nat – Shorewall one-to-one NAT file Synopsis /etc/shorewall/nat Description This file is used to define one-to-one Network Address Translation (NAT). Warning If all you want to do is simple port forwarding, do NOT use this file. See m[blue]http://www.shorewall.net/FAQ.htm#faq1m[][1]. Also, in many cases, Proxy ARP (m[blue]shorewall-proxyarpm[][2](5)) is a better solution that one-to-one NAT. The columns in…
modules – Shorewall file Synopsis /usr/share/shorewall/modules /usr/share/shorewall/helpers Description These files specify which kernel modules Shorewall will load before trying to determine your iptables/kernel’s capabilities. The modules file is used when LOAD_HELPERS_ONLY=No in m[blue]shorewall.confm[][1](8); the helpers file is used when LOAD_HELPERS_ONLY=Yes Each record in the files has the following format: loadmodule modulename [moduleoption…] The modulename names…
masq – Shorewall Masquerade/SNAT definition file Synopsis /etc/shorewall/masq Description This file is used to define dynamic NAT (Masquerading) and to define Source NAT (SNAT). While still supported, its use is deprecated in favor of m[blue]shorewall-snatm[][1](5) which was introduced in Shorewall 5.0.14. Warning The entries in this file are order-sensitive. The first entry that matches a…
mangle – Shorewall Packet marking/mangling rules file Synopsis /etc/shorewall/mangle Description This file was introduced in Shorewall 4.6.0 and is intended to replace m[blue]shorewall-tcrules(5)m[][1]. This file is only processed by the compiler if: 1. No file named ‘tcrules’ exists on the current CONFIG_PATH (see m[blue]shorewall.conf(5)m[][2]); or 2. The first file named ‘tcrules’ found on the CONFIG_PATH…
maclist – Shorewall MAC Verification file Synopsis /etc/shorewall/maclist Description This file is used to define the MAC addresses and optionally their associated IP addresses to be allowed to use the specified interface. The feature is enabled by using the maclist option in the m[blue]shorewall-interfacesm[][1](5) or m[blue]shorewall-hostsm[][2](5) configuration file. The columns in the file are as…
shorewall-lite.conf – Shorewall Lite global configuration file Synopsis /etc/shorewall-lite/shorewall-lite.conf Description This file sets options that apply to Shorewall Lite as a whole. The file consists of Shell comments (lines beginning with ‘#’), blank lines and assignment statements (variable=value). Each variable’s setting is preceded by comments that describe the variable and it’s effect. Any option not…
vardir – Shorewall Lite file Synopsis /etc/shorewall-lite/vardir Description This file does not exist by default. You may create the file if you want to change the directory used by Shorewall Lite to store state information, including compiled firewall scripts. By default, the directory used is /var/lib/shorewall-lite/. The file contains a single variable assignment: VARDIR=directory where…
ipsets – Specifying the name if an ipset in Shorewall configuration files Synopsis +ipsetname +ipsetname[flag,…] +[ipsetname,…] Description Note: In the above syntax descriptions, the square brackets ("[]") are to be taken literally rather than as meta-characters. In most places where a network address may be entered, an ipset may be substituted. Set names must be…
interfaces – Shorewall interfaces file Synopsis /etc/shorewall/interfaces Description The interfaces file serves to define the firewall’s network interfaces to Shorewall. The order of entries in this file is not significant in determining zone composition. Beginning with Shorewall 4.5.3, the interfaces file supports two different formats: FORMAT 1 (default – deprecated) There is a BROADCAST column…
hosts – Shorewall file Synopsis /etc/shorewall/hosts Description This file is used to define zones in terms of subnets and/or individual IP addresses. Most simple setups don’t need to (should not) place anything in this file. The order of entries in this file is not significant in determining zone composition. Rather, the order that the zones…
exclusion – Exclude a set of hosts from a definition in a shorewall configuration file. Synopsis !address-or-range[,address-or-range]… !zone-name[,zone-name]… Description The first form of exclusion is used when you wish to exclude one or more addresses from a definition. An exclamation point is followed by a comma-separated list of addresses. The addresses may be single host…
ecn – Shorewall ECN file Synopsis /etc/shorewall/ecn Description Use this file to list the destinations for which you want to disable ECN (Explicit Congestion Notification). The columns in the file are as follows. INTERFACE – interface Interface through which host(s) communicate with the firewall HOST(S) (Optional) – [–|address-or-address-range[,address-or-address-range]…] Comma-separated list of host and/or network addresses….
conntrack – shorewall conntrack file Synopsis /etc/shorewall/conntrack Description The original intent of the notrack file was to exempt certain traffic from Netfilter connection tracking. Traffic matching entries in the file were not to be tracked. The role of the file was expanded in Shorewall 4.4.27 to include all rules that can be added in the…
blrules – shorewall Blacklist file Synopsis /etc/shorewall/blrules Description This file is used to perform blacklisting and whitelisting. Rules in this file are applied depending on the setting of BLACKLISTNEWONLY in m[blue]shorewall.confm[][1](5). If BLACKLISTNEWONLY=No, then they are applied regardless of the connection tracking state of the packet. If BLACKLISTNEWONLY=Yes, they are applied to connections in the…
blacklist – Shorewall Blacklist file Synopsis /etc/shorewall/blacklist Description The blacklist file is used to perform static blacklisting. You can blacklist by source address (IP or MAC), or by application. The columns in the file are as follows. ADDRESS/SUBNET – {–|~mac-address|ip-address|address-range|+ipset} Host address, network address, MAC address, IP address range (if your kernel and iptables contain…
arprules – Shorewall ARP rules file Synopsis /etc/shorewall/arprules Description This file was added in Shorewall 4.5.12 and is used to describe low-level rules managed by arptables (8). These rules only affect Address Resolution Protocol (ARP), Reverse Address Resolution Protocol (RARP) and Dynamic Reverse Address Resolution Protocol (DRARP) frames. The columns in the file are as…
actions – Shorewall action declaration file Synopsis /etc/shorewall/actions Description This file allows you to define new ACTIONS for use in rules (see m[blue]shorewall-rules(5)m[][1]). You define the iptables rules to be performed in an ACTION in /etc/shorewall/action.action-name. Columns are: NAME The name of the action. ACTION names should begin with an upper-case letter to distinguish them…
accounting – Shorewall Accounting file Synopsis /etc/shorewall/accounting Description Accounting rules exist simply to count packets and bytes in categories that you define in this file. You may display these rules and their packet and byte counters using the shorewall show accounting command. Beginning with Shorewall 4.4.18, the accounting structure can be created with three root…
shigofumirc – Configuration file for Shigofumi Description Configuration for shigofumi is loaded from .shigofumirc in user’s home directory by default. The file is plain text file with simple syntax: Setting is stored in option = value format. If value is a type of string, it must be delimited by quotation marks. Boolean values can be…
shells – pathnames of valid login shells Description /etc/shells is a text file which contains the full pathnames of valid login shells. This file is consulted by chsh(1) and available to be queried by other programs. Be aware that there are programs which consult this file to find out if a user is a normal…