| shorewall-mangle.xml (shorewall-docs-xml-5.2.3.6.tar.bz2) | : | shorewall-mangle.xml (shorewall-docs-xml-5.2.6.tar.bz2) |
|---|
| | |
| skipping to change at line 29 | | skipping to change at line 29 |
|---|
| <refsynopsisdiv> | | <refsynopsisdiv> |
| <cmdsynopsis> | | <cmdsynopsis> |
| <command>/etc/shorewall[6]/mangle</command> | | <command>/etc/shorewall[6]/mangle</command> |
| </cmdsynopsis> | | </cmdsynopsis> |
| </refsynopsisdiv> | | </refsynopsisdiv> |
| | |
| <refsect1> | | <refsect1> |
| <title>Description</title> | | <title>Description</title> |
| | |
| <para>This file was introduced in Shorewall 4.6.0 and replaces <ulink | | <para>This file was introduced in Shorewall 4.6.0 and replaces <ulink |
|
| url="/manpages/shorewall-tcrules.html">shorewall-tcrules(5)</ulink>. This | | url="shorewall-tcrules.html">shorewall-tcrules(5)</ulink>. This |
| file is only processed by the compiler if:</para> | | file is only processed by the compiler if:</para> |
| | |
| <para>Entries in this file cause packets to be marked as a means of | | <para>Entries in this file cause packets to be marked as a means of |
| classifying them for traffic control or policy routing.</para> | | classifying them for traffic control or policy routing.</para> |
| | |
| <important> | | <important> |
| <para>Unlike rules in the <ulink | | <para>Unlike rules in the <ulink |
|
| url="/manpages/shorewall-rules.html">shorewall-rules</ulink>(5) file, | | url="shorewall-rules.html">shorewall-rules</ulink>(5) file, |
| evaluation of rules in this file will continue after a match. So the | | evaluation of rules in this file will continue after a match. So the |
| final mark for each packet will be the one assigned by the LAST tcrule | | final mark for each packet will be the one assigned by the LAST tcrule |
| that matches.</para> | | that matches.</para> |
| | |
| <para>If you use multiple internet providers with the 'track' option, in | | <para>If you use multiple internet providers with the 'track' option, in |
| /etc/shorewall/providers be sure to read the restrictions at <ulink | | /etc/shorewall/providers be sure to read the restrictions at <ulink |
|
| url="/MultiISP.html">http://www.shorewall.net/MultiISP.html</ulink>.</para
> | | url="../MultiISP.html">https://shorewall.org/MultiISP.html</ulink>.</para> |
| </important> | | </important> |
| | |
| <para>The columns in the file are as follows (where the column name is | | <para>The columns in the file are as follows (where the column name is |
| followed by a different name in parentheses, the different name is used in | | followed by a different name in parentheses, the different name is used in |
| the alternate specification syntax).</para> | | the alternate specification syntax).</para> |
| | |
| <variablelist> | | <variablelist> |
| <varlistentry> | | <varlistentry> |
| <term><emphasis role="bold">ACTION</emphasis> - | | <term><emphasis role="bold">ACTION</emphasis> - |
| <replaceable>command</replaceable>[(<replaceable>parameters</replaceable
>)][:<replaceable>chain-designator</replaceable>]</term> | | <replaceable>command</replaceable>[(<replaceable>parameters</replaceable
>)][:<replaceable>chain-designator</replaceable>]</term> |
| | |
| skipping to change at line 134 | | skipping to change at line 134 |
|---|
| </varlistentry> | | </varlistentry> |
| </variablelist> | | </variablelist> |
| | |
| <para>The nat table designators were added in Shorewall 5.2.1. When | | <para>The nat table designators were added in Shorewall 5.2.1. When |
| a nat table designator is given, only the CONNMARK, MARK, SAVE and | | a nat table designator is given, only the CONNMARK, MARK, SAVE and |
| RESTORE commands may be used.</para> | | RESTORE commands may be used.</para> |
| | |
| <para>Unless otherwise specified for the particular | | <para>Unless otherwise specified for the particular |
| <replaceable>command</replaceable>, the default chain is PREROUTING | | <replaceable>command</replaceable>, the default chain is PREROUTING |
