masq – Shorewall6 Masquerade/SNAT definition file Synopsis /etc/shorewall6/masq Description Use this file to define Source NAT (SNAT). Requires Shorewall 4.5.14 or later. Warning The entries in this file are order-sensitive. The first entry that matches a particular connection will be the one that is used. Warning If you have more than one ISP link, adding…
mangle – Shorewall Packet marking/mangling rules file Synopsis /etc/shorewall6/mangle Description This file was introduced in Shorewall 4.6.0 and is intended to replace m[blue]shorewall6-tcrules(5)m[][1]. This file is only processed by the compiler if: 1. No file named ‘tcrules’ exists on the current CONFIG_PATH (see m[blue]shorewall6.conf(5)m[][2]); or 2. The first file named ‘tcrules’ found on the CONFIG_PATH…
maclist – shorewall6 MAC Verification file Synopsis /etc/shorewall6/maclist Description This file is used to define the MAC addresses and optionally their associated IPv6 addresses to be allowed to use the specified interface. The feature is enabled by using the maclist option in the m[blue]shorewall6-interfacesm[][1](5) or m[blue]shorewall6-hostsm[][2](5) configuration file. The columns in the file are as…
shorewall6-lite.conf – Shorewall6 Lite global configuration file Synopsis /etc/shorewall6-lite/shorewall6-lite.conf Description This file sets options that apply to Shorewall6 Lite as a whole. The file consists of Shell comments (lines beginning with ‘#’), blank lines and assignment statements (variable=value). Each variable’s setting is preceded by comments that describe the variable and it’s effect. Any option not…
vardir – Shorewall6 Lite file Synopsis /etc/shorewall6-lite/vardir Description This file does not exist by default. You may create the file if you want to change the directory used by Shorewall6 Lite to store state information, including compiled firewall scripts. By default, the directory used is /var/lib/shorewall6-lite/. The file contains a single variable assignment: VARDIR=directory where…
ipsets – Specifying the name if an ipset in Shorewall6 configuration files Synopsis +ipsetname +ipsetname[flag,…] +[ipsetname,…] Description Note: In the above syntax descriptions, the square brackets ("[]") are to be taken literally rather than as meta-characters. In most places where a network address may be entered, an ipset may be substituted. Set names must be…
interfaces – shorewall6 interfaces file Synopsis /etc/shorewall6/interfaces Description The interfaces file serves to define the firewall’s network interfaces to shorewall6. The order of entries in this file is not significant in determining zone composition. Beginning with Shorewall 4.5.3, the interfaces file supports two different formats: FORMAT 1 (default – deprecated) There is a ANYCAST column…
exclusion – Exclude a set of hosts from a definition in a shorewall6 configuration file. Synopsis !address-or-range[,address-or-range]… !zone-name[,zone-name]… Description Exclusion is used when you wish to exclude one or more addresses from a definition. An exclamation point is followed by a comma-separated list of addresses. The addresses may be single host addresses (e.g., fe80::2a0:ccff:fedb:31c4) or…
conntrack – shorewall6 conntrack file Synopsis /etc/shorewall6/conntrack Description The original intent of the notrack file was to exempt certain traffic from Netfilter connection tracking. Traffic matching entries in the file were not to be tracked. The role of the file was expanded in Shorewall 4.4.27 to include all rules that can be added in the…
blrules – shorewall6 Blacklist file Synopsis /etc/shorewall6/blrules Description This file is used to perform zone-specific blacklisting and whitelisting. Rules in this file are applied depending on the setting of BLACKLISTNEWONLY in m[blue]shorewall6.confm[][1](5). If BLACKLISTNEWONLY=No, then they are applied regardless of the connection tracking state of the packet. If BLACKLISTNEWONLY=Yes, they are applied to connections in…
actions – shorewall6 action declaration file Synopsis /etc/shorewall6/actions Description This file allows you to define new ACTIONS for use in rules (see m[blue]shorewall6-rules(5)m[][1]). You define the ip6tables rules to be performed in an ACTION in /etc/shorewall6/action.action-name. Columns are: NAME The name of the action. ACTION names should begin with an upper-case letter to distinguish them…
accounting – Shorewall6 Accounting file Synopsis /etc/shorewall6/accounting Description Accounting rules exist simply to count packets and bytes in categories that you define in this file. You may display these rules and their packet and byte counters using the shorewall6 show accounting command. Beginning with Shorewall 4.4.18, the accounting structure can be created with three root…
shorewall.conf – Shorewall global configuration file Synopsis /etc/shorewall/shorewall.conf Description This file sets options that apply to Shorewall as a whole. The file consists of Shell comments (lines beginning with ‘#’), blank lines and assignment statements (variable=value). If the value contains shell metacharacters or white-space, then it must be enclosed in quotes. Example: MACLIST_LOG_LEVEL="NFLOG(1,0,1)". Options Many…
shorewall.conf – Shorewall global configuration file Synopsis /etc/shorewall/shorewall.conf Description This file sets options that apply to Shorewall as a whole. The file consists of Shell comments (lines beginning with ‘#’), blank lines and assignment statements (variable=value). If the value contains shell meta characters or white-space, then it must be enclosed in quotes. Example: MACLIST_LOG_LEVEL="NFLOG(1,0,1)". Options…
zones – Shorewall zone declaration file Synopsis /etc/shorewall/zones Description The /etc/shorewall/zones file declares your network zones. You specify the hosts in each zone through entries in /etc/shorewall/interfaces or /etc/shorewall/hosts. The columns in the file are as follows (where the column name is followed by a different name in parentheses, the different name is used in…
vardir – Shorewall file Synopsis /etc/shorewall/vardir Description This file does not exist by default. You may create the file if you want to change the directory used by Shorewall to store state information, including compiled firewall scripts. By default, the directory used is /var/lib/shorewall/. The file contains a single variable assignment: VARDIR=directory where directory is…
tunnels – Shorewall VPN definition file Synopsis /etc/shorewall/tunnels Description The tunnels file is used to define rules for encapsulated (usually encrypted) traffic to pass between the Shorewall system and a remote gateway. Traffic flowing through the tunnel is handled using the normal zone/policy/rule mechanism. See m[blue]http://www.shorewall.net/VPNBasics.htmlm[][1] for details. The columns in the file are as…
tos – Shorewall Type of Service rules file Synopsis /etc/shorewall/tos Description This file defines rules for setting Type Of Service (TOS) The columns in the file are as follows. SOURCE – {all|address]|all:address|$FW} If all, may optionally be followed by ":" and an IP address, a MAC address, a subnet specification or the name of an…
tcrules – Shorewall Packet Marking rules file Synopsis /etc/shorewall/tcrules Description Entries in this file cause packets to be marked as a means of classifying them for traffic control or policy routing. Important Unlike rules in the shorewall-rules[1](5) file, evaluation of rules in this file will continue after a match. So the final mark for each…