center"><font color="#ffffff">Shorewall News Archive</font></h1>
|
||
</td>
|
||
</tr>
|
||
|
||
|
||
|
||
</tbody>
|
||
</table>
|
||
|
||
|
||
<p><b>1/28/2003 - Shorewall 1.3.14-Beta2</b></p>
|
||
|
||
<p>Includes the Beta 1 content plus restores VLAN device names of the form
|
||
$dev.$vid (e.g., eth0.1)</p>
|
||
|
||
<p><b>1/25/2003 - Shorewall 1.3.14-Beta1</b><br>
|
||
</p>
|
||
|
||
<p>The Beta includes the following changes:<br>
|
||
</p>
|
||
|
||
<ol>
|
||
<li>An OLD_PING_HANDLING option has been added to shorewall.conf. When
|
||
set to Yes, Shorewall ping handling is as it has always been (see http://www.shorewall.net/ping.html).<br>
|
||
<br>
|
||
When OLD_PING_HANDLING=No, icmp echo (ping) is handled via rules and policies
|
||
just like any other connection request. The FORWARDPING=Yes option in shorewall.conf
|
||
and the 'noping' and 'filterping' options in /etc/shorewall/interfaces will
|
||
all generate an error.<br>
|
||
<br>
|
||
</li>
|
||
<li>It is now possible to direct Shorewall to create a "label" such as<61>
|
||
"eth0:0" for IP addresses that it creates under ADD_IP_ALIASES=Yes and ADD_SNAT_ALIASES=Yes.
|
||
This is done by specifying the label instead of just the interface name:<br>
|
||
<20><br>
|
||
<20><> a) In the INTERFACE column of /etc/shorewall/masq<br>
|
||
<20><> b) In the INTERFACE column of /etc/shorewall/nat<br>
|
||
<20></li>
|
||
<li>When an interface name is entered in the SUBNET column of the /etc/shorewall/masq
|
||
file, Shorewall previously masqueraded traffic from only the first subnet
|
||
defined on that interface. It did not masquerade traffic from:<br>
|
||
<20><br>
|
||
<20><> a) The subnets associated with other addresses on the interface.<br>
|
||
<20><> b) Subnets accessed through local routers.<br>
|
||
<20><br>
|
||
Beginning with Shorewall 1.3.14, if you enter an interface name in the
|
||
SUBNET column, shorewall will use the firewall's routing table to construct
|
||
the masquerading/SNAT rules.<br>
|
||
<20><br>
|
||
Example 1 -- This is how it works in 1.3.14.<br>
|
||
<20><> <br>
|
||
|
||
<pre><EFBFBD><EFBFBD> [root@gateway test]# cat /etc/shorewall/masq<br> #INTERFACE<43><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> SUBNET<45><54><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ADDRESS<br> eth0<68><30><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> eth2<68><32><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
||
|
||
<pre><EFBFBD> [root@gateway test]# ip route show dev eth2<br> 192.168.1.0/24<32> scope link<br> 192.168.10.0/24<32> proto kernel<65> scope link<6E> src 192.168.10.254<br></pre>
|
||
|
||
<pre><EFBFBD> [root@gateway test]# shorewall start<br> ...<br> Masqueraded Subnets and Hosts:<br> To 0.0.0.0/0 from 192.168.1.0/24 through eth0 using 206.124.146.176<br> To 0.0.0.0/0 from 192.168.10.0/24 through eth0 using 206.124.146.176<br> Processing /etc/shorewall/tos...</pre>
|
||
<20><br>
|
||
When upgrading to Shorewall 1.3.14, if you have multiple local subnets
|
||
connected to an interface that is specified in the SUBNET column of an /etc/shorewall/masq
|
||
entry, your /etc/shorewall/masq file will need changing. In most cases,
|
||
you will simply be able to remove redundant entries. In some cases though,
|
||
you might want to change from using the interface name to listing specific
|
||
subnetworks if the change described above will cause masquerading to occur
|
||
on subnetworks that you don't wish to masquerade.<br>
|
||
<20><br>
|
||
Example 2 -- Suppose that your current config is as follows:<br>
|
||
<20><> <br>
|
||
|
||
<pre><EFBFBD><EFBFBD> [root@gateway test]# cat /etc/shorewall/masq<br> #INTERFACE<43><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> SUBNET<45><54><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ADDRESS<br> eth0<68><30><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> eth2<68><32><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 206.124.146.176<br> eth0<68><30><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 192.168.10.0/24<32><34><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
||
|
||
<pre><EFBFBD><EFBFBD> [root@gateway test]# ip route show dev eth2<br> 192.168.1.0/24<32> scope link<br> 192.168.10.0/24<32> proto kernel<65> scope link<6E> src 192.168.10.254<br> [root@gateway test]#</pre>
|
||
<20><br>
|
||
<20><> In this case, the second entry in /etc/shorewall/masq is no longer required.<br>
|
||
<20><br>
|
||
Example 3 -- What if your current configuration is like this?<br>
|
||
<20><br>
|
||
|
||
<pre><EFBFBD><EFBFBD> [root@gateway test]# cat /etc/shorewall/masq<br> #INTERFACE<43><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> SUBNET<45><54><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ADDRESS<br> eth0<68><30><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> eth2<68><32><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
||
|
||
<pre><EFBFBD><EFBFBD> [root@gateway test]# ip route show dev eth2<br> 192.168.1.0/24<32> scope link<br> 192.168.10.0/24<32> proto kernel<65> scope link<6E> src 192.168.10.254<br> [root@gateway test]#</pre>
|
||
<20><br>
|
||
<20><> In this case, you would want to change the entry in<69> /etc/shorewall/masq
|
||
to:<br>
|
||
|
||
<pre><EFBFBD><EFBFBD> #INTERFACE<43><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> SUBNET<45><54><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ADDRESS<br> eth0<68><30><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 192.168.1.0/24<32><34><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 206.124.146.176<br> #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
||
<b> </b></li>
|
||
|
||
</ol>
|
||
|
||
<p><b>1/18/2003 - Shorewall 1.3.13 Documentation in PDF Format</b></p>
|
||
|
||
<p>Juraj Ontkanin has produced a PDF containing the Shorewall 1.3.13 documenation.
|
||
the PDF may be downloaded from</p>
|
||
<20><><EFBFBD> <a
|
||
href="ftp://slovakia.shorewall.net/mirror/shorewall/pdf/"
|
||
target="_self">ftp://slovakia.shorewall.net/mirror/shorewall/pdf/</a><br>
|
||
<20><><EFBFBD> <a
|
||
href="http://slovakia.shorewall.net/pub/shorewall/pdf/">http://slovakia.shorewall.net/pub/shorewall/pdf/</a>
|
||
|
||
<p><b>1/17/2003 - shorewall.net has MOVED</b><b><EFBFBD></b></p>
|
||
|
||
<p>Thanks to the generosity of Alex Martin and <a
|
||
href="http://www.rettc.com">Rett Consulting</a>, www.shorewall.net and ftp.shorewall.net
|
||
are now hosted on a system in Bellevue, Washington. A big thanks to Alex
|
||
for making this happen.<br>
|
||
</p>
|
||
|
||
<p><b>1/13/2003 - Shorewall 1.3.13<br>
|
||
</b></p>
|
||
|
||
<p>Just includes a few things that I had on the burner:<br>
|
||
</p>
|
||
|
||
<ol>
|
||
<li>A new 'DNAT-' action has been added for entries in the /etc/shorewall/rules
|
||
file. DNAT- is intended for advanced users who wish to minimize the number
|
||
of rules that connection requests must traverse.<br>
|
||
<br>
|
||
A Shorewall DNAT rule actually generates two iptables rules: a header
|
||
rewriting rule in the 'nat' table and an ACCEPT rule in the 'filter' table.
|
||
A DNAT- rule only generates the first of these rules. This is handy when
|
||
you have several DNAT rules that would generate the same ACCEPT rule.<br>
|
||
<br>
|
||
<20><> Here are three rules from my previous rules file:<br>
|
||
<br>
|
||
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> DNAT<41><54> net<65> dmz:206.124.146.177 tcp smtp - 206.124.146.178<br>
|
||
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> DNAT<41><54> net<65> dmz:206.124.146.177 tcp smtp - 206.124.146.179<br>
|
||
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ACCEPT net<65> dmz:206.124.146.177 tcp www,smtp,ftp,...<br>
|
||
<br>
|
||
<20><> These three rules ended up generating _three_ copies of<br>
|
||
<br>
|
||
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ACCEPT net<65> dmz:206.124.146.177 tcp smtp<br>
|
||
<br>
|
||
<20><> By writing the rules this way, I end up with only one copy of the
|
||
ACCEPT rule.<br>
|
||
<br>
|
||
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> DNAT-<2D> net<65> dmz:206.124.146.177 tcp smtp -<2D> 206.124.146.178<br>
|
||
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> DNAT-<2D> net<65> dmz:206.124.146.177 tcp smtp -<2D> 206.124.146.179<br>
|
||
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ACCEPT net<65> dmz:206.124.146.177 tcp www,smtp,ftp,....<br>
|
||
<br>
|
||
</li>
|
||
<li>The 'shorewall check' command now prints out the applicable policy
|
||
between each pair of zones.<br>
|
||
<br>
|
||
</li>
|
||
<li>A new CLEAR_TC option has been added to shorewall.conf. If this
|
||
option is set to 'No' then Shorewall won't clear the current traffic control
|
||
rules during [re]start. This setting is intended for use by people that
|
||
prefer to configure traffic shaping when the network interfaces come up rather
|
||
than when the firewall is started. If that is what you want to do, set TC_ENABLED=Yes
|
||
and CLEAR_TC=No and do not supply an /etc/shorewall/tcstart file. That
|
||
way, your traffic shaping rules can still use the 'fwmark' classifier based
|
||
on packet marking defined in /etc/shorewall/tcrules.<br>
|
||
<br>
|
||
</li>
|
||
<li>A new SHARED_DIR variable has been added that allows distribution
|
||
packagers to easily move the shared directory (default /usr/lib/shorewall).
|
||
Users should never have a need to change the value of this shorewall.conf
|
||
setting.<br>
|
||
</li>
|
||
|
||
</ol>
|
||
|
||
<p><b>1/6/2003 - <big><big><big>BURNOUT</big></big></big></b><b>
|
||
</b></p>
|
||
|
||
<p><b>Until further notice, I will not be involved in either Shorewall Development
|
||
or Shorewall Support</b></p>
|
||
|
||
<p><b>-Tom Eastep</b><br>
|
||
</p>
|
||
|
||
<p><b>12/30/2002 - Shorewall Documentation in PDF Format</b></p>
|
||
|
||
<p>Juraj Ontkanin has produced a PDF containing the Shorewall 1.3.12 documenation.