| when MARK_IN_FORWARD_CHAIN=No in <ulink | | when MARK_IN_FORWARD_CHAIN=No in <ulink |
|
| url="/manpages/shorewall.conf.html">shorewall.conf(5)</ulink>, and | | url="shorewall.conf.html">shorewall.conf(5)</ulink>, and |
| FORWARD when MARK_IN_FORWARD_CHAIN=Yes.</para> | | FORWARD when MARK_IN_FORWARD_CHAIN=Yes.</para> |
| | |
| <para>A <replaceable>chain-designator</replaceable> may not be | | <para>A <replaceable>chain-designator</replaceable> may not be |
| specified if the SOURCE or DEST columns begin with '$FW'. When the | | specified if the SOURCE or DEST columns begin with '$FW'. When the |
| SOURCE is $FW, the generated rule is always placed in the OUTPUT | | SOURCE is $FW, the generated rule is always placed in the OUTPUT |
| chain. If DEST is '$FW', then the rule is placed in the INPUT chain. | | chain. If DEST is '$FW', then the rule is placed in the INPUT chain. |
| Additionally, a <replaceable>chain-designator</replaceable> may not | | Additionally, a <replaceable>chain-designator</replaceable> may not |
| be specified in an action body.</para> | | be specified in an action body.</para> |
| | |
| <para>Where a command takes parameters, those parameters are | | <para>Where a command takes parameters, those parameters are |
| | |
| skipping to change at line 229 | | skipping to change at line 229 |
|---|
| prio</programlisting> | | prio</programlisting> |
| | |
| <para>Classification occurs in the POSTROUTING chain except | | <para>Classification occurs in the POSTROUTING chain except |
| when the <emphasis role="bold">SOURCE</emphasis> is <emphasis | | when the <emphasis role="bold">SOURCE</emphasis> is <emphasis |
| role="bold">$FW</emphasis>[:<emphasis>address</emphasis>] in | | role="bold">$FW</emphasis>[:<emphasis>address</emphasis>] in |
| which case classification occurs in the OUTPUT chain.</para> | | which case classification occurs in the OUTPUT chain.</para> |
| | |
| <para>When using Shorewall's built-in traffic shaping tool, | | <para>When using Shorewall's built-in traffic shaping tool, |
| the <emphasis>major</emphasis> class is the device number (the | | the <emphasis>major</emphasis> class is the device number (the |
| first device in <ulink | | first device in <ulink |
|
| url="/manpages/shorewall-tcdevices.html">shorewall-tcdevices</ul
ink>(5) | | url="shorewall-tcdevices.html">shorewall-tcdevices</ulink>(5) |
| is major class 1, the second device is major class 2, and so | | is major class 1, the second device is major class 2, and so |
| on) and the <emphasis>minor</emphasis> class is the class's | | on) and the <emphasis>minor</emphasis> class is the class's |
| MARK value in <ulink | | MARK value in <ulink |
|
| url="/manpages/shorewall-tcclasses.html">shorewall-tcclasses</ul
ink>(5) | | url="shorewall-tcclasses.html">shorewall-tcclasses</ulink>(5) |
| preceded by the number 1 (MARK 1 corresponds to minor class | | preceded by the number 1 (MARK 1 corresponds to minor class |
| 11, MARK 5 corresponds to minor class 15, MARK 22 corresponds | | 11, MARK 5 corresponds to minor class 15, MARK 22 corresponds |
| to minor class 122, etc.).</para> | | to minor class 122, etc.).</para> |
| </listitem> | | </listitem> |
| </varlistentry> | | </varlistentry> |
| | |
| <varlistentry> | | <varlistentry> |
| <term><emphasis role="bold">?COMMENT</emphasis></term> | | <term><emphasis role="bold">?COMMENT</emphasis></term> |
| | |
| <listitem> | | <listitem> |
| | |
| skipping to change at line 322 | | skipping to change at line 322 |
|---|
| </varlistentry> | | </varlistentry> |
| | |
| <varlistentry> | | <varlistentry> |
| <term><emphasis role="bold">DIVERTHA</emphasis></term> | | <term><emphasis role="bold">DIVERTHA</emphasis></term> |
| | |
| <listitem> | | <listitem> |
| <para>Added in Shorewall 5.0.4. To setup the HAProxy | | <para>Added in Shorewall 5.0.4. To setup the HAProxy |
| configuration described at <ulink | | configuration described at <ulink |
| url="http://www.loadbalancer.org/blog/setting-up-haproxy-with-tr
ansparent-mode-on-centos-6-x">http://www.loadbalancer.org/blog/setting-up-haprox
