Section 5: file formats
vardir – Shorewall file Synopsis /etc/shorewall/vardir Description This file does not exist by default. You may create the file if you want to change the directory used by Shorewall to store state information, including compiled firewall scripts. By default, the directory used is /var/lib/shorewall/. The file contains a single variable assignment: VARDIR=directory where directory is…
tunnels – Shorewall VPN definition file Synopsis /etc/shorewall/tunnels Description The tunnels file is used to define rules for encapsulated (usually encrypted) traffic to pass between the Shorewall system and a remote gateway. Traffic flowing through the tunnel is handled using the normal zone/policy/rule mechanism. See m[blue]http://www.shorewall.net/VPNBasics.htmlm[][1] for details. The columns in the file are as…
tos – Shorewall Type of Service rules file Synopsis /etc/shorewall/tos Description This file defines rules for setting Type Of Service (TOS) The columns in the file are as follows. SOURCE – {all|address]|all:address|$FW} If all, may optionally be followed by ":" and an IP address, a MAC address, a subnet specification or the name of an…
tcrules – Shorewall Packet Marking rules file Synopsis /etc/shorewall/tcrules Description Entries in this file cause packets to be marked as a means of classifying them for traffic control or policy routing. Important Unlike rules in the shorewall-rules[1](5) file, evaluation of rules in this file will continue after a match. So the final mark for each…
tcpri – Shorewall file Synopsis /etc/shorewall/tcpri Description This file is used to specify the priority of traffic for simple traffic shaping (TC_ENABLED=Simple in m[blue]shorewall.confm[][1](5)). The priority band of each packet is determined by the last entry that the packet matches. If a packet doesn’t match any entry in this file, then its priority will be…
tcinterfaces – Shorewall file Synopsis /etc/shorewall/tcinterfaces Description This file lists the interfaces that are subject to simple traffic shaping. Simple traffic shaping is enabled by setting TC_ENABLED=Simple in m[blue]shorewall.confm[][1](5). A note on the bandwidth definition used in this file: • don’t use a space between the integer value and the unit: 30kbit is valid while…
tcfilters – Shorewall u32/basic classifier rules file Synopsis /etc/shorewall/tcfilters Description Entries in this file cause packets to be classified for traffic shaping. Beginning with Shorewall 4.4.15, the file may contain entries for both IPv4 and IPv6. By default, all rules apply to IPv4 but that can be changed by inserting a line as follows: IPV4…
tcdevices – Shorewall Traffic Shaping Devices file Synopsis /etc/shorewall/tcdevices Description Entries in this file define the bandwidth for interfaces on which you want traffic shaping to be enabled. If you do not plan to use traffic shaping for a device, don’t put it in here as it limits the throughput of that device to the…
tcclasses – Shorewall file to define HTB and HFSC classes Synopsis /etc/shorewall/tcclasses Description A note on the rate/bandwidth definitions used in this file: • don’t use a space between the integer value and the unit: 30kbit is valid while 30 kbit is NOT. • you can use one of the following units: kpbs Kilobytes per…
stoppedrules – The Shorewall file that governs what traffic flows through the firewall while it is in the ‘stopped’ state. Synopsis /etc/shorewall/stoppedrules Description This file is used to define the hosts that are accessible when the firewall is stopped or is being stopped. Warning Changes to this file do not take effect until after the…
snat – Shorewall SNAT/Masquerade definition file Synopsis /etc/shorewall/snat Description This file is used to define dynamic NAT (Masquerading) and to define Source NAT (SNAT). It superseded m[blue]shorewall-masqm[][1](5) in Shorewall 5.0.14. Warning The entries in this file are order-sensitive. The first entry that matches a particular connection will be the one that is used. Warning If…
secmarks – Shorewall file Synopsis /etc/shorewall/secmarks Description Important Unlike rules in the m[blue]shorewall-rulesm[][1](5) file, evaluation of rules in this file will continue after a match. So the final secmark for each packet will be the one assigned by the LAST rule that matches. The secmarks file is used to associate an SELinux context with packets….
rules – Shorewall rules file Synopsis /etc/shorewall/rules Description Entries in this file govern connection establishment by defining exceptions to the policies laid out in m[blue]shorewall-policym[][1](5). By default, subsequent requests and responses are automatically allowed using connection tracking. For any particular (source,dest) pair of zones, the rules are evaluated in the order in which they appear…
rtrules – Shorewall Routing Rules file Synopsis /etc/shorewall/rtrules Description Entries in this file cause traffic to be routed to one of the providers listed in m[blue]shorewall-providersm[][1](5). The columns in the file are as follows. SOURCE (Optional) – {–|[&]interface|address|interface:address} An ip address (network or host) that matches the source IP address in a packet. May also…
routestopped – The Shorewall file that governs what traffic flows through the firewall while it is in the ‘stopped’ state. Synopsis /etc/shorewall/routestopped Description This file is used to define the hosts that are accessible when the firewall is stopped or is being stopped. Warning Changes to this file do not take effect until after the…
routes – Shorewall file Synopsis /etc/shorewall/routes Description This file was added in Shorewall 4.4.15 and is used to define routes to be added to provider routing tables. The columns in the file are as follows. PROVIDER The name or number of a provider defined in m[blue]shorewall-providersm[][1] (5). Beginning with Shorewall 4.5.14, you may also enter…
route_rules – Shorewall Routing Rules file Synopsis /etc/shorewall/route_rules Description Entries in this file cause traffic to be routed to one of the providers listed in shorewall-providers[1](5). The columns in the file are as follows. SOURCE (Optional) – {–|interface|address|interface:address} An ip address (network or host) that matches the source IP address in a packet. May also…
proxyarp – Shorewall Proxy ARP file Synopsis /etc/shorewall/proxyarp Description This file is used to define Proxy ARP. There is one entry in this file for each IP address to be proxied. The columns in the file are as follows. ADDRESS – address IP Address. INTERFACE – interface (Optional as of Shorewall 4.4.16) Local interface where…
providers – Shorewall Providers file Synopsis /etc/shorewall/providers Description This file is used to define additional routing tables. You will want to define an additional table if: • You have connections to more than one ISP or multiple connections to the same ISP • You run Squid as a transparent proxy on a host other than…
policy – Shorewall policy file Synopsis /etc/shorewall/policy Description This file defines the high-level policy for connections between zones defined in m[blue]shorewall-zonesm[][1](5). Important The order of entries in this file is important This file determines what to do with a new connection request if we don’t get a match from the /etc/shorewall/rules file . For each…