|
||
the PDF may be downloaded from</p>
|
||
|
||
<p><EFBFBD><EFBFBD><EFBFBD> <a href="ftp://slovakia.shorewall.net/mirror/shorewall/pdf/"
|
||
target="_self">ftp://slovakia.shorewall.net/mirror/shorewall/pdf/</a><br>
|
||
<20><><EFBFBD> <a
|
||
href="http://slovakia.shorewall.net/pub/shorewall/pdf/">http://slovakia.shorewall.net/pub/shorewall/pdf/</a><br>
|
||
</p>
|
||
|
||
<p><b>12/27/2002 - Shorewall 1.3.12 Released</b></p>
|
||
|
||
<p> Features include:<br>
|
||
</p>
|
||
|
||
<ol>
|
||
<li>"shorewall refresh" now reloads the traffic shaping rules
|
||
(tcrules and tcstart).</li>
|
||
<li>"shorewall debug [re]start" now turns off debugging after
|
||
an error occurs. This places the point of the failure near the end of
|
||
the trace rather than up in the middle of it.</li>
|
||
<li>"shorewall [re]start" has been speeded up by more than 40%
|
||
with my configuration. Your milage may vary.</li>
|
||
<li>A "shorewall show classifiers" command has been added which
|
||
shows the current packet classification filters. The output from this
|
||
command is also added as a separate page in "shorewall monitor"</li>
|
||
<li>ULOG (must be all caps) is now accepted as a valid syslog
|
||
level and causes the subject packets to be logged using the ULOG target
|
||
rather than the LOG target. This allows you to run ulogd (available
|
||
from <a href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
||
and log all Shorewall messages <a href="shorewall_logging.html">to
|
||
a separate log file</a>.</li>
|
||
<li>If you are running a kernel that has a FORWARD chain in the
|
||
mangle table ("shorewall show mangle" will show you the chains in the
|
||
mangle table), you can set MARK_IN_FORWARD_CHAIN=Yes in <a
|
||
href="Documentation.htm#Conf">shorewall.conf</a>. This allows for marking
|
||
input packets based on their destination even when you are using Masquerading
|
||
or SNAT.</li>
|
||
<li>I have cluttered up the /etc/shorewall directory with empty
|
||
'init', 'start', 'stop' and 'stopped' files. If you already have a
|
||
file with one of these names, don't worry -- the upgrade process won't
|
||
overwrite your file.</li>
|
||
<li>I have added a new RFC1918_LOG_LEVEL variable to <a
|
||
href="Documentation.htm#Conf">shorewall.conf</a>. This variable specifies
|
||
the syslog level at which packets are logged as a result of entries in
|
||
the /etc/shorewall/rfc1918 file. Previously, these packets were always
|
||
logged at the 'info' level.<br>
|
||
</li>
|
||
|
||
</ol>
|
||
|
||
<p><b>12/20/2002 - Shorewall 1.3.12 Beta 3<br>
|
||
</b></p>
|
||
This version corrects a problem with Blacklist logging. In Beta
|
||
2, if BLACKLIST_LOG_LEVEL was set to anything but ULOG, the firewall would
|
||
fail to start and "shorewall refresh" would also fail.<br>
|
||
|
||
<p><b>12/20/2002 - Shorewall 1.3.12 Beta 2</b></p>
|
||
|
||
<p>The first public Beta version of Shorewall 1.3.12 is now available (Beta
|
||
1 was made available only to a limited audience).<br>
|
||
</p>
|
||
Features include:<br>
|
||
|
||
<ol>
|
||
<li>"shorewall refresh" now reloads the traffic shaping rules
|
||
(tcrules and tcstart).</li>
|
||
<li>"shorewall debug [re]start" now turns off debugging after
|
||
an error occurs. This places the point of the failure near the end of
|
||
the trace rather than up in the middle of it.</li>
|
||
<li>"shorewall [re]start" has been speeded up by more than
|
||
40% with my configuration. Your milage may vary.</li>
|
||
<li>A "shorewall show classifiers" command has been added
|
||
which shows the current packet classification filters. The output from
|
||
this command is also added as a separate page in "shorewall monitor"</li>
|
||
<li>ULOG (must be all caps) is now accepted as a valid syslog
|
||
level and causes the subject packets to be logged using the ULOG target
|
||
rather than the LOG target. This allows you to run ulogd (available
|
||
from <a href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
||
and log all Shorewall messages <a href="shorewall_logging.html">to
|
||
a separate log file</a>.</li>
|
||
<li>If you are running a kernel that has a FORWARD chain
|
||
in the mangle table ("shorewall show mangle" will show you the chains
|
||
in the mangle table), you can set MARK_IN_FORWARD_CHAIN=Yes in shorewall.conf.
|
||
This allows for marking input packets based on their destination even
|
||
when you are using Masquerading or SNAT.</li>
|
||
<li>I have cluttered up the /etc/shorewall directory with
|
||
empty 'init', 'start', 'stop' and 'stopped' files. If you already have
|
||
a file with one of these names, don't worry -- the upgrade process won't
|
||
overwrite your file.</li>
|
||
|
||
</ol>
|
||
You may download the Beta from:<br>
|
||
|
||
<blockquote><a href="http://www.shorewall.net/pub/shorewall/Beta">http://www.shorewall.net/pub/shorewall/Beta</a><br>
|
||
<a href="ftp://ftp.shorewall.net/pub/shorewall/Beta"
|
||
target="_top">ftp://ftp.shorewall.net/pub/shorewall/Beta</a><br>
|
||
</blockquote>
|
||
|
||
<p><b>12/12/2002 - Mandrake Multi Network Firewall <a
|
||
href="http://www.mandrakesoft.com"><img src="images/logo2.png"
|
||
alt="Powered by Mandrake Linux" width="140" height="21" border="0">
|
||
</a></b></p>
|
||
Shorewall is at the center of MandrakeSoft's recently-announced
|
||
<a
|
||
href="http://www.mandrakestore.com/mdkinc/index.php?PAGE=tab_0/menu_0.php&id_art=250&LANG_=en#GOTO_250">Multi
|
||
Network Firewall (MNF)</a> product. Here is the <a
|
||
href="http://www.mandrakesoft.com/company/press/pr?n=/pr/products/2403">press
|
||
release</a>.<br>
|
||
|
||
<p><b>12/7/2002 - Shorewall Support for Mandrake 9.0</b></p>
|
||
|
||
<p>Two months and 3 days after I ordered Mandrake 9.0, it was finally delivered.
|
||
I have installed 9.0 on one of my systems and I am now in a position
|
||
to support Shorewall users who run Mandrake 9.0.</p>
|
||
|
||
<p><b>12/6/2002 - Debian 1.3.11a Packages Available<br>
|
||
</b></p>
|
||
|
||
<p>Apt-get sources listed at <a
|
||
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html.</a></p>
|
||
|
||
<p><b>12/3/2002 - Shorewall 1.3.11a</b></p>
|
||
|
||
<p>This is a bug-fix roll up which includes Roger Aich's fix for DNAT with
|
||
excluded subnets (e.g., "DNAT foo!bar ..."). Current 1.3.11 users
|
||
who don't need rules of this type need not upgrade to 1.3.11.</p>
|
||
|
||
<p><b>11/24/2002 - Shorewall 1.3.11</b></p>
|
||
|
||
<p>In this version:</p>
|
||
|
||
<ul>
|
||
<li>A 'tcpflags' option has been added to entries
|
||
in <a href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>.
|
||
This option causes Shorewall to make a set of sanity check on TCP packet
|
||
header flags.</li>
|
||
<li>It is now allowed to use 'all' in the SOURCE or
|
||
DEST column in a <a href="Documentation.htm#Rules">rule</a>.
|
||
When used, 'all' must appear by itself (in may not be qualified) and
|
||
it does not enable intra-zone traffic. For example, the rule <br>
|
||
<br>
|
||
<20> <20> ACCEPT loc all tcp 80<br>
|
||
<br>
|
||
does not enable http traffic from 'loc' to 'loc'.</li>
|
||
<li>Shorewall's use of the 'echo' command is now compatible
|
||
with bash clones such as ash and dash.</li>
|
||
<li>fw->fw policies now generate a startup error.
|
||
fw->fw rules generate a warning and are ignored</li>
|
||
|
||
</ul>
|
||
|
||
<p><b>11/14/2002 - Shorewall Documentation in PDF Format</b></p>
|
||
|
||
<p>Juraj Ontkanin has produced a PDF containing the Shorewall 1.3.10 documenation.
|
||
the PDF may be downloaded from</p>
|
||
|
||
<p><EFBFBD><EFBFBD><EFBFBD> <a href="ftp://slovakia.shorewall.net/mirror/shorewall/pdf/"
|
||
target="_self">ftp://slovakia.shorewall.net/mirror/shorewall/pdf/</a><br>
|
||
<20><><EFBFBD> <a
|
||
href="http://slovakia.shorewall.net/pub/shorewall/pdf/">http://slovakia.shorewall.net/pub/shorewall/pdf/</a><br>
|
||
</p>
|
||
|
||
<p><b>11/09/2002 - Shorewall is Back at SourceForge</b><b>
|
||
</b></p>
|
||
|
||
|
||
<p>The main Shorewall 1.3 web site is now back at SourceForge at <a
|
||
href="http://shorewall.sf.net" target="_top">http://shorewall.sf.net</a>.<br>
|
||
</p>
|
||
|
||
|
||
<p><b>11/09/2002 - Shorewall 1.3.10</b></p>
|
||
|
||
<p>In this version:</p>
|
||
|
||
<ul>
|
||
<li>You may now <a href="IPSEC.htm#Dynamic">define
|
||
the contents of a zone dynamically</a> with the <a
|
||
href="starting_and_stopping_shorewall.htm">"shorewall add" and "shorewall
|
||
delete" commands</a>. These commands are expected to be used
|
||
primarily within <a
|
||
href="http://www.xs4all.nl/%7Efreeswan/">FreeS/Wan</a> updown scripts.</li>
|
||
<li>Shorewall can now do<a
|
||
href="MAC_Validation.html"> MAC verification</a> on ethernet
|
||
segments. You can specify the set of allowed MAC addresses on the
|
||
segment and you can optionally tie each MAC address to one or more
|
||
IP addresses.</li>
|
||
<li>PPTP Servers and Clients running on the firewall
|
||
system may now be defined in the<a href="PPTP.htm"> /etc/shorewall/tunnels</a>
|
||
file.</li>
|
||
<li>A new 'ipsecnat' tunnel type is supported for
|
||
use when the <a href="IPSEC.htm">remote IPSEC endpoint is
|
||
behind a NAT gateway</a>.</li>
|
||
<li>The PATH used by Shorewall may now be specified
|
||
in <a href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf.</a></li>
|
||
<li>The main firewall script is now /usr/lib/shorewall/firewall.
|
||
The script in /etc/init.d/shorewall is very small and uses /sbin/shorewall
|
||
to do the real work. This change makes custom distributions such
|
||
as for Debian and for Gentoo easier to manage since it is /etc/init.d/shorewall
|
||
that tends to have distribution-dependent code</li>
|
||
|
||
</ul>
|
||
|
||
<p><b>10/24/2002 - Shorewall is now in Gentoo Linux</b><b> </b><a
|
||
href="http://www.gentoo.org"><br>
|
||
</a></p>
|
||
Alexandru Hartmann reports that his Shorewall package
|
||
is now a part of <a href="http://www.gentoo.org">the Gentoo Linux
|
||
distribution</a>. Thanks Alex!<br>
|
||
|
||
<p><b>10/23/2002 - Shorewall 1.3.10 Beta 1</b><b> </b></p>
|
||
In this version:<br>
|
||
|
||
<ul>
|
||
<li>You may now <a href="IPSEC.htm#Dynamic">define
|
||
the contents of a zone dynamically</a> with the <a
|
||
href="starting_and_stopping_shorewall.htm">"shorewall add" and "shorewall
|
||
delete" commands</a>. These commands are expected to be used
|
||
primarily within <a
|
||
href="http://www.xs4all.nl/%7Efreeswan/">FreeS/Wan</a> updown
|
||
scripts.</li>
|
||
<li>Shorewall can now do<a
|
||
href="MAC_Validation.html"> MAC verification</a> on ethernet segments.