y-with-transparent-mode-on-centos-6-x</ulink>, | | url="http://www.loadbalancer.org/blog/setting-up-haproxy-with-tr
ansparent-mode-on-centos-6-x">http://www.loadbalancer.org/blog/setting-up-haprox
y-with-transparent-mode-on-centos-6-x</ulink>, |
| place this entry in <ulink | | place this entry in <ulink |
|
| url="/manpages/shorewall-providers.html">shorewall-providers(5)<
/ulink>:</para> | | url="shorewall-providers.html">shorewall-providers(5)</ulink>:</
para> |
| | |
| <programlisting>#NAME NUMBER MARK DUPLICATE INTERFACE G
ATEWAY OPTIONS COPY | | <programlisting>#NAME NUMBER MARK DUPLICATE INTERFACE G
ATEWAY OPTIONS COPY |
| TProxy 1 - - lo - tproxy</programli
sting> | | TProxy 1 - - lo - tproxy</programli
sting> |
| | |
| <para>and use this DIVERTHA entry:</para> | | <para>and use this DIVERTHA entry:</para> |
| | |
| <programlisting>#ACTION SOURCE DEST
PROTO DPORT SPORT USER TEST LENGTH TOS CONNBYTES HELPER
PROBABILITY DSCP | | <programlisting>#ACTION SOURCE DEST
PROTO DPORT SPORT USER TEST LENGTH TOS CONNBYTES HELPER
PROBABILITY DSCP |
| DIVERTHA - - tcp</programlisting> | | DIVERTHA - - tcp</programlisting> |
| </listitem> | | </listitem> |
| </varlistentry> | | </varlistentry> |
| | |
| skipping to change at line 389 | | skipping to change at line 389 |
|---|
| placed in the POSTROUTING chain.</para> | | placed in the POSTROUTING chain.</para> |
| </listitem> | | </listitem> |
| </varlistentry> | | </varlistentry> |
| | |
| <varlistentry> | | <varlistentry> |
| <term><emphasis role="bold">ECN</emphasis></term> | | <term><emphasis role="bold">ECN</emphasis></term> |
| | |
| <listitem> | | <listitem> |
| <para>Added in Shorewall 5.0.6 as an alternative to entries in | | <para>Added in Shorewall 5.0.6 as an alternative to entries in |
| <ulink | | <ulink |
|
| url="/manpages/shorewall-ecn.html">shorewall-ecn(5)</ulink>. | | url="shorewall-ecn.html">shorewall-ecn(5)</ulink>. |
| If a PROTO is specified, it must be 'tcp' (6). If no PROTO is | | If a PROTO is specified, it must be 'tcp' (6). If no PROTO is |
| supplied, TCP is assumed. This action causes all ECN bits in | | supplied, TCP is assumed. This action causes all ECN bits in |
| the TCP header to be cleared.</para> | | the TCP header to be cleared.</para> |
| </listitem> | | </listitem> |
| </varlistentry> | | </varlistentry> |
| | |
| <varlistentry> | | <varlistentry> |
| <term><emphasis | | <term><emphasis |
| role="bold">IMQ</emphasis>(<replaceable>number</replaceable>)</ter
m> | | role="bold">IMQ</emphasis>(<replaceable>number</replaceable>)</ter
m> |
| | |
| | |
| skipping to change at line 424 | | skipping to change at line 424 |
|---|
| two semicolons (";;") (preferred since Shoreall 5.0.0). If an | | two semicolons (";;") (preferred since Shoreall 5.0.0). If an |
| <replaceable>action</replaceable> is specified, the compiler | | <replaceable>action</replaceable> is specified, the compiler |
| proceeds as if that <replaceable>action</replaceable> had been | | proceeds as if that <replaceable>action</replaceable> had been |
| specified in this column. If no action is specified, then you | | specified in this column. If no action is specified, then you |
| may include your own jump ("-j | | may include your own jump ("-j |
| <replaceable>target</replaceable> | | <replaceable>target</replaceable> |
| [<replaceable>option</replaceable>] ...") after any matches | | [<replaceable>option</replaceable>] ...") after any matches |
| specified at the end of the rule. If the target is not one | | specified at the end of the rule. If the target is not one |
| known to Shorewall, then it must be defined as a builtin | | known to Shorewall, then it must be defined as a builtin |
| action in <ulink | | action in <ulink |
|
| url="/manpages/shorewall-actions.html">shorewall-actions</ulink> | | url="shorewall-actions.html">shorewall-actions</ulink> |
| (5).</para> | | (5).</para> |
| | |
| <para>The following rules are equivalent:</para> | | <para>The following rules are equivalent:</para> |
| | |
