Section 5: file formats
params – Shorewall parameters file Synopsis /etc/shorewall/params Description Assign any shell variables that you need in this file. The file is always processed by /bin/sh or by the shell specified through SHOREWALL_SHELL in m[blue]shorewall.confm[][1] (5) so the full range of shell capabilities may be used. It is suggested that variable names begin with an upper…
notrack – shorewall notrack file Synopsis /etc/shorewall/notrack Description The notrack file is used to exempt certain traffic from Netfilter connection tracking. Traffic matching entries in this file will not be tracked. The columns in the file are as follows. SOURCE – {zone[:interface][:address-list]|COMMENT} where zone is the name of a zone, interface is an interface to…
netmap – Shorewall NETMAP definition file Synopsis /etc/shorewall/netmap Description This file is used to map addresses in one network to corresponding addresses in a second network. Warning To use this file, your kernel and iptables must have NETMAP support included. The columns in the file are as follows (where the column name is followed by…
nesting – Shorewall Nested Zones Synopsis child-zone[:parent-zone[,parent-zone]…] Description In m[blue]shorewall-zonesm[][1](5), a zone may be declared to be a sub-zone of one or more other zones using the above syntax. The child-zone may be neither the firewall zone nor a vserver zone. The firewall zone may not appear as a parent zone, although all vserver zones…
nat – Shorewall one-to-one NAT file Synopsis /etc/shorewall/nat Description This file is used to define one-to-one Network Address Translation (NAT). Warning If all you want to do is simple port forwarding, do NOT use this file. See m[blue]http://www.shorewall.net/FAQ.htm#faq1m[][1]. Also, in many cases, Proxy ARP (m[blue]shorewall-proxyarpm[][2](5)) is a better solution that one-to-one NAT. The columns in…
modules – Shorewall file Synopsis /usr/share/shorewall/modules /usr/share/shorewall/helpers Description These files specify which kernel modules Shorewall will load before trying to determine your iptables/kernel’s capabilities. The modules file is used when LOAD_HELPERS_ONLY=No in m[blue]shorewall.confm[][1](8); the helpers file is used when LOAD_HELPERS_ONLY=Yes Each record in the files has the following format: loadmodule modulename [moduleoption…] The modulename names…
masq – Shorewall Masquerade/SNAT definition file Synopsis /etc/shorewall/masq Description This file is used to define dynamic NAT (Masquerading) and to define Source NAT (SNAT). While still supported, its use is deprecated in favor of m[blue]shorewall-snatm[][1](5) which was introduced in Shorewall 5.0.14. Warning The entries in this file are order-sensitive. The first entry that matches a…
mangle – Shorewall Packet marking/mangling rules file Synopsis /etc/shorewall/mangle Description This file was introduced in Shorewall 4.6.0 and is intended to replace m[blue]shorewall-tcrules(5)m[][1]. This file is only processed by the compiler if: 1. No file named ‘tcrules’ exists on the current CONFIG_PATH (see m[blue]shorewall.conf(5)m[][2]); or 2. The first file named ‘tcrules’ found on the CONFIG_PATH…
maclist – Shorewall MAC Verification file Synopsis /etc/shorewall/maclist Description This file is used to define the MAC addresses and optionally their associated IP addresses to be allowed to use the specified interface. The feature is enabled by using the maclist option in the m[blue]shorewall-interfacesm[][1](5) or m[blue]shorewall-hostsm[][2](5) configuration file. The columns in the file are as…
shorewall-lite.conf – Shorewall Lite global configuration file Synopsis /etc/shorewall-lite/shorewall-lite.conf Description This file sets options that apply to Shorewall Lite as a whole. The file consists of Shell comments (lines beginning with ‘#’), blank lines and assignment statements (variable=value). Each variable’s setting is preceded by comments that describe the variable and it’s effect. Any option not…
vardir – Shorewall Lite file Synopsis /etc/shorewall-lite/vardir Description This file does not exist by default. You may create the file if you want to change the directory used by Shorewall Lite to store state information, including compiled firewall scripts. By default, the directory used is /var/lib/shorewall-lite/. The file contains a single variable assignment: VARDIR=directory where…
ipsets – Specifying the name if an ipset in Shorewall configuration files Synopsis +ipsetname +ipsetname[flag,…] +[ipsetname,…] Description Note: In the above syntax descriptions, the square brackets ("[]") are to be taken literally rather than as meta-characters. In most places where a network address may be entered, an ipset may be substituted. Set names must be…
interfaces – Shorewall interfaces file Synopsis /etc/shorewall/interfaces Description The interfaces file serves to define the firewall’s network interfaces to Shorewall. The order of entries in this file is not significant in determining zone composition. Beginning with Shorewall 4.5.3, the interfaces file supports two different formats: FORMAT 1 (default – deprecated) There is a BROADCAST column…
hosts – Shorewall file Synopsis /etc/shorewall/hosts Description This file is used to define zones in terms of subnets and/or individual IP addresses. Most simple setups don’t need to (should not) place anything in this file. The order of entries in this file is not significant in determining zone composition. Rather, the order that the zones…
exclusion – Exclude a set of hosts from a definition in a shorewall configuration file. Synopsis !address-or-range[,address-or-range]… !zone-name[,zone-name]… Description The first form of exclusion is used when you wish to exclude one or more addresses from a definition. An exclamation point is followed by a comma-separated list of addresses. The addresses may be single host…
ecn – Shorewall ECN file Synopsis /etc/shorewall/ecn Description Use this file to list the destinations for which you want to disable ECN (Explicit Congestion Notification). The columns in the file are as follows. INTERFACE – interface Interface through which host(s) communicate with the firewall HOST(S) (Optional) – [–|address-or-address-range[,address-or-address-range]…] Comma-separated list of host and/or network addresses….
conntrack – shorewall conntrack file Synopsis /etc/shorewall/conntrack Description The original intent of the notrack file was to exempt certain traffic from Netfilter connection tracking. Traffic matching entries in the file were not to be tracked. The role of the file was expanded in Shorewall 4.4.27 to include all rules that can be added in the…
blrules – shorewall Blacklist file Synopsis /etc/shorewall/blrules Description This file is used to perform blacklisting and whitelisting. Rules in this file are applied depending on the setting of BLACKLISTNEWONLY in m[blue]shorewall.confm[][1](5). If BLACKLISTNEWONLY=No, then they are applied regardless of the connection tracking state of the packet. If BLACKLISTNEWONLY=Yes, they are applied to connections in the…
blacklist – Shorewall Blacklist file Synopsis /etc/shorewall/blacklist Description The blacklist file is used to perform static blacklisting. You can blacklist by source address (IP or MAC), or by application. The columns in the file are as follows. ADDRESS/SUBNET – {–|~mac-address|ip-address|address-range|+ipset} Host address, network address, MAC address, IP address range (if your kernel and iptables contain…
arprules – Shorewall ARP rules file Synopsis /etc/shorewall/arprules Description This file was added in Shorewall 4.5.12 and is used to describe low-level rules managed by arptables (8). These rules only affect Address Resolution Protocol (ARP), Reverse Address Resolution Protocol (RARP) and Dynamic Reverse Address Resolution Protocol (DRARP) frames. The columns in the file are as…