|
||
You can specify the set of allowed MAC addresses on the segment
|
||
and you can optionally tie each MAC address to one or more IP addresses.</li>
|
||
<li>PPTP Servers and Clients running on the firewall
|
||
system may now be defined in the<a href="PPTP.htm"> /etc/shorewall/tunnels</a>
|
||
file.</li>
|
||
<li>A new 'ipsecnat' tunnel type is supported
|
||
for use when the <a href="IPSEC.htm">remote IPSEC endpoint
|
||
is behind a NAT gateway</a>.</li>
|
||
<li>The PATH used by Shorewall may now be specified
|
||
in <a href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf.</a></li>
|
||
<li>The main firewall script is now /usr/lib/shorewall/firewall.
|
||
The script in /etc/init.d/shorewall is very small and uses /sbin/shorewall
|
||
to do the real work. This change makes custom distributions such
|
||
as for Debian and for Gentoo easier to manage since it is /etc/init.d/shorewall
|
||
that tends to have distribution-dependent code.</li>
|
||
|
||
</ul>
|
||
You may download the Beta from:<br>
|
||
|
||
<ul>
|
||
<li><a
|
||
href="http://www.shorewall.net/pub/shorewall/Beta">http://www.shorewall.net/pub/shorewall/Beta</a></li>
|
||
<li><a
|
||
href="ftp://ftp.shorewall.net/pub/shorewall/Beta" target="_top">ftp://ftp.shorewall.net/pub/shorewall/Beta</a></li>
|
||
|
||
</ul>
|
||
|
||
<p><b>10/10/2002 - <20>Debian 1.3.9b Packages Available<br>
|
||
</b></p>
|
||
|
||
<p>Apt-get sources listed at <a
|
||
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html.</a></p>
|
||
|
||
<p><b>10/9/2002 - Shorewall 1.3.9b</b></p>
|
||
This release rolls up fixes to the installer and
|
||
to the firewall script.<br>
|
||
|
||
<p><b>10/6/2002 - Shorewall.net now running on RH8.0<br>
|
||
</b><br>
|
||
The firewall and server here at shorewall.net
|
||
are now running RedHat release 8.0.<br>
|
||
<b><br>
|
||
9/30/2002 - Shorewall 1.3.9a</b></p>
|
||
Roles up the fix for broken tunnels.<br>
|
||
|
||
<p><b>9/30/2002 - TUNNELS Broken in 1.3.9!!!</b></p>
|
||
There is an updated firewall script at <a
|
||
href="ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall"
|
||
target="_top">ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall</a>
|
||
-- copy that file to /usr/lib/shorewall/firewall.<br>
|
||
|
||
<p><b>9/28/2002 - Shorewall 1.3.9</b></p>
|
||
|
||
<p>In this version:<br>
|
||
</p>
|
||
|
||
<ul>
|
||
<li><a
|
||
href="configuration_file_basics.htm#dnsnames">DNS Names</a> are
|
||
now allowed in Shorewall config files (although I recommend against
|
||
using them).</li>
|
||
<li>The connection SOURCE may now be
|
||
qualified by both interface and IP address in a <a
|
||
href="Documentation.htm#Rules">Shorewall rule</a>.</li>
|
||
<li>Shorewall startup is now disabled
|
||
after initial installation until the file /etc/shorewall/startup_disabled
|
||
is removed. This avoids nasty surprises during reboot for users
|
||
who install Shorewall but don't configure it.</li>
|
||
<li>The 'functions' and 'version' files
|
||
and the 'firewall' symbolic link have been moved from /var/lib/shorewall
|
||
to /usr/lib/shorewall to appease the LFS police at Debian.<br>
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
<p><b>9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability
|
||
Restored</b><br>
|
||
</p>
|
||
<img src="images/j0233056.gif"
|
||
alt="Brown Paper Bag" width="50" height="86" align="left">
|
||
A couple of recent configuration changes
|
||
at www.shorewall.net broke the Search facility:<br>
|
||
|
||
|
||
<blockquote>
|
||
|
||
<ol>
|
||
<li>Mailing List Archive Search was
|
||
not available.</li>
|
||
<li>The Site Search index was incomplete</li>
|
||
<li>Only one page of matches was presented.</li>
|
||
|
||
|
||
</ol>
|
||
</blockquote>
|
||
Hopefully these problems are now corrected.
|
||
|
||
<p><b>9/23/2002 - Full Shorewall Site/Mailing List Archive Search Capability
|
||
Restored<br>
|
||
</b></p>
|
||
A couple of recent configuration changes
|
||
at www.shorewall.net had the negative effect of breaking the
|
||
Search facility:<br>
|
||
|
||
<ol>
|
||
<li>Mailing List Archive Search was
|
||
not available.</li>
|
||
<li>The Site Search index was incomplete</li>
|
||
<li>Only one page of matches was presented.</li>
|
||
|
||
</ol>
|
||
Hopefully these problems are now corrected.<br>
|
||
|
||
<p><b>9/18/2002 - <20>Debian 1.3.8 Packages Available<br>
|
||
</b></p>
|
||
|
||
<p>Apt-get sources listed at <a
|
||
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html.</a></p>
|
||
|
||
<p><b>9/16/2002 - Shorewall 1.3.8</b></p>
|
||
|
||
|
||
<p>In this version:<br>
|
||
</p>
|
||
|
||
|
||
<ul>
|
||
<li>A <a
|
||
href="Documentation.htm#Conf">NEWNOTSYN</a> option has been
|
||
added to shorewall.conf. This option determines whether Shorewall
|
||
accepts TCP packets which are not part of an established connection
|
||
and that are not 'SYN' packets (SYN flag on and ACK flag off).</li>
|
||
<li>The need for the 'multi' option
|
||
to communicate between zones za and zb on the same interface
|
||
is removed in the case where the chain 'za2zb' and/or 'zb2za'
|
||
exists. 'za2zb' will exist if:</li>
|
||
|
||
|
||
|
||
<ul>
|
||
<li> There is a policy for
|
||
za to zb; or </li>
|
||
<li>There is at least one rule
|
||
for za to zb.</li>
|
||
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<ul>
|
||
<li>The /etc/shorewall/blacklist
|
||
file now contains three columns. In addition to the SUBNET/ADDRESS
|
||
column, there are optional PROTOCOL and PORT columns to block
|
||
only certain applications from the blacklisted addresses.<br>
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>9/11/2002 - Debian 1.3.7c Packages Available</b></p>
|
||
|
||
|
||
<p>Apt-get sources listed at <a
|
||
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
|
||
|
||
|
||
<p><b>9/2/2002 - Shorewall 1.3.7c</b></p>
|
||
|
||
|
||
<p>This is a role up of a fix for "DNAT" rules where the source zone is $FW
|
||
(fw).</p>
|
||
|
||
|
||
<p><b>8/31/2002 - I'm not available</b></p>
|
||
|
||
|
||
<p>I'm currently on vacation<6F> -- please respect my need for a couple of
|
||
weeks free of Shorewall problem reports.</p>
|
||
|
||
|
||
<p>-Tom</p>
|
||
|
||
|
||
<p><b>8/26/2002 - Shorewall 1.3.7b</b></p>
|
||
|
||
|
||
<p>This is a role up of the "shorewall refresh" bug fix and the change which
|
||
reverses the order of "dhcp" and "norfc1918" checking.</p>
|
||
|
||
|
||
<p><b>8/26/2002 - French FTP Mirror is Operational</b></p>
|
||
|
||
|
||
<p><a target="_blank"
|
||
href="ftp://france.shorewall.net/pub/mirrors/shorewall">ftp://france.shorewall.net/pub/mirrors/shorewall</a>
|
||
is now available.</p>
|
||
|
||
|
||
<p><b>8/25/2002 - Shorewall Mirror in France</b></p>
|
||
|
||
|
||
<p>Thanks to a Shorewall user in Paris, the Shorewall web site is now mirrored
|
||
at <a target="_top"
|
||
href="http://france.shorewall.net">http://france.shorewall.net</a>.</p>
|
||
|
||
|
||
<p><b>8/25/2002 - Shorewall 1.3.7a Debian Packages Available</b></p>
|
||
|
||
|
||
<p>Lorenzo Martignoni reports that the packages for version 1.3.7a are available
|
||
at <a
|
||
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
|
||
|
||
|
||
<p><b>8/22/2002 - Shorewall 1.3.7 Wins a Brown Paper Bag Award for its Author
|
||
-- Shorewall 1.3.7a released<img border="0"
|
||
src="images/j0233056.gif" width="50" height="80" align="middle">
|
||
</b></p>
|
||
|
||
|
||
<p>1.3.7a corrects problems occurring in rules file processing when starting
|
||
Shorewall 1.3.7.</p>
|
||
|
||
|
||
<p><b>8/22/2002 - Shorewall 1.3.7 Released 8/13/2002</b></p>
|
||
|
||
|
||
<p>Features in this release include:</p>
|
||
|
||
|
||
<ul>
|
||
<li>The 'icmp.def' file is now
|
||
empty! The rules in that file were required in ipchains
|
||
firewalls but are not required in Shorewall. Users who have
|
||
ALLOWRELATED=No in <a href="Documentation.htm#Conf">shorewall.conf</a>
|
||
should see the <a href="errata.htm#Upgrade">Upgrade Issues</a>.</li>
|
||
<li>A 'FORWARDPING' option has
|
||
been added to <a href="Documentation.htm#Conf"> shorewall.conf</a>.
|
||
The effect of setting this variable to Yes is the same as
|
||
the effect of adding an ACCEPT rule for ICMP echo-request
|
||
in <a href="shorewall_extension_scripts.htm">/etc/shorewall/icmpdef</a>.