| <programlisting>2:P eth0 -
tcp 22 | | <programlisting>2:P eth0 -
tcp 22 |
| INLINE(MARK(2)):P eth0 - tcp 22 | | INLINE(MARK(2)):P eth0 - tcp 22 |
| INLINE(MARK(2)):P eth0 - ;; -p tcp | | INLINE(MARK(2)):P eth0 - ;; -p tcp |
| INLINE eth0 - tcp 22 ;; -j MARK --set-mark
2 | | INLINE eth0 - tcp 22 ;; -j MARK --set-mark
2 |
| INLINE eth0 - ;; -p tcp -j MARK --se
t-mark 2 | | INLINE eth0 - ;; -p tcp -j MARK --se
t-mark 2 |
| </programlisting> | | </programlisting> |
| | |
| skipping to change at line 567 | | skipping to change at line 567 |
|---|
| following error message will be issued:</para> | | following error message will be issued:</para> |
| | |
| <simplelist> | | <simplelist> |
| <member>ERROR: Unknown target | | <member>ERROR: Unknown target |
| (<replaceable>target</replaceable>)</member> | | (<replaceable>target</replaceable>)</member> |
| </simplelist> | | </simplelist> |
| | |
| <para>This error message may be eliminated by adding the | | <para>This error message may be eliminated by adding the |
| <replaceable>target</replaceable> as a builtin action in | | <replaceable>target</replaceable> as a builtin action in |
| <ulink | | <ulink |
|
| url="/manpages/shorewall-actions.html">shorewall-actions(5)</uli
nk>.</para> | | url="shorewall-actions.html">shorewall-actions(5)</ulink>.</para
> |
| </listitem> | | </listitem> |
| </varlistentry> | | </varlistentry> |
| | |
| <varlistentry> | | <varlistentry> |
| <term><emphasis | | <term><emphasis |
| role="bold">IPTABLES({<replaceable>target</replaceable> | | role="bold">IPTABLES({<replaceable>target</replaceable> |
| [<replaceable>option</replaceable> ...])</emphasis></term> | | [<replaceable>option</replaceable> ...])</emphasis></term> |
| | |
| <listitem> | | <listitem> |
| <para>IPv4 only.</para> | | <para>IPv4 only.</para> |
| | |
| skipping to change at line 592 | | skipping to change at line 592 |
|---|
| error message will be issued:</para> | | error message will be issued:</para> |
| | |
| <simplelist> | | <simplelist> |
| <member>ERROR: Unknown target | | <member>ERROR: Unknown target |
| (<replaceable>target</replaceable>)</member> | | (<replaceable>target</replaceable>)</member> |
| </simplelist> | | </simplelist> |
| | |
| <para>This error message may be eliminated by adding the | | <para>This error message may be eliminated by adding the |
| <replaceable>target</replaceable> as a builtin action in | | <replaceable>target</replaceable> as a builtin action in |
| <ulink | | <ulink |
|
| url="/manpages/shorewall-actions.html">shorewall-actions(5)</uli
nk>.</para> | | url="shorewall-actions.html">shorewall-actions(5)</ulink>.</para
> |
| </listitem> | | </listitem> |
| </varlistentry> | | </varlistentry> |
| | |
| <varlistentry> | | <varlistentry> |
| <term><emphasis | | <term><emphasis |
| role="bold">MARK({<replaceable>mark</replaceable>|<replaceable>ran
ge</replaceable>})</emphasis></term> | | role="bold">MARK({<replaceable>mark</replaceable>|<replaceable>ran
ge</replaceable>})</emphasis></term> |
| | |
| <listitem> | | <listitem> |
| <para>where <replaceable>mark</replaceable> is a packet mark | | <para>where <replaceable>mark</replaceable> is a packet mark |
| value.</para> | | value.</para> |
| | |
| skipping to change at line 635 | | skipping to change at line 635 |
|---|
| capability in iptables and kernel. Marks in the specified | | capability in iptables and kernel. Marks in the specified |
| range are assigned to packets on a round-robin fashion.</para> | | range are assigned to packets on a round-robin fashion.</para> |
| | |
| <para>When a mask is specified, the result of logically ANDing | | <para>When a mask is specified, the result of logically ANDing |
| each mark value with the mask must be the same as the mark | | each mark value with the mask must be the same as the mark |
| value. The least significant bit in the mask is used as an | | value. The least significant bit in the mask is used as an |
| increment. For example, if '0x200-0x400/0xff00' is specified, | | increment. For example, if '0x200-0x400/0xff00' is specified, |
