tunnels – Shorewall6 VPN definition file Synopsis /etc/shorewall6/tunnels Description The tunnels file is used to define rules for encapsulated (usually encrypted) traffic to pass between the Shorewall6 system and a remote gateway. Traffic flowing through the tunnel is handled using the normal zone/policy/rule mechanism. See m[blue]http://www.shorewall.net/VPNBasics.htmlm[][1] for details. The columns in the file are as…
tcpri – Shorewall6 file Synopsis /etc/shorewall6/tcpri Description This file is used to specify the priority band of traffic for simple traffic shaping (TC_ENABLED=Simple in m[blue]shorewall6.confm[][1](5)). The priority band of each packet is determined by the last entry that the packet matches. If a packet doesn’t match any entry in this file, then its priority will…
tcinterfaces – Shorewall6 file Synopsis /etc/shorewall6/tcinterfaces Description This file lists the interfaces that are subject to simple traffic shaping. Simple traffic shaping is enabled by setting TC_ENABLED=Simple in m[blue]shorewall6.confm[][1](5). A note on the bandwidth definition used in this file: • don’t use a space between the integer value and the unit: 30kbit is valid while…
tcfilters – shorewall6 u32/basic classifier rules file Synopsis /etc/shorewall6/tcfilters Description Entries in this file cause packets to be classified for traffic shaping. Beginning with Shorewall 4.4.15, the file may contain entries for both IPv4 and IPv6. By default, all rules apply to IPv6 but that can be changed by inserting a line as follows: IPV4…
tcdevices – Shorewall6 Traffic Shaping Devices file Synopsis /etc/shorewall6/tcdevices Description Entries in this file define the bandwidth for interfaces on which you want traffic shaping to be enabled. If you do not plan to use traffic shaping for a device, don’t put it in here as it limits the throughput of that device to the…
tcclasses – Shorewall6 file to define HTB and HFSC classes Synopsis /etc/shorewall6/tcclasses Description A note on the rate/bandwidth definitions used in this file: • don’t use a space between the integer value and the unit: 30kbit is valid while 30 kbit is NOT. • you can use one of the following units: kpbs Kilobytes per…
stoppedrules – The Shorewall file that governs what traffic flows through the firewall while it is in the ‘stopped’ state. Synopsis /etc/shorewall6/stoppedrules Description This file is used to define the hosts that are accessible when the firewall is stopped or is being stopped. Warning Changes to this file do not take effect until after the…
snat – Shorewall6 SNAT/Masquerade definition file Synopsis /etc/shorewall6/snat Description This file is used to define dynamic NAT (Masquerading) and to define Source NAT (SNAT). While still supported, its use is deprecated in favor of m[blue]shorewall6-snatm[][1](5) which was introduced in Shorewall 5.0.14. Warning The entries in this file are order-sensitive. The first entry that matches a…
secmarks – Shorewall6 file Synopsis /etc/shorewall6/secmarks Description Important Unlike rules in the m[blue]shorewall6-rulesm[][1](5) file, evaluation of rules in this file will continue after a match. So the final secmark for each packet will be the one assigned by the LAST rule that matches. The secmarks file is used to associate an SELinux context with packets….
rules – Shorewall6 rules file Synopsis /etc/shorewall6/rules Description Entries in this file govern connection establishment by defining exceptions to the policies laid out in m[blue]shorewall6-policym[][1](5). By default, subsequent requests and responses are automatically allowed using connection tracking. For any particular (source,dest) pair of zones, the rules are evaluated in the order in which they appear…
rtrules – Shorewall6 Routing Rules file Synopsis /etc/shorewall6/rtrules Description Entries in this file cause traffic to be routed to one of the providers listed in m[blue]shorewall6-providersm[][1](5). The columns in the file are as follows. SOURCE (Optional) – {–|interface|address|interface:<address>} An ip address (network or host) that matches the source IP address in a packet. May also…
routes – Shorewall6 file Synopsis /etc/shorewall6/routes Description This file was added in Shorewall 4.4.15 and is used to define routes to be added to provider routing tables. The columns in the file are as follows. PROVIDER The name or number of a provider defined in m[blue]shorewall6-providersm[][1] (5). Beginning with Shorewall 4.5.14, you may also enter…
proxyndp – Shorewall6 Proxy NDP file Synopsis /etc/shorewall6/proxyndp Description This file was added in Shorewall 4.4.16 and is used to define Proxy NDP. There is one entry in this file for each IPv6 address to be proxied. The columns in the file are as follows. ADDRESS – address IPv6 Address. INTERFACE – interface (Optional) Local…
providers – Shorewall6 Providers file Synopsis /etc/shorewall6/providers Description This file is used to define additional routing tables. You will want to define an additional table if: • You have connections to more than one ISP or multiple connections to the same ISP • You run Squid as a transparent proxy on a host other than…
policy – shorewall6 policy file Synopsis /etc/shorewall6/policy Description This file defines the high-level policy for connections between zones defined in m[blue]shorewall6-zonesm[][1](5). Important The order of entries in this file is important This file determines what to do with a new connection request if we don’t get a match from the /etc/shorewall6/rules file . For each…
params – Shorewall6 parameters file Synopsis /etc/shorewall6/params Description Assign any shell variables that you need in this file. The file is always processed by /bin/sh or by the shell specified through SHOREWALL_SHELL in m[blue]shorewall6.confm[][1] (5) so the full range of shell capabilities may be used. It is suggested that variable names begin with an upper…
netmap – Shorewall6 NETMAP definition file Synopsis /etc/shorewall/netmap Description This file is used to map addresses in one network to corresponding addresses in a second network. It was added in Shorewall6 4.4.23.3. Warning To use this file, your kernel and ip6tables must have RAWPOST table support included. The columns in the file are as follows…
nat – Shorewall6 one-to-one NAT file Synopsis /etc/shorewall6/nat Description This file is used to define one-to-one Network Address Translation (NAT). Warning If all you want to do is simple port forwarding, do NOT use this file. See m[blue]http://www.shorewall.net/FAQ.htm#faq1m[][1]. The columns in the file are as follows (where the column name is followed by a different…
modules – shorewall6 file Synopsis /usr/share/shorewall6/modules /usr/share/shorewall6/helpers Description These files specify which kernel modules shorewall6 will load before trying to determine your ip6tables/kernel’s capabilities. The modules file is used when LOAD_HELPERS_ONLY=No in m[blue]shorewall6.confm[][1](5); the helpers file is used when LOAD_HELPERS_ONLY=Yes. Each record in the files has the following format: loadmodule modulename [moduleoption…] The modulename names…