|
||
Users who have such a rule in icmpdef are encouraged
|
||
to switch to FORWARDPING=Yes.</li>
|
||
<li>The loopback CLASS A Network
|
||
(127.0.0.0/8) has been added to the rfc1918 file.</li>
|
||
<li>Shorewall now works with iptables
|
||
1.2.7</li>
|
||
<li>The documentation and web site
|
||
no longer uses FrontPage themes.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p>I would like to thank John Distler for his valuable input regarding TCP
|
||
SYN and ICMP treatment in Shorewall. That input has
|
||
led to marked improvement in Shorewall in the last two
|
||
releases.</p>
|
||
|
||
|
||
<p><b>8/13/2002 - Documentation in the <a target="_top"
|
||
href="http://www.shorewall.net/cgi-bin/cvs/cvsweb.cgi">CVS Repository</a></b></p>
|
||
|
||
|
||
<p>The Shorewall-docs project now contains just the HTML and image files
|
||
- the Frontpage files have been removed.</p>
|
||
|
||
|
||
<p><b>8/7/2002 - <i>STABLE</i></b> <b>branch added to <a target="_top"
|
||
href="http://www.shorewall.net/cgi-bin/cvs/cvsweb.cgi">CVS Repository</a></b></p>
|
||
|
||
|
||
<p>This branch will only be updated after I release a new version of Shorewall
|
||
so you can always update from this branch to get the
|
||
latest stable tree.</p>
|
||
|
||
|
||
<p><b>8/7/2002 - <a href="errata.htm#Upgrade">Upgrade Issues</a> section
|
||
added to the <a href="errata.htm">Errata Page</a></b></p>
|
||
|
||
|
||
<p>Now there is one place to go to look for issues involved with upgrading
|
||
to recent versions of Shorewall.</p>
|
||
|
||
|
||
<p><b>8/7/2002 - Shorewall 1.3.6</b></p>
|
||
|
||
|
||
<p>This is primarily a bug-fix rollup with a couple of new features:</p>
|
||
|
||
|
||
<ul>
|
||
<li>The latest <a
|
||
href="shorewall_quickstart_guide.htm">QuickStart Guides </a>
|
||
including the <a href="shorewall_setup_guide.htm">Shorewall Setup
|
||
Guide.</a></li>
|
||
<li>Shorewall will now DROP TCP
|
||
packets that are not part of or related to an existing connection
|
||
and that are not SYN packets. These "New not SYN" packets
|
||
may be optionally logged by setting the LOGNEWNOTSYN option
|
||
in <a href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf</a>.</li>
|
||
<li>The processing of "New not
|
||
SYN" packets may be extended by commands in the new
|
||
<a href="shorewall_extension_scripts.htm">newnotsyn extension script</a>.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>7/30/2002 - Shorewall 1.3.5b Released</b></p>
|
||
|
||
|
||
<p>This interim release:</p>
|
||
|
||
|
||
<ul>
|
||
<li>Causes the firewall script
|
||
to remove the lock file if it is killed.</li>
|
||
<li>Once again allows lists in
|
||
the second column of the <a
|
||
href="Documentation.htm#Hosts">/etc/shorewall/hosts</a> file.</li>
|
||
<li>Includes the latest <a
|
||
href="shorewall_quickstart_guide.htm">QuickStart Guides</a>.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>7/29/2002 - New Shorewall Setup Guide Available</b></p>
|
||
|
||
|
||
<p>The first draft of this guide is available at <a
|
||
href="http://www.shorewall.net/shorewall_setup_guide.htm"> http://www.shorewall.net/shorewall_setup_guide.htm</a>.
|
||
The guide is intended for use by people who are setting
|
||
up Shorewall to manage multiple public IP addresses and
|
||
by people who want to learn more about Shorewall than is described
|
||
in the single-address guides. Feedback on the new guide is
|
||
welcome.</p>
|
||
|
||
|
||
<p><b>7/28/2002 - Shorewall 1.3.5 Debian Package Available</b></p>
|
||
|
||
|
||
<p>Lorenzo Martignoni reports that the packages are version 1.3.5a and are
|
||
available at <a
|
||
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
|
||
|
||
|
||
<p><b>7/27/2002 - Shorewall 1.3.5a Released</b></p>
|
||
|
||
|
||
<p>This interim release restores correct handling of REDIRECT rules. </p>
|
||
|
||
|
||
<p><b>7/26/2002 - Shorewall 1.3.5 Released</b></p>
|
||
|
||
|
||
<p>This will be the last Shorewall release for a while. I'm going to be
|
||
focusing on rewriting a lot of the documentation.</p>
|
||
|
||
|
||
<p><b><EFBFBD></b>In this version:</p>
|
||
|
||
|
||
<ul>
|
||
<li>Empty and invalid source and
|
||
destination qualifiers are now detected in the rules
|
||
file. It is a good idea to use the 'shorewall check' command
|
||
before you issue a 'shorewall restart' command be be sure
|
||
that you don't have any configuration problems that will prevent
|
||
a successful restart.</li>
|
||
<li>Added <b>MERGE_HOSTS</b> variable
|
||
in <a href="Documentation.htm#Conf"> shorewall.conf</a> to provide
|
||
saner behavior of the /etc/shorewall/hosts file.</li>
|
||
<li>The time that the counters
|
||
were last reset is now displayed in the heading of the
|
||
'status' and 'show' commands.</li>
|
||
<li>A <b>proxyarp </b>option has
|
||
been added for entries in <a
|
||
href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>.
|
||
This option facilitates Proxy ARP sub-netting as described in
|
||
the Proxy ARP subnetting mini-HOWTO (<a
|
||
href="http://www.tldp.org/HOWTO/mini/Proxy-ARP-Subnet/">http://www.tldp.org/HOWTO/mini/Proxy-ARP-Subnet/</a>).
|
||
Specifying the proxyarp option for an interface causes
|
||
Shorewall to set /proc/sys/net/ipv4/conf/<interface>/proxy_arp.</li>
|
||
<li>The Samples have been updated
|
||
to reflect the new capabilities in this release. </li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>7/16/2002 - New Mirror in Argentina</b></p>
|
||
|
||
|
||
<p>Thanks to Arturo "Buanzo" Busleiman, there is now a Shorewall mirror in
|
||
Argentina. Thanks Buanzo!!!</p>
|
||
|
||
|
||
<p><b>7/16/2002 - Shorewall 1.3.4 Released</b></p>
|
||
|
||
|
||
<p>In this version:</p>
|
||
|
||
|
||
<ul>
|
||
<li>A new <a
|
||
href="Documentation.htm#Routestopped"> /etc/shorewall/routestopped</a>
|
||
file has been added. This file is intended to eventually
|
||
replace the <b>routestopped</b> option in the /etc/shorewall/interface
|
||
and /etc/shorewall/hosts files. This new file makes remote
|
||
firewall administration easier by allowing any IP or subnet to
|
||
be enabled while Shorewall is stopped.</li>
|
||
<li>An /etc/shorewall/stopped <a
|
||
href="Documentation.htm#Scripts">extension script</a> has been added.
|
||
This script is invoked after Shorewall has stopped.</li>
|
||
<li>A <b>DETECT_DNAT_ADDRS </b>option
|
||
has been added to <a href="Documentation.htm#Conf">/etc/shoreall/shorewall.conf</a>.
|
||
When this option is selected, DNAT rules only apply
|
||
when the destination address is the external interface's
|
||
primary IP address.</li>
|
||
<li>The <a
|
||
href="shorewall_quickstart_guide.htm">QuickStart Guide</a> has
|
||
been broken into three guides and has been almost entirely
|
||
rewritten.</li>
|
||
<li>The Samples have been updated
|
||
to reflect the new capabilities in this release. </li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>7/8/2002 - Shorewall 1.3.3 Debian Package Available</b></p>
|
||
|
||
|
||
<p>Lorenzo Marignoni reports that the packages are available at <a
|
||
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
|
||
|
||
|
||
<p><b>7/6/2002 - Shorewall 1.3.3 Released</b></p>
|
||
|
||
|
||
<p>In this version:</p>
|
||
|
||
|
||
<ul>
|
||
<li>Entries in /etc/shorewall/interface
|
||
that use the wildcard character ("+") now have the "multi"
|
||
option assumed.</li>
|
||
<li>The 'rfc1918' chain in the
|
||
mangle table has been renamed 'man1918' to make log
|
||
messages generated from that chain distinguishable from those
|
||
generated by the 'rfc1918' chain in the filter table.</li>
|
||
<li>Interface names appearing in
|
||
the hosts file are now validated against the interfaces
|
||
file.</li>
|
||
<li>The TARGET column in the rfc1918
|
||
file is now checked for correctness.</li>
|
||
<li>The chain structure in the
|
||
nat table has been changed to reduce the number of rules
|
||
that a packet must traverse and to correct problems with
|
||
NAT_BEFORE_RULES=No</li>
|
||
<li>The "hits" command has been
|
||
enhanced.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>6/25/2002 - Samples Updated for 1.3.2</b></p>
|
||
|
||
|
||
<p>The comments in the sample configuration files have been updated to reflect
|
||
new features introduced in Shorewall 1.3.2.</p>
|
||
|
||
|
||
<p><b>6/25/2002 - Shorewall 1.3.1 Debian Package Available</b></p>
|
||
|
||
|
||
<p>Lorenzo Marignoni reports that the package is available at <a
|
||
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
|
||
|
||
|
||
<p><b>6/19/2002 - Documentation Available in PDF Format</b></p>
|
||
|
||
|
||
<p>Thanks to Mike Martinez, the Shorewall Documentation is now available
|
||
for <a href="download.htm">download</a> in <a
|
||
href="http://www.adobe.com">Adobe</a> PDF format.</p>
|
||
|
||
|
||
<p><b>6/16/2002 - Shorewall 1.3.2 Released</b></p>
|
||
|
||
|
||
<p>In this version:</p>
|
||
|
||
|
||
<ul>
|
||
<li>A <a
|
||
href="Documentation.htm#Starting">logwatch command</a> has been
|
||
added to /sbin/shorewall.</li>
|
||
<li>A <a
|
||
href="blacklisting_support.htm">dynamic blacklist facility</a>
|
||
has been added.</li>
|
||
<li>Support for the <a
|
||
href="Documentation.htm#Conf">Netfilter multiport match function</a>
|
||
has been added.</li>
|
||
<li>The files <b>firewall, functions
|
||
</b>and <b>version</b> have been moved from
|
||
/etc/shorewall to /var/lib/shorewall.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>6/6/2002 - Why CVS Web access is Password Protected</b></p>
|
||
|
||
|
||
<p>Last weekend, I installed the CVS Web package to provide brower-based
|
||
access to the Shorewall CVS repository. Since then, I have had several
|
||
instances where my server was almost unusable due to the high load generated
|
||
by website copying tools like HTTrack and WebStripper. These mindless tools:</p>
|
||
|
||
|
||
<ul>
|
||
<li>Ignore robot.txt files.</li>
|
||
<li>Recursively copy everything
|
||
that they find.</li>
|
||
<li>Should be classified as weapons
|
||
rather than tools.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p>These tools/weapons are particularly damaging when combined with CVS Web
|
||
because they doggedly follow every link in the cgi-generated
|
||
HTML resulting in 1000s of executions of the cvsweb.cgi
|
||
script. Yesterday, I spend several hours implementing measures
|
||
to block these tools but unfortunately, these measures resulted
|
||
in my server OOM-ing under even moderate load.</p>
|
||
|
||
|
||
<p>Until I have the time to understand the cause of the OOM (or until I buy
|
||
more RAM if that is what is required), CVS Web access
|
||
will remain Password Protected. </p>
|
||
|
||
|
||
<p><b>6/5/2002 - Shorewall 1.3.1 Debian Package Available</b></p>
|
||
|
||
|
||
<p>Lorenzo Marignoni reports that the package is available at <a
|
||
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</p>
|
||
|
||
|
||
<p><b>6/2/2002 - Samples Corrected</b></p>
|
||
|
||
|
||
<p>The 1.3.0 samples configurations had several serious problems that prevented
|
||
DNS and SSH from working properly. These problems have
|
||
been corrected in the <a
|
||
href="/pub/shorewall/samples-1.3.1">1.3.1 samples.</a></p>
|
||
|
||
|
||
<p><b>6/1/2002 - Shorewall 1.3.1 Released</b></p>
|
||
|
||
|
||
<p>Hot on the heels of 1.3.0, this release:</p>
|
||
|
||
|
||
<ul>
|
||
<li>Corrects a serious problem
|
||
with "all <i><zone></i> CONTINUE" policies.