| then the assigned mark values are 0x200, 0x300 and 0x400 in | | then the assigned mark values are 0x200, 0x300 and 0x400 in |
| equal proportions. If no mask is specified, then ( 2 ** | | equal proportions. If no mask is specified, then ( 2 ** |
| MASK_BITS ) - 1 is assumed (MASK_BITS is set in <ulink | | MASK_BITS ) - 1 is assumed (MASK_BITS is set in <ulink |
|
| url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(5)).<
/para> | | url="shorewall.conf.html">shorewall.conf</ulink>(5)).</para> |
| </listitem> | | </listitem> |
| </varlistentry> | | </varlistentry> |
| | |
| <varlistentry> | | <varlistentry> |
| <term><emphasis | | <term><emphasis |
| role="bold">NFLOG</emphasis>[(<emphasis>nflog-parameters</emphasis
>)]</term> | | role="bold">NFLOG</emphasis>[(<emphasis>nflog-parameters</emphasis
>)]</term> |
| | |
| <listitem> | | <listitem> |
| <para>Added in Shorewall 5.0.9. Logs matching packets using | | <para>Added in Shorewall 5.0.9. Logs matching packets using |
| NFLOG. The <replaceable>nflog-parameters</replaceable> are a | | NFLOG. The <replaceable>nflog-parameters</replaceable> are a |
| | |
| skipping to change at line 807 | | skipping to change at line 807 |
|---|
| </listitem> | | </listitem> |
| </varlistentry> | | </varlistentry> |
| | |
| <varlistentry> | | <varlistentry> |
| <term><emphasis | | <term><emphasis |
| role="bold">TPROXY</emphasis>([<replaceable>port</replaceable>[,<r
eplaceable>address</replaceable>]])</term> | | role="bold">TPROXY</emphasis>([<replaceable>port</replaceable>[,<r
eplaceable>address</replaceable>]])</term> |
| | |
| <listitem> | | <listitem> |
| <para>Transparently redirects a packet without altering the IP | | <para>Transparently redirects a packet without altering the IP |
| header. Requires a tproxy provider to be defined in <ulink | | header. Requires a tproxy provider to be defined in <ulink |
|
| url="/manpages/shorewall-providers.html">shorewall-providers</ul
ink>(5).</para> | | url="shorewall-providers.html">shorewall-providers</ulink>(5).</
para> |
| | |
| <para>There are three parameters to TPROXY - neither is | | <para>There are three parameters to TPROXY - neither is |
| required:</para> | | required:</para> |
| | |
| <itemizedlist> | | <itemizedlist> |
| <listitem> | | <listitem> |
| <para><replaceable>port</replaceable> - the port on which | | <para><replaceable>port</replaceable> - the port on which |
| the proxy server is listening. If omitted, the original | | the proxy server is listening. If omitted, the original |
| destination port.</para> | | destination port.</para> |
| </listitem> | | </listitem> |
| | |
| skipping to change at line 866 | | skipping to change at line 866 |
|---|
| <para>where <replaceable>source-spec</replaceable> is one of:</para> | | <para>where <replaceable>source-spec</replaceable> is one of:</para> |
| | |
| <variablelist> | | <variablelist> |
| <varlistentry> | | <varlistentry> |
| <term>[!]<replaceable>interface</replaceable></term> | | <term>[!]<replaceable>interface</replaceable></term> |
| | |
| <listitem> | | <listitem> |
| <para>where <replaceable>interface</replaceable> is the | | <para>where <replaceable>interface</replaceable> is the |
| logical name of an <replaceable>interface</replaceable> | | logical name of an <replaceable>interface</replaceable> |
| defined in <ulink | | defined in <ulink |
|
| url="/manpages/shorewall-interfaces.html">shorewall-interfaces</
ulink>(5). | | url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5). |
| Matches packets entering the firewall from the named | | Matches packets entering the firewall from the named |
| interface. May not be used in CLASSIFY rules or in rules using | | interface. May not be used in CLASSIFY rules or in rules using |
| the :T chain qualifier.</para> | | the :T chain qualifier.</para> |
| | |
| <para>Beginning with Shorweall 5.2.1, the | | <para>Beginning with Shorweall 5.2.1, the |
| <replaceable>interface</replaceable> may be preceded with '!' | | <replaceable>interface</replaceable> may be preceded with '!' |
