tcpri – Shorewall file Synopsis /etc/shorewall/tcpri Description This file is used to specify the priority of traffic for simple traffic shaping (TC_ENABLED=Simple in m[blue]shorewall.confm[][1](5)). The priority band of each packet is determined by the last entry that the packet matches. If a packet doesn’t match any entry in this file, then its priority will be…
tcinterfaces – Shorewall file Synopsis /etc/shorewall/tcinterfaces Description This file lists the interfaces that are subject to simple traffic shaping. Simple traffic shaping is enabled by setting TC_ENABLED=Simple in m[blue]shorewall.confm[][1](5). A note on the bandwidth definition used in this file: • don’t use a space between the integer value and the unit: 30kbit is valid while…
tcfilters – Shorewall u32/basic classifier rules file Synopsis /etc/shorewall/tcfilters Description Entries in this file cause packets to be classified for traffic shaping. Beginning with Shorewall 4.4.15, the file may contain entries for both IPv4 and IPv6. By default, all rules apply to IPv4 but that can be changed by inserting a line as follows: IPV4…
tcdevices – Shorewall Traffic Shaping Devices file Synopsis /etc/shorewall/tcdevices Description Entries in this file define the bandwidth for interfaces on which you want traffic shaping to be enabled. If you do not plan to use traffic shaping for a device, don’t put it in here as it limits the throughput of that device to the…
tcclasses – Shorewall file to define HTB and HFSC classes Synopsis /etc/shorewall/tcclasses Description A note on the rate/bandwidth definitions used in this file: • don’t use a space between the integer value and the unit: 30kbit is valid while 30 kbit is NOT. • you can use one of the following units: kpbs Kilobytes per…
stoppedrules – The Shorewall file that governs what traffic flows through the firewall while it is in the ‘stopped’ state. Synopsis /etc/shorewall/stoppedrules Description This file is used to define the hosts that are accessible when the firewall is stopped or is being stopped. Warning Changes to this file do not take effect until after the…
snat – Shorewall SNAT/Masquerade definition file Synopsis /etc/shorewall/snat Description This file is used to define dynamic NAT (Masquerading) and to define Source NAT (SNAT). It superseded m[blue]shorewall-masqm[][1](5) in Shorewall 5.0.14. Warning The entries in this file are order-sensitive. The first entry that matches a particular connection will be the one that is used. Warning If…
secmarks – Shorewall file Synopsis /etc/shorewall/secmarks Description Important Unlike rules in the m[blue]shorewall-rulesm[][1](5) file, evaluation of rules in this file will continue after a match. So the final secmark for each packet will be the one assigned by the LAST rule that matches. The secmarks file is used to associate an SELinux context with packets….
rules – Shorewall rules file Synopsis /etc/shorewall/rules Description Entries in this file govern connection establishment by defining exceptions to the policies laid out in m[blue]shorewall-policym[][1](5). By default, subsequent requests and responses are automatically allowed using connection tracking. For any particular (source,dest) pair of zones, the rules are evaluated in the order in which they appear…
rtrules – Shorewall Routing Rules file Synopsis /etc/shorewall/rtrules Description Entries in this file cause traffic to be routed to one of the providers listed in m[blue]shorewall-providersm[][1](5). The columns in the file are as follows. SOURCE (Optional) – {–|[&]interface|address|interface:address} An ip address (network or host) that matches the source IP address in a packet. May also…
routestopped – The Shorewall file that governs what traffic flows through the firewall while it is in the ‘stopped’ state. Synopsis /etc/shorewall/routestopped Description This file is used to define the hosts that are accessible when the firewall is stopped or is being stopped. Warning Changes to this file do not take effect until after the…
routes – Shorewall file Synopsis /etc/shorewall/routes Description This file was added in Shorewall 4.4.15 and is used to define routes to be added to provider routing tables. The columns in the file are as follows. PROVIDER The name or number of a provider defined in m[blue]shorewall-providersm[][1] (5). Beginning with Shorewall 4.5.14, you may also enter…
route_rules – Shorewall Routing Rules file Synopsis /etc/shorewall/route_rules Description Entries in this file cause traffic to be routed to one of the providers listed in shorewall-providers[1](5). The columns in the file are as follows. SOURCE (Optional) – {–|interface|address|interface:address} An ip address (network or host) that matches the source IP address in a packet. May also…
proxyarp – Shorewall Proxy ARP file Synopsis /etc/shorewall/proxyarp Description This file is used to define Proxy ARP. There is one entry in this file for each IP address to be proxied. The columns in the file are as follows. ADDRESS – address IP Address. INTERFACE – interface (Optional as of Shorewall 4.4.16) Local interface where…
providers – Shorewall Providers file Synopsis /etc/shorewall/providers Description This file is used to define additional routing tables. You will want to define an additional table if: • You have connections to more than one ISP or multiple connections to the same ISP • You run Squid as a transparent proxy on a host other than…
policy – Shorewall policy file Synopsis /etc/shorewall/policy Description This file defines the high-level policy for connections between zones defined in m[blue]shorewall-zonesm[][1](5). Important The order of entries in this file is important This file determines what to do with a new connection request if we don’t get a match from the /etc/shorewall/rules file . For each…
params – Shorewall parameters file Synopsis /etc/shorewall/params Description Assign any shell variables that you need in this file. The file is always processed by /bin/sh or by the shell specified through SHOREWALL_SHELL in m[blue]shorewall.confm[][1] (5) so the full range of shell capabilities may be used. It is suggested that variable names begin with an upper…
notrack – shorewall notrack file Synopsis /etc/shorewall/notrack Description The notrack file is used to exempt certain traffic from Netfilter connection tracking. Traffic matching entries in this file will not be tracked. The columns in the file are as follows. SOURCE – {zone[:interface][:address-list]|COMMENT} where zone is the name of a zone, interface is an interface to…
netmap – Shorewall NETMAP definition file Synopsis /etc/shorewall/netmap Description This file is used to map addresses in one network to corresponding addresses in a second network. Warning To use this file, your kernel and iptables must have NETMAP support included. The columns in the file are as follows (where the column name is followed by…
nesting – Shorewall Nested Zones Synopsis child-zone[:parent-zone[,parent-zone]…] Description In m[blue]shorewall-zonesm[][1](5), a zone may be declared to be a sub-zone of one or more other zones using the above syntax. The child-zone may be neither the firewall zone nor a vserver zone. The firewall zone may not appear as a parent zone, although all vserver zones…