|
||
This problem is present in all versions of Shorewall that
|
||
support the CONTINUE policy. These previous versions optimized
|
||
away the "all2<i><zone></i>" chain and replaced it with
|
||
the "all2all" chain with the usual result that a policy of REJECT
|
||
was enforced rather than the intended CONTINUE policy.</li>
|
||
<li>Adds an <a
|
||
href="Documentation.htm#rfc1918">/etc/shorewall/rfc1918</a>
|
||
file for defining the exact behavior of the<a
|
||
href="Documentation.htm#Interfaces"> 'norfc1918' interface option</a>.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>5/29/2002 - Shorewall 1.3.0 Released</b></p>
|
||
|
||
|
||
<p>In addition to the changes in Beta 1, Beta 2 and RC1, Shorewall 1.3.0
|
||
includes:</p>
|
||
|
||
|
||
<ul>
|
||
<li>A 'filterping' interface option
|
||
that allows ICMP echo-request (ping) requests addressed
|
||
to the firewall to be handled by entries in /etc/shorewall/rules
|
||
and /etc/shorewall/policy.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>5/23/2002 - Shorewall 1.3 RC1 Available</b></p>
|
||
|
||
|
||
<p>In addition to the changes in Beta 1 and Beta 2, RC1 (Version 1.2.92)
|
||
incorporates the following:</p>
|
||
|
||
|
||
<ul>
|
||
<li>Support for the /etc/shorewall/whitelist
|
||
file has been withdrawn. If you need whitelisting,
|
||
see <a href="/1.3/whitelisting_under_shorewall.htm">these instructions</a>.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>5/19/2002 - Shorewall 1.3 Beta 2 Available</b></p>
|
||
|
||
|
||
<p>In addition to the changes in Beta 1, this release which carries the
|
||
designation 1.2.91 adds:</p>
|
||
|
||
|
||
<ul>
|
||
<li>The structure of the firewall
|
||
is changed markedly. There is now an INPUT and a FORWARD
|
||
chain for each interface; this reduces the number of rules
|
||
that a packet must traverse, especially in complicated setups.</li>
|
||
<li><a
|
||
href="Documentation.htm#Exclude">Sub-zones may now be excluded
|
||
from DNAT and REDIRECT rules.</a></li>
|
||
<li>The names of the columns in
|
||
a number of the configuration files have been changed
|
||
to be more consistent and self-explanatory and the documentation
|
||
has been updated accordingly.</li>
|
||
<li>The sample configurations have
|
||
been updated for 1.3.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>5/17/2002 - Shorewall 1.3 Beta 1 Available</b></p>
|
||
|
||
|
||
<p>Beta 1 carries the version designation 1.2.90 and implements the following
|
||
features:</p>
|
||
|
||
|
||
<ul>
|
||
<li>Simplified rule syntax which
|
||
makes the intent of each rule clearer and hopefully
|
||
makes Shorewall easier to learn.</li>
|
||
<li>Upward compatibility with 1.2
|
||
configuration files has been maintained so that current
|
||
users can migrate to the new syntax at their convenience.</li>
|
||
<li><b><font color="#cc6666">WARNING:<3A>
|
||
Compatibility with the old parameterized sample configurations
|
||
has NOT been maintained. Users still running those configurations
|
||
should migrate to the new sample configurations before
|
||
upgrading to 1.3 Beta 1.</font></b></li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>5/4/2002 - Shorewall 1.2.13 is Available</b></p>
|
||
|
||
|
||
<p>In this version:</p>
|
||
|
||
|
||
<ul>
|
||
<li><a
|
||
href="Documentation.htm#Whitelist">White-listing</a> is supported.</li>
|
||
<li><a
|
||
href="Documentation.htm#Policy">SYN-flood protection </a>is
|
||
added.</li>
|
||
<li>IP addresses added under <a
|
||
href="Documentation.htm#Conf">ADD_IP_ALIASES and ADD_SNAT_ALIASES</a>
|
||
now inherit the VLSM and Broadcast Address of the interface's
|
||
primary IP address.</li>
|
||
<li>The order in which port forwarding
|
||
DNAT and Static DNAT <a
|
||
href="Documentation.htm#Conf">can now be reversed</a> so that
|
||
port forwarding rules can override the contents of <a
|
||
href="Documentation.htm#NAT"> /etc/shorewall/nat</a>. </li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>4/30/2002 - Shorewall Debian News</b></p>
|
||
|
||
|
||
<p>Lorenzo Marignoni reports that Shorewall 1.2.12 is now in both the
|
||
<a href="http://packages.debian.org/testing/net/shorewall.html">Debian
|
||
Testing Branch</a> and the <a
|
||
href="http://packages.debian.org/unstable/net/shorewall.html">Debian
|
||
Unstable Branch</a>.</p>
|
||
|
||
|
||
<p><b>4/20/2002 - Shorewall 1.2.12 is Available</b></p>
|
||
|
||
|
||
<ul>
|
||
<li>The 'try' command works again</li>
|
||
<li>There is now a single RPM that
|
||
also works with SuSE.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>4/17/2002 - Shorewall Debian News</b></p>
|
||
|
||
|
||
<p>Lorenzo Marignoni reports that:</p>
|
||
|
||
|
||
<ul>
|
||
<li>Shorewall 1.2.10 is in the
|
||
<a href="http://packages.debian.org/testing/net/shorewall.html">Debian
|
||
Testing Branch</a></li>
|
||
<li>Shorewall 1.2.11 is in the
|
||
<a href="http://packages.debian.org/unstable/net/shorewall.html">Debian
|
||
Unstable Branch</a></li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p>Thanks, Lorenzo!</p>
|
||
|
||
|
||
<p><b>4/16/2002 - Shorewall 1.2.11 RPM Available for SuSE</b></p>
|
||
|
||
|
||
<p>Thanks to <a href="mailto:s.mohr@familie-mohr.com">Stefan Mohr</a>, there
|
||
is now a Shorewall 1.2.11 <a
|
||
href="http://www.shorewall.net/pub/shorewall/shorewall-1.2-11.i686.suse73.rpm">
|
||
SuSE RPM</a> available. </p>
|
||
|
||
|
||
<p><b>4/13/2002 - Shorewall 1.2.11 Available </b></p>
|
||
|
||
|
||
<p>In this version:</p>
|
||
|
||
|
||
<ul>
|
||
<li>The 'try' command now accepts
|
||
an optional timeout. If the timeout is given in the command,
|
||
the standard configuration will automatically be restarted
|
||
after the new configuration has been running for that length
|
||
of time. This prevents a remote admin from being locked out
|
||
of the firewall in the case where the new configuration starts
|
||
but prevents access.</li>
|
||
<li>Kernel route filtering may
|
||
now be enabled globally using the new ROUTE_FILTER
|
||
parameter in <a href="Documentation.htm#Conf"> /etc/shorewall/shorewall.conf</a>.</li>
|
||
<li>Individual IP source addresses
|
||
and/or subnets may now be excluded from masquerading/SNAT.</li>
|
||
<li>Simple "Yes/No" and "On/Off"
|
||
values are now case-insensitive in /etc/shorewall/shorewall.conf.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>4/13/2002 - Hamburg Mirror now has FTP </b></p>
|
||
|
||
|
||
<p>Stefan now has an FTP mirror at <a target="_blank"
|
||
href="ftp://germany.shorewall.net/pub/shorewall"> ftp://germany.shorewall.net/pub/shorewall</a>.<2E>
|
||
Thanks Stefan!</p>
|
||
|
||
|
||
<p><b>4/12/2002 - New Mirror in Hamburg</b></p>
|
||
|
||
|
||
<p>Thanks to <a href="mailto:s.mohr@familie-mohr.com">Stefan Mohr</a>, there
|
||
is now a mirror of the Shorewall website at <a
|
||
target="_top" href="http://germany.shorewall.net"> http://germany.shorewall.net</a>.
|
||
</p>
|
||
|
||
|
||
<p><b>4/10/2002 - Shorewall QuickStart Guide Version 1.1 Available</b></p>
|
||
|
||
|
||
<p><a href="shorewall_quickstart_guide.htm">Version 1.1 of the QuickStart
|
||
Guide</a> is now available. Thanks to those who have
|
||
read version 1.0 and offered their suggestions. Corrections
|
||
have also been made to the sample scripts.</p>
|
||
|
||
|
||
<p><b>4/9/2002 - Shorewall QuickStart Guide Version 1.0 Available</b></p>
|
||
|
||
|
||
<p><a href="shorewall_quickstart_guide.htm">Version 1.0 of the QuickStart
|
||
Guide</a> is now available. This Guide and its accompanying
|
||
sample configurations are expected to provide a replacement
|
||
for the recently withdrawn parameterized samples. </p>
|
||
|
||
|
||
<p><b>4/8/2002 - Parameterized Samples Withdrawn </b></p>
|
||
|
||
|
||
<p>Although the <a
|
||
href="http://www.shorewall.net/pub/shorewall/samples-1.2.1/">parameterized
|
||
samples</a> have allowed people to get a firewall up
|
||
and running quickly, they have unfortunately set the wrong
|
||
level of expectation among those who have used them. I am
|
||
therefore withdrawing support for the samples and I am recommending
|
||
that they not be used in new Shorewall installations.</p>
|
||
|
||
|
||
<p><b>4/2/2002 - Updated Log Parser</b></p>
|
||
|
||
|
||
<p><a href="mailto:JML@redwoodtech.com">John Lodge</a> has provided an updated
|
||
version of his <a href="pub/shorewall/parsefw/">CGI-based
|
||
log parser</a> with corrected date handling. </p>
|
||
|
||
|
||
<p><b>3/30/2002 - Shorewall Website Search Improvements</b></p>
|
||
|
||
|
||
<p>The quick search on the home page now excludes the mailing list archives.
|
||
The <a href="htdig/search.html">Extended Search</a>
|
||
allows excluding the archives or restricting the search
|
||
to just the archives. An archive search form is also available
|
||
on the <a href="http://lists.shorewall.net/mailing_list.htm">mailing list information page</a>.</p>
|
||
|
||
|
||
<p><b>3/28/2002 - Debian Shorewall News (From Lorenzo Martignoni)</b></p>
|
||
|
||
|
||
<ul>
|
||
<li>The 1.2.10 Debian Package is
|
||
available at <a
|
||
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</li>
|
||
<li>Shorewall 1.2.9 is now in the
|
||
<a href="http://packages.debian.org/unstable/net/shorewall.html">Debian
|
||
Unstable Distribution</a>.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>3/25/2002 - Log Parser Available</b></p>
|
||
|
||
|
||
<p><a href="mailto:JML@redwoodtech.com">John Lodge</a> has provided a <a
|
||
href="pub/shorewall/parsefw/">CGI-based log parser</a> for Shorewall. Thanks
|
||
John.</p>
|
||
|
||
|
||
<p><b>3/20/2002 - Shorewall 1.2.10 Released</b></p>
|
||
|
||
|
||
<p>In this version:</p>
|
||
|
||
|
||
<ul>
|
||
<li>A "shorewall try" command has
|
||
been added (syntax: shorewall try <i> <configuration
|
||
directory></i>). This command attempts "shorewall -c <i>
|
||
<configuration directory></i> start" and if that results
|
||
in the firewall being stopped due to an error, a "shorewall
|
||
start" command is executed. The 'try' command allows you to
|
||
create a new <a href="Documentation.htm#Configs"> configuration</a>
|
||
and attempt to start it; if there is an error that leaves
|
||
your firewall in the stopped state, it will automatically be restarted
|
||
using the default configuration (in /etc/shorewall).</li>
|
||
<li>A new variable ADD_SNAT_ALIASES
|
||
has been added to <a href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf</a>.