| which matches all interfaces except the one specified.</para> | | which matches all interfaces except the one specified.</para> |
| </listitem> | | </listitem> |
| </varlistentry> | | </varlistentry> |
| | |
| | |
| skipping to change at line 897 | | skipping to change at line 897 |
|---|
| ("+").</para> | | ("+").</para> |
| | |
| <para>A MAC address in Shorewall format (preceded by a tilde | | <para>A MAC address in Shorewall format (preceded by a tilde |
| ("~") and using dash ("-") as a separator (e.g., | | ("~") and using dash ("-") as a separator (e.g., |
| ~00-A0-C9-15-39-78).</para> | | ~00-A0-C9-15-39-78).</para> |
| </blockquote> | | </blockquote> |
| | |
| <para>Matches traffic whose source IP address matches one of | | <para>Matches traffic whose source IP address matches one of |
| the listed addresses and that does not match an address listed | | the listed addresses and that does not match an address listed |
| in the <replaceable>exclusion</replaceable> (see <ulink | | in the <replaceable>exclusion</replaceable> (see <ulink |
|
| url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ul
ink>(5)).</para> | | url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).<
/para> |
| | |
| <para><emphasis role="bold">This form will not match traffic | | <para><emphasis role="bold">This form will not match traffic |
| that originates on the firewall itself unless either | | that originates on the firewall itself unless either |
| <major><minor> or the :T chain qualifier is used | | <major><minor> or the :T chain qualifier is used |
| in the ACTION column.</emphasis></para> | | in the ACTION column.</emphasis></para> |
| </listitem> | | </listitem> |
| </varlistentry> | | </varlistentry> |
| | |
| <varlistentry> | | <varlistentry> |
| <term>[!]<replaceable>interface</replaceable>:<replaceable>address
</replaceable>,[...][<replaceable>exclusion</replaceable>]</term> | | <term>[!]<replaceable>interface</replaceable>:<replaceable>address
</replaceable>,[...][<replaceable>exclusion</replaceable>]</term> |
| | |
| skipping to change at line 1001 | | skipping to change at line 1001 |
|---|
| <listitem> | | <listitem> |
| <para>where <replaceable>dest-spec</replaceable> is one of:</para> | | <para>where <replaceable>dest-spec</replaceable> is one of:</para> |
| | |
| <variablelist> | | <variablelist> |
| <varlistentry> | | <varlistentry> |
| <term><replaceable>interface</replaceable></term> | | <term><replaceable>interface</replaceable></term> |
| | |
| <listitem> | | <listitem> |
| <para>where <replaceable>interface</replaceable> is the | | <para>where <replaceable>interface</replaceable> is the |
| logical name of an interface defined in <ulink | | logical name of an interface defined in <ulink |
|
| url="/manpages/shorewall-interfaces.html">shorewall-interfaces</
ulink>(5). | | url="shorewall-interfaces.html">shorewall-interfaces</ulink>(5). |
| Matches packets leaving the firewall through the named | | Matches packets leaving the firewall through the named |
| interface. May not be used in the PREROUTING chain (:P in the | | interface. May not be used in the PREROUTING chain (:P in the |
| mark column or no chain qualifier and MARK_IN_FORWARD_CHAIN=No | | mark column or no chain qualifier and MARK_IN_FORWARD_CHAIN=No |
| in <ulink | | in <ulink |
|
| url="/manpages/shorewall.conf">shorewall.conf</ulink> | | url="shorewall.conf">shorewall.conf</ulink> |
| (5)).</para> | | (5)).</para> |
| </listitem> | | </listitem> |
| </varlistentry> | | </varlistentry> |
| | |
| <varlistentry> | | <varlistentry> |
| <term><replaceable>address</replaceable>[,...][<replaceable>exclus
ion</replaceable>]</term> | | <term><replaceable>address</replaceable>[,...][<replaceable>exclus
ion</replaceable>]</term> |
| | |
| <listitem> | | <listitem> |
| <para>where <replaceable>address</replaceable> is:</para> | | <para>where <replaceable>address</replaceable> is:</para> |
| | |
| | |
| skipping to change at line 1031 | | skipping to change at line 1031 |