|
||
If this variable is set to "Yes", Shorewall will automatically
|
||
add IP addresses listed in the third column of the <a
|
||
href="Documentation.htm#Masq"> /etc/shorewall/masq</a> file.</li>
|
||
<li>Copyright notices have been
|
||
added to the documenation.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>3/11/2002 - Shorewall 1.2.9 Released</b></p>
|
||
|
||
|
||
<p>In this version:</p>
|
||
|
||
|
||
<ul>
|
||
<li>Filtering by <a
|
||
href="Documentation.htm#MAC">MAC address</a> has been added.
|
||
MAC addresses may be used as the source address in:
|
||
|
||
|
||
|
||
<ul>
|
||
<li>Filtering rules (<a
|
||
href="Documentation.htm#Rules">/etc/shorewall/rules</a>)</li>
|
||
<li>Traffic Control Classification
|
||
Rules (<a href="traffic_shaping.htm#tcrules">/etc/shorewall/tcrules</a>)</li>
|
||
<li>TOS Rules (<a
|
||
href="Documentation.htm#TOS">/etc/shorewall/tos</a>)</li>
|
||
<li>Blacklist (<a
|
||
href="Documentation.htm#Blacklist">/etc/shorewall/blacklist</a>)</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</li>
|
||
<li>Several bugs have been fixed</li>
|
||
<li>The 1.2.9 Debian Package is
|
||
also available at <a
|
||
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a>.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>3/1/2002 - 1.2.8 Debian Package is Available</b></p>
|
||
|
||
|
||
<p>See <a href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a></p>
|
||
|
||
|
||
<p><b>2/25/2002 - New Two-interface Sample</b></p>
|
||
|
||
|
||
<p>I've enhanced the two interface sample to allow access from the firewall
|
||
to servers in the local zone - <a
|
||
href="http://www.shorewall.net/pub/shorewall/LATEST.samples/two-interfaces.tgz">
|
||
http://www.shorewall.net/pub/shorewall/LATEST.samples/two-interfaces.tgz</a></p>
|
||
|
||
|
||
<p><b>2/23/2002 - Shorewall 1.2.8 Released</b></p>
|
||
|
||
|
||
<p>Do to a serious problem with 1.2.7, I am releasing 1.2.8. It corrects
|
||
problems associated with the lock file used to prevent multiple state-changing
|
||
operations from occuring simultaneously. My apologies
|
||
for any inconvenience my carelessness may have caused.</p>
|
||
|
||
|
||
<p><b>2/22/2002 - Shorewall 1.2.7 Released</b></p>
|
||
|
||
|
||
<p>In this version:</p>
|
||
|
||
|
||
<ul>
|
||
<li>UPnP probes (UDP destination
|
||
port 1900) are now silently dropped in the <i>common</i>
|
||
chain</li>
|
||
<li>RFC 1918 checking in the mangle
|
||
table has been streamlined to no longer require packet
|
||
marking. RFC 1918 checking in the filter table has been
|
||
changed to require half as many rules as previously.</li>
|
||
<li>A 'shorewall check' command
|
||
has been added that does a cursory validation of the
|
||
zones, interfaces, hosts, rules and policy files.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>2/18/2002 - 1.2.6 Debian Package is Available</b></p>
|
||
|
||
|
||
<p>See <a href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a></p>
|
||
|
||
|
||
<p><b>2/8/2002 - Shorewall 1.2.6 Released</b></p>
|
||
|
||
|
||
<p>In this version:</p>
|
||
|
||
|
||
<ul>
|
||
<li>$-variables may now be used
|
||
anywhere in the configuration files except /etc/shorewall/zones.</li>
|
||
<li>The interfaces and hosts files
|
||
now have their contents validated before any changes
|
||
are made to the existing Netfilter configuration. The appearance
|
||
of a zone name that isn't defined in /etc/shorewall/zones
|
||
causes "shorewall start" and "shorewall restart" to abort without
|
||
changing the Shorewall state. Unknown options in either file
|
||
cause a warning to be issued.</li>
|
||
<li>A problem occurring when BLACKLIST_LOGLEVEL
|
||
was not set has been corrected.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>2/4/2002 - Shorewall 1.2.5 Debian Package Available</b></p>
|
||
|
||
|
||
<p>see <a href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a></p>
|
||
|
||
|
||
<p><b>2/1/2002 - Shorewall 1.2.5 Released</b></p>
|
||
|
||
|
||
<p>Due to installation problems with Shorewall 1.2.4, I have released Shorewall
|
||
1.2.5. Sorry for the rapid-fire development.</p>
|
||
|
||
|
||
<p>In version 1.2.5:</p>
|
||
|
||
|
||
<ul>
|
||
<li>The installation problems have
|
||
been corrected.</li>
|
||
<li><a
|
||
href="Documentation.htm#Masq">SNAT</a> is now supported.</li>
|
||
<li>A "shorewall version" command
|
||
has been added</li>
|
||
<li>The default value of the STATEDIR
|
||
variable in /etc/shorewall/shorewall.conf has been changed
|
||
to /var/lib/shorewall in order to conform to the GNU/Linux
|
||
File Hierarchy Standard, Version 2.2.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>1/28/2002 - Shorewall 1.2.4 Released</b></p>
|
||
|
||
|
||
<ul>
|
||
<li>The "fw" zone <a
|
||
href="Documentation.htm#FW">may now be given a different name</a>.</li>
|
||
<li>You may now place end-of-line
|
||
comments (preceded by '#') in any of the configuration
|
||
files</li>
|
||
<li>There is now protection against
|
||
against two state changing operations occuring concurrently.
|
||
This is implemented using the 'lockfile' utility if it
|
||
is available (lockfile is part of procmail); otherwise, a less
|
||
robust technique is used. The lockfile is created in the STATEDIR
|
||
defined in /etc/shorewall/shorewall.conf and has the name
|
||
"lock".</li>
|
||
<li>"shorewall start" no longer
|
||
fails if "detect" is specified in <a
|
||
href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>
|
||
for an interface with subnet mask 255.255.255.255.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>1/27/2002 - Shorewall 1.2.3 Debian Package Available </b>-- see <a
|
||
href="http://security.dsi.unimi.it/%7Elorenzo/debian.html">http://security.dsi.unimi.it/~lorenzo/debian.html</a></p>
|
||
|
||
|
||
<p><b>1/20/2002 - Corrected firewall script available<6C></b></p>
|
||
|
||
|
||
<p>Corrects a problem with BLACKLIST_LOGLEVEL. See <a href="errata.htm">the
|
||
errata</a> for details.</p>
|
||
|
||
|
||
<p><b>1/19/2002 - Shorewall 1.2.3 Released</b></p>
|
||
|
||
|
||
<p>This is a minor feature and bugfix release. The single new feature is:</p>
|
||
|
||
|
||
<ul>
|
||
<li>Support for TCP MSS Clamp to
|
||
PMTU -- This support is usually required when the internet
|
||
connection is via PPPoE or PPTP and may be enabled using the
|
||
<a href="Documentation.htm#ClampMSS">CLAMPMSS</a> option in /etc/shorewall/shorewall.conf.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p>The following problems were corrected:</p>
|
||
|
||
|
||
<ul>
|
||
<li>The "shorewall status" command
|
||
no longer hangs.</li>
|
||
<li>The "shorewall monitor" command
|
||
now displays the icmpdef chain</li>
|
||
<li>The CLIENT PORT(S) column in
|
||
tcrules is no longer ignored</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>1/18/2002 - Shorewall 1.2.2 packaged with new </b><a
|
||
href="http://leaf.sourceforge.net">LEAF</a><b> release</b></p>
|
||
|
||
|
||
<p>Jacques Nilo and Eric Wolzak have released a kernel 2.4.16 LEAF distribution
|
||
that includes Shorewall 1.2.2. See <a
|
||
href="http://leaf.sourceforge.net/devel/jnilo">http://leaf.sourceforge.net/devel/jnilo</a>
|
||
for details.</p>
|
||
|
||
|
||
<p><b>1/11/2002 - Debian Package (.deb) Now Available - </b>Thanks to <a
|
||
href="mailto:lorenzo.martignoni@milug.org">Lorenzo Martignoni</a>, a 1.2.2
|
||
Shorewall Debian package is now available. There is a
|
||
link to Lorenzo's site from the <a href="download.htm">Shorewall
|
||
download page</a>.</p>
|
||
|
||
|
||
<p><b>1/9/2002 - Updated 1.2.2 /sbin/shorewall available - </b><a
|
||
href="/pub/shorewall/errata/1.2.2/shorewall">This corrected version </a>restores
|
||
the "shorewall status" command to health.</p>
|
||
|
||
|
||
<p><b>1/8/2002 - Shorewall 1.2.2 Released</b></p>
|
||
|
||
|
||
<p>In version 1.2.2</p>
|
||
|
||
|
||
<ul>
|
||
<li>Support for IP blacklisting
|
||
has been added
|
||
|
||
|
||
<ul>
|
||
<li>You specify whether you want
|
||
packets from blacklisted hosts dropped or rejected
|
||
using the <a href="Documentation.htm#BLDisposition">BLACKLIST_DISPOSITION
|
||
</a>setting in /etc/shorewall/shorewall.conf</li>
|
||
<li>You specify whether you want
|
||
packets from blacklisted hosts logged and at what
|
||
syslog level using the <a href="Documentation.htm#BLLoglevel">BLACKLIST_LOGLEVEL</a>
|
||
setting in /etc/shorewall/shorewall.conf</li>
|
||
<li>You list the IP addresses/subnets
|
||
that you wish to blacklist in <a
|
||
href="Documentation.htm#Blacklist">/etc/shorewall/blacklist</a></li>
|
||
<li>You specify the interfaces
|
||
you want checked against the blacklist using the
|
||
new "<a href="Documentation.htm#BLInterface">blacklist</a>" option
|
||
in /etc/shorewall/interfaces.</li>
|
||
<li>The black list is refreshed
|
||
from /etc/shorewall/blacklist by the "shorewall
|
||
refresh" command.</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</li>
|
||
<li>Use of TCP RST replies has been
|
||
expanded<65>
|
||
|
||
|
||
<ul>
|
||
<li>TCP connection requests rejected
|
||
because of a REJECT policy are now replied with a
|
||
TCP RST packet.</li>
|
||
<li>TCP connection requests rejected
|
||
because of a protocol=all rule in /etc/shorewall/rules
|
||
are now replied with a TCP RST packet.</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</li>
|
||
<li>A <a
|
||
href="Documentation.htm#Logfile">LOGFILE</a> specification has
|
||
been added to /etc/shorewall/shorewall.conf. LOGFILE is used
|
||
to tell the /sbin/shorewall program where to look for Shorewall
|
||
messages.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>1/5/2002 - New Parameterized Samples (<a
|
||
href="ftp://ftp.shorewall.net/pub/shorewall/samples-1.2.0/"
|
||
target="_blank">version 1.2.0</a>) released. </b>These are minor updates
|
||
to the previously-released samples. There are two new
|
||
rules added:</p>
|
||
|
||
|
||
<ul>
|
||
<li>Unless you have explicitly enabled
|
||
Auth connections (tcp port 113) to your firewall, these
|
||
connections will be REJECTED rather than DROPPED. This
|
||
speeds up connection establishment to some servers.</li>
|
||
<li>Orphan DNS replies are now silently
|
||
dropped.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p>See the README file for upgrade instructions.</p>
|
||
|
||
|
||
<p><b>1/1/2002 - <u><font color="#ff6633">Shorewall Mailing List Moving</font></u></b></p>
|
||
|
||
|
||
<p>The Shorewall mailing list hosted at <a href="http://sourceforge.net">
|
||
Sourceforge</a> is moving to Shorewall.net. If you are
|
||
a current subscriber to the list at Sourceforge, please <a
|
||
href="shorewall_mailing_list_migration.htm">see these instructions</a>.
|
||
If you would like to subscribe to the new list, visit
|
||
<a href="http://www.shorewall.net/mailman/listinfo/shorewall-users">http://www.shorewall.net/mailman/listinfo/shorewall-users</a>.</p>
|
||
|
||
|
||
<p><b>12/31/2001 - Shorewall 1.2.1 Released</b></p>
|
||
|
||
|
||
<p>In version 1.2.1:</p>
|
||
|
||
|
||
<ul>
|
||
<li><a
|
||
href="Documentation.htm#LogUncleanOption">Logging of Mangled/Invalid
|
||
Packets</a> is added.<2E></li>
|
||
<li>The <a href="IPIP.htm">tunnel
|
||
script</a> has been corrected.</li>
|
||
<li>'shorewall show tc' now correctly
|
||
handles tunnels.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>12/21/2001 - Shorewall 1.2.0 Released!</b> - <b>I couldn't resist
|
||
releasing 1.2 on 12/21/2001</b></p>
|
||
|
||
|
||
<p>Version 1.2 contains the following new features:</p>
|
||
|
||
|
||
<ul>
|
||
<li>Support for <a
|
||
href="traffic_shaping.htm">Traffic Control/Shaping</a></li>
|
||
<li>Support for <a
|
||
href="Documentation.htm#Unclean">Filtering of Mangled/Invalid Packets</a></li>
|
||
<li>Support for <a
|
||
href="IPIP.htm">GRE Tunnels</a></li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p>For the next month or so, I will continue to provide corrections to version
|
||
1.1.18 as necessary so that current version 1.1.x users
|
||
will not be forced into a quick upgrade to 1.2.0 just to have
|
||
access to bug fixes.</p>
|
||
|
||
|
||
<p>For those of you who have installed one of the Beta RPMS, you will need
|
||
to use the "--oldpackage" option when upgrading to 1.2.0:</p>
|
||
|
||
|
||
<blockquote>
|
||
|
||
<p>rpm -Uvh --oldpackage shorewall-1.2-0.noarch.rpm</p>
|
||
</blockquote>
|
||
|
||
|
||
<p><b>12/19/2001 - Thanks to <a href="mailto:scowles@infohiiway.com">Steve
|
||
Cowles</a>, there is now a Shorewall mirror in Texas. </b>This
|
||
web site is mirrored at <a
|
||
href="http://www.infohiiway.com/shorewall" target="_top">http://www.infohiiway.com/shorewall</a>
|
||
and the ftp site is at <a
|
||
href="ftp://ftp.infohiiway.com/pub/mirrors/shorewall">ftp://ftp.infohiiway.com/pub/mirrors/shorewall</a>.<b><EFBFBD></b></p>
|
||
|
||
|
||
<p><b>11/30/2001 - A new set of the parameterized <a
|
||
href="ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.18">Sample
|
||
Configurations</a> has been released</b>. In this version:</p>
|
||
|
||
|
||
<ul>
|
||
<li>Ping is now allowed between
|
||
the zones.</li>
|
||
<li>In the three-interface configuration,
|
||
it is now possible to configure the internet services
|
||
that are to be available to servers in the DMZ.<2E></li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>11/20/2001 - The current version of Shorewall is 1.1.18.<2E></b></p>
|
||
|
||
|
||
<p>In this version:</p>
|
||
|
||
|
||
<ul>
|
||
<li>The spelling of ADD_IP_ALIASES
|
||
has been corrected in the shorewall.conf file</li>
|
||
<li>The logic for deleting user-defined
|
||
chains has been simplified so that it avoids a bug in
|
||
the LRP version of the 'cut' utility.</li>
|
||
<li>The /var/lib/lrpkg/shorwall.conf
|
||
file has been corrected to properly display the NAT entry
|
||
in that file.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>11/19/2001 - Thanks to <a href="mailto:shorewall@timelord.sk">Juraj
|
||
Ontkanin</a>, there is now a Shorewall mirror in
|
||
the Slovak Republic</b>. The website is now mirrored at <a
|
||
href="http://www.nrg.sk/mirror/shorewall" target="_top">http://www.nrg.sk/mirror/shorewall</a>
|
||
and the FTP site is mirrored at <a
|
||
href="ftp://ftp.nrg.sk/mirror/shorewall">ftp://ftp.nrg.sk/mirror/shorewall</a>.</p>
|
||
|
||
|
||
<p><b>11/2/2001 - Announcing Shorewall Parameter-driven Sample Configurations.</b>
|
||
There are three sample configurations:</p>
|
||
|
||
|
||
<ul>
|
||
<li>One Interface -- for a standalone
|
||
system.</li>
|
||
<li>Two Interfaces -- A masquerading
|
||
firewall.</li>
|
||
<li>Three Interfaces -- A masquerading
|
||
firewall with DMZ.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p>Samples may be downloaded from <a
|
||
href="ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.17"> ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.17</a>
|
||
. See the README file for instructions.</p>
|
||
|
||
|
||
<p><b>11/1/2001 - The current version of Shorewall is 1.1.17</b>.<2E> I intend
|
||
this to be the last of the 1.1 Shorewall releases.</p>
|
||
|
||
|
||
<p> In this version:</p>
|
||
|
||
|
||
<ul>
|
||
<li>The handling of <a
|
||
href="Documentation.htm#Aliases">ADD_IP_ALIASES</a> has
|
||
been corrected.<2E></li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>10/22/2001 - The current version of Shorewall is 1.1.16</b>. In this
|
||
version:</p>
|
||
|
||
|
||
<ul>
|
||
<li>A new "shorewall show connections"
|
||
command has been added.</li>
|
||
<li>In the "shorewall monitor" output,
|
||
the currently tracked connections are now shown on a
|
||
separate page.</li>
|
||
<li>Prior to this release, Shorewall
|
||
unconditionally added the external IP adddress(es) specified
|
||
in /etc/shorewall/nat. Beginning with version 1.1.16,
|
||
a new parameter (<a href="Documentation.htm#Aliases">ADD_IP_ALIASES</a>)
|
||
may be set to "no" (or "No") to inhibit this behavior.
|
||
This allows IP aliases created using your distribution's
|
||
network configuration tools to be used in static NAT.<2E></li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>10/15/2001 - The current version of Shorewall is 1.1.15.</b> In this
|
||
version:</p>
|
||
|
||
|
||
<ul>
|
||
<li>Support for nested zones has
|
||
been improved. See <a href="Documentation.htm#Nested"> the documentation</a>
|
||
for details</li>
|
||
<li>Shorewall now correctly checks
|
||
the alternate configuration directory for the 'zones'
|
||
file.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>10/4/2001 - The current version of Shorewall is 1.1.14.</b> In this
|
||
version</p>
|
||
|
||
|
||
<ul>
|
||
<li>Shorewall now supports alternate
|
||
configuration directories. When an alternate directory
|
||
is specified when starting or restarting Shorewall (e.g.,
|
||
"shorewall -c /etc/testconf restart"), Shorewall will first
|
||
look for configuration files in the alternate directory then in
|
||
/etc/shorewall. To create an alternate configuration simply:<br>
|
||
1. Create a New Directory<br>
|
||
2. Copy to that directory any
|
||
of your configuration files that you want to change.<br>
|
||
3. Modify the copied files as
|
||
needed.<br>
|
||
4. Restart Shorewall specifying
|
||
the new directory.</li>
|
||
<li>The rules for allowing/disallowing
|
||
icmp echo-requests (pings) are now moved after rules
|
||
created when processing the rules file. This allows you to
|
||
add rules that selectively allow/deny ping based on source or
|
||
destination address.</li>
|
||
<li>Rules that specify multiple
|
||
client ip addresses or subnets no longer cause startup
|
||
failures.</li>
|
||
<li>Zone names in the policy file
|
||
are now validated against the zones file.</li>
|
||
<li>If you have <a
|
||
href="Documentation.htm#MangleEnabled">packet mangling</a> support
|
||
enabled, the "<a href="Documentation.htm#Interfaces">norfc1918</a>"
|
||
interface option now logs and drops any incoming packets
|
||
on the interface that have an RFC 1918 destination address.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>9/12/2001 - The current version of Shorewall is 1.1.13</b>. In this
|
||
version</p>
|
||
|
||
|
||
<ul>
|
||
<li>Shell variables can now be used
|
||
to parameterize Shorewall rules.</li>
|
||
<li>The second column in the hosts
|
||
file may now contain a comma-separated list.<br>
|
||
<br>
|
||
Example:<br>
|
||
<20><><EFBFBD> sea<65><61><EFBFBD> eth0:130.252.100.0/24,206.191.149.0/24</li>
|
||
<li>Handling of multi-zone interfaces
|
||
has been improved. See the <a
|
||
href="Documentation.htm#Interfaces">documentation for the /etc/shorewall/interfaces
|
||
file</a>.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>8/28/2001 - The current version of Shorewall is 1.1.12</b>. In this
|
||
version</p>
|
||
|
||
|
||
<ul>
|
||
<li>Several columns in the rules
|
||
file may now contain comma-separated lists.</li>
|
||
<li>Shorewall is now more rigorous
|
||
in parsing the options in /etc/shorewall/interfaces.</li>
|
||
<li>Complementation using "!" is
|
||
now supported in rules.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>7/28/2001 - The current version of Shorewall is 1.1.11</b>. In this
|
||
version</p>
|
||
|
||
|
||
<ul>
|
||
<li>A "shorewall refresh" command
|
||
has been added to allow for refreshing the rules associated
|
||
with the broadcast address on a dynamic interface. This
|
||
command should be used in place of "shorewall restart" when
|
||
the internet interface's IP address changes.</li>
|
||
<li>The /etc/shorewall/start file
|
||
(if any) is now processed after all temporary rules
|
||
have been deleted. This change prevents the accidental
|
||
removal of rules added during the processing of that file.</li>
|
||
<li>The "dhcp" interface option
|
||
is now applicable to firewall interfaces used by a DHCP
|
||
server running on the firewall.</li>
|
||
<li>The RPM can now be built from
|
||
the .tgz file using "rpm -tb"<22></li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>7/6/2001 - The current version of Shorewall is 1.1.10.</b> In this
|
||
version</p>
|
||
|
||
|
||
<ul>
|
||
<li>Shorewall now enables Ipv4 Packet
|
||
Forwarding by default. Packet forwarding may be disabled
|
||
by specifying IP_FORWARD=Off in /etc/shorewall/shorewall.conf.
|
||
If you don't want Shorewall to enable or disable packet
|
||
forwarding, add IP_FORWARDING=Keep to your /etc/shorewall/shorewall.conf
|
||
file.</li>
|
||
<li>The "shorewall hits" command
|
||
no longer lists extraneous service names in its last report.</li>
|
||
<li>Erroneous instructions in the
|
||
comments at the head of the firewall script have been
|
||
corrected.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>6/23/2001 - The current version of Shorewall is 1.1.9.</b> In this
|
||
version</p>
|
||
|
||
|
||
<ul>
|
||
<li>The "tunnels" file <u>really</u>
|
||
is in the RPM now.</li>
|
||
<li>SNAT can now be applied to port-forwarded
|
||
connections.</li>
|
||
<li>A bug which would cause firewall
|
||
start failures in some dhcp configurations has been fixed.</li>
|
||
<li>The firewall script now issues
|
||
a message if you have the name of an interface in the
|
||
second column in an entry in /etc/shorewall/masq and that
|
||
interface is not up.</li>
|
||
<li>You can now configure Shorewall
|
||
so that it<a href="Documentation.htm#NatEnabled"> doesn't require the
|
||
NAT and/or mangle netfilter modules</a>.</li>
|
||
<li>Thanks to Alex<65> Polishchuk,
|
||
the "hits" command from seawall is now in shorewall.</li>
|
||
<li>Support for <a
|
||
href="IPIP.htm">IPIP tunnels</a> has been added.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>6/18/2001 - The current version of Shorewall is 1.1.8</b>. In this
|
||
version</p>
|
||
|
||
|
||
<ul>
|
||
<li>A typo in the sample rules file
|
||
has been corrected.</li>
|
||
<li>It is now possible to restrict
|
||
masquerading by<a href="Documentation.htm#Masq"> destination host
|
||
or subnet.</a></li>
|
||
<li>It is now possible to have static
|
||
<a href="NAT.htm#LocalPackets">NAT rules applied to packets originating
|
||
on the firewall itself</a>.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>6/2/2001 - The current version of Shorewall is 1.1.7.</b> In this version</p>
|
||
|
||
|
||
<ul>
|
||
<li>The TOS rules are now deleted
|
||
when the firewall is stopped.</li>
|
||
<li>The .rpm will now install regardless
|
||
of which version of iptables is installed.</li>
|
||
<li>The .rpm will now install without
|
||
iproute2 being installed.</li>
|
||
<li>The documentation has been cleaned
|
||
up.</li>
|
||
<li>The sample configuration files
|
||
included in Shorewall have been formatted to 80 columns
|
||
for ease of editing on a VGA console.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>5/25/2001 - The current version of Shorewall is 1.1.6</b>. In this
|
||
version</p>
|
||
|
||
|
||
<ul>
|
||
<li><a
|
||
href="Documentation.htm#lograte">You may now rate-limit the
|
||
packet log.</a></li>
|
||
<li> Previous versions
|
||
of Shorewall have an implementation of Static NAT which violates
|
||
the principle of least surprise.<2E> NAT only occurs for packets
|
||
arriving at (DNAT) or send from (SNAT) the interface named
|
||
in the INTERFACE column of /etc/shorewall/nat. Beginning with
|
||
version 1.1.6, NAT effective regardless of which interface packets
|
||
come from or are destined to. To get compatibility with prior versions,
|
||
I have added a new "ALL <a href="NAT.htm#AllInterFaces">"ALL
|
||
INTERFACES"<22> column to /etc/shorewall/nat</a>. By placing
|
||
"no" or "No" in the new column, the NAT behavior of prior
|
||
versions may be retained.<2E></li>
|
||
<li>The treatment of <a
|
||
href="IPSEC.htm#RoadWarrior">IPSEC Tunnels where the remote
|
||
gateway is a standalone system has been improved</a>. Previously,
|
||
it was necessary to include an additional rule allowing UDP port
|
||
500 traffic to pass through the tunnel. Shorewall will now create
|
||
this rule automatically when you place the name of the remote peer's
|
||
zone in a new GATEWAY ZONE column in /etc/shorewall/tunnels.<2E></li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>5/20/2001 - The current version of Shorewall is 1.1.5.</b> In this
|
||
version</p>
|
||
|
||
|
||
<ul>
|
||
<li><a
|
||
href="Documentation.htm#modules">You may now pass parameters
|
||
when loading netfilter modules and you can specify the modules
|
||
to load.</a></li>
|
||
<li>Compressed modules are now loaded.
|
||
This requires that you modutils support loading compressed
|
||
modules.</li>
|
||
<li><a
|
||
href="Documentation.htm#TOS">You may now set the Type of Service
|
||
(TOS) field in packets.</a></li>
|
||
<li>Corrected rules generated for
|
||
port redirection (again).</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>5/10/2001 - The current version of Shorewall is 1.1.4.</b> In this
|
||
version</p>
|
||
|
||
|
||
<ul>
|
||
<li> <a
|
||
href="Documentation.htm#Conf">Accepting RELATED connections
|
||
is now optional.</a></li>
|
||
<li>Corrected problem where if "shorewall
|
||
start" aborted early (due to kernel configuration errors
|
||
for example), superfluous 'sed' error messages were
|
||
reported.</li>
|
||
<li>Corrected rules generated for
|
||
port redirection.</li>
|
||
<li>The order in which iptables
|
||
kernel modules are loaded has been corrected (Thanks
|
||
to Mark Pavlidis).<2E></li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>4/28/2001 - The current version of Shorewall is 1.1.3.</b> In this
|
||
version</p>
|
||
|
||
|
||
<ul>
|
||
<li>Correct message issued when
|
||
Proxy ARP address added (Thanks to Jason Kirtland).</li>
|
||
<li>/tmp/shorewallpolicy-$$ is now
|
||
removed if there is an error while starting the firewall.</li>
|
||
<li>/etc/shorewall/icmp.def and
|
||
/etc/shorewall/common.def are now used to define the
|
||
icmpdef and common chains unless overridden by the presence
|
||
of /etc/shorewall/icmpdef or /etc/shorewall/common.</li>
|
||
<li>In the .lrp, the file /var/lib/lrpkg/shorwall.conf
|
||
has been corrected. An extra space after "/etc/shorwall/policy"
|
||
has been removed and "/etc/shorwall/rules" has been added.</li>
|
||
<li>When a sub-shell encounters
|
||
a fatal error and has stopped the firewall, it now kills
|
||
the main shell so that the main shell will not continue.</li>
|
||
<li>A problem has been corrected
|
||
where a sub-shell stopped the firewall and main shell
|
||
continued resulting in a perplexing error message referring
|
||
to "common.so" resulted.</li>
|
||
<li>Previously, placing "-" in the
|
||
PORT(S) column in /etc/shorewall/rules resulted in an error
|
||
message during start. This has been corrected.</li>
|
||
<li>The first line of "install.sh"
|
||
has been corrected -- I had inadvertently deleted the initial
|
||
"#".</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>4/12/2001 - The current version of Shorewall is 1.1.2.</b> In this
|
||
version</p>
|
||
|
||
|
||
<ul>
|
||
<li>Port redirection now works again.</li>
|
||
<li>The icmpdef and common chains
|
||
<a href="Documentation.htm#Icmpdef">may now be user-defined</a>.</li>
|
||
<li>The firewall no longer fails
|
||
to start if "routefilter" is specified for an interface
|
||
that isn't started. A warning message is now issued
|
||
in this case.</li>
|
||
<li>The LRP Version is renamed "shorwall"
|
||
for 8,3 MSDOS file system compatibility.</li>
|
||
<li>A couple of LRP-specific problems
|
||
were corrected.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>4/8/2001 - Shorewall is now affiliated with the <a
|
||
href="http://leaf.sourceforge.net">Leaf Project</a> </b> <a
|
||
href="http://leaf.sourceforge.net"> <img border="0"
|
||
src="images/leaflogo.gif" width="49" height="36">
|
||
</a></p>
|
||
|
||
|
||
<p><b>4/5/2001 - The current version of Shorewall is 1.1.1. In this version:</b></p>
|
||
|
||
|
||
<ul>
|
||
<li>The common chain is traversed
|
||
from INPUT, OUTPUT and FORWARD before logging occurs</li>
|
||
<li>The source has been cleaned
|
||
up dramatically</li>
|
||
<li>DHCP DISCOVER packets with RFC1918
|
||
source addresses no longer generate log messages. Linux
|
||
DHCP clients generate such packets and it's annoying
|
||
to see them logged.<2E></li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>3/25/2001 - The current version of Shorewall is 1.1.0. In this version:</b></p>
|
||
|
||
|
||
<ul>
|
||
<li>Log messages now indicate the
|
||
packet disposition.</li>
|
||
<li>Error messages have been improved.</li>
|
||
<li>The ability to define zones
|
||
consisting of an enumerated set of hosts and/or subnetworks
|
||
has been added.</li>
|
||
<li>The zone-to-zone chain matrix
|
||
is now sparse so that only those chains that contain
|
||
meaningful rules are defined.</li>
|
||
<li>240.0.0.0/4 and 169.254.0.0/16
|
||
have been added to the source subnetworks whose packets
|
||
are dropped under the <i>norfc1918</i> interface
|
||
option.</li>
|
||
<li>Exits are now provided for executing
|
||
an user-defined script when a chain is defined, when
|
||
the firewall is initialized, when the firewall is started,
|
||
when the firewall is stopped and when the firewall is cleared.</li>
|
||
<li>The Linux kernel's route filtering
|
||
facility can now be specified selectively on network
|
||
interfaces.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>3/19/2001 - The current version of Shorewall is 1.0.4. This version:</b></p>
|
||
|
||
|
||
<ul>
|
||
<li>Allows user-defined zones. Shorewall
|
||
now has only one pre-defined zone (fw) with the remaining
|
||
zones being defined in the new configuration file /etc/shorewall/zones.
|
||
The /etc/shorewall/zones file released in this version
|
||
provides behavior that is compatible with Shorewall 1.0.3.<2E></li>
|
||
<li>Adds the ability to specify
|
||
logging in entries in the /etc/shorewall/rules file.</li>
|
||
<li>Correct handling of the icmp-def
|
||
chain so that only ICMP packets are sent through the
|
||
chain.</li>
|
||
<li>Compresses the output of "shorewall
|
||
monitor" if awk is installed. Allows the command to work
|
||
if awk isn't installed (although it's not pretty).</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>3/13/2001 - The current version of Shorewall is 1.0.3. This is a bug-fix
|
||
release with no new features.</b></p>
|
||
|
||
|
||
<ul>
|
||
<li>The PATH variable in the firewall
|
||
script now includes /usr/local/bin and /usr/local/sbin.</li>
|
||
<li>DMZ-related chains are now correctly
|
||
deleted if the DMZ is deleted.</li>
|
||
<li>The interface OPTIONS for "gw"
|
||
interfaces are no longer ignored.</li>
|
||
|
||
|
||
</ul>
|
||
|
||
|
||
<p><b>3/8/2001 - The current version of Shorewall is 1.0.2. It supports an
|
||
additional "gw" (gateway) zone for tunnels and it supports
|
||
IPSEC tunnels with end-points on the firewall. There is also
|
||
a .lrp available now.</b></p>
|
||
|
||
|
||
<p><font size="2">Updated 1/28/2003 - <a href="support.htm">Tom Eastep</a>
|
||
</font></p>
|
||
|
||
|
||
<p><a href="copyright.htm"><font size="2"> Copyright</font> <20> <font
|
||
size="2">2001, 2002 Thomas M. Eastep.</font></a><br>
|
||
</p>
|
||
<br>
|
||
<br>
|
||
<br>
|
||
<br>
|
||
</body>
|
||
</html>
|