|---|
| ("+").</para> | | ("+").</para> |
| | |
| <para>A MAC address in Shorewall format (preceded by a tilde | | <para>A MAC address in Shorewall format (preceded by a tilde |
| ("~") and using dash ("-") as a separator (e.g., | | ("~") and using dash ("-") as a separator (e.g., |
| ~00-A0-C9-15-39-78).</para> | | ~00-A0-C9-15-39-78).</para> |
| </blockquote> | | </blockquote> |
| | |
| <para>Matches traffic whose destination IP address matches one | | <para>Matches traffic whose destination IP address matches one |
| of the listed addresses and that does not match an address | | of the listed addresses and that does not match an address |
| listed in the <replaceable>exclusion</replaceable> (see <ulink | | listed in the <replaceable>exclusion</replaceable> (see <ulink |
|
| url="/manpages/shorewall-exclusion.html">shorewall-exclusion</ul
ink>(5)).</para> | | url="shorewall-exclusion.html">shorewall-exclusion</ulink>(5)).<
/para> |
| </listitem> | | </listitem> |
| </varlistentry> | | </varlistentry> |
| | |
| <varlistentry> | | <varlistentry> |
| <term><replaceable>interface</replaceable>:<replaceable>address</r
eplaceable>,[...][<replaceable>exclusion</replaceable>]</term> | | <term><replaceable>interface</replaceable>:<replaceable>address</r
eplaceable>,[...][<replaceable>exclusion</replaceable>]</term> |
| | |
| <listitem> | | <listitem> |
| <para>This form combines the preceding two forms and matches | | <para>This form combines the preceding two forms and matches |
| when both the outgoing interface and destination IP address | | when both the outgoing interface and destination IP address |
| match. May not be used in the PREROUTING chain (:P in the mark | | match. May not be used in the PREROUTING chain (:P in the mark |
| column or no chain qualifier and MARK_IN_FORWARD_CHAIN=No in | | column or no chain qualifier and MARK_IN_FORWARD_CHAIN=No in |
|
| <ulink url="/manpages/shorewall.conf">shorewall.conf</ulink> | | <ulink url="shorewall.conf">shorewall.conf</ulink> |
| (5)).</para> | | (5)).</para> |
| </listitem> | | </listitem> |
| </varlistentry> | | </varlistentry> |
| | |
| <varlistentry> | | <varlistentry> |
| <term><replaceable>interface</replaceable>:<replaceable>exclusion<
/replaceable></term> | | <term><replaceable>interface</replaceable>:<replaceable>exclusion<
/replaceable></term> |
| | |
| <listitem> | | <listitem> |
| <para>This form matches packets leaving through the named | | <para>This form matches packets leaving through the named |
| <replaceable>interface</replaceable> and whose destination IP | | <replaceable>interface</replaceable> and whose destination IP |
| address does not match any of the addresses in the | | address does not match any of the addresses in the |
| <replaceable>exclusion</replaceable>. May not be used in the | | <replaceable>exclusion</replaceable>. May not be used in the |
| PREROUTING chain (:P in the mark column or no chain qualifier | | PREROUTING chain (:P in the mark column or no chain qualifier |
| and MARK_IN_FORWARD_CHAIN=No in <ulink | | and MARK_IN_FORWARD_CHAIN=No in <ulink |
|
| url="/manpages/shorewall.conf">shorewall.conf</ulink> | | url="shorewall.conf">shorewall.conf</ulink> |
| (5)).</para> | | (5)).</para> |
| </listitem> | | </listitem> |
| </varlistentry> | | </varlistentry> |
| | |
| <varlistentry> | | <varlistentry> |
| <term>$FW</term> | | <term>$FW</term> |
| | |
| <listitem> | | <listitem> |
| <para>Matches packets originating on the firewall system. May | | <para>Matches packets originating on the firewall system. May |
| not be used with a chain qualifier (:P, :F, etc.) in the | | not be used with a chain qualifier (:P, :F, etc.) in the |
| | |
| skipping to change at line 1127 | | skipping to change at line 1127 |
|---|
| <term><emphasis role="bold">PROTO</emphasis> - {<emphasis | | <term><emphasis role="bold">PROTO</emphasis> - {<emphasis |
| role="bold">-</emphasis>|<emphasis | | role="bold">-</emphasis>|<emphasis |
| role="bold">{tcp:[!]syn</emphasis>|<emphasis | | role="bold">{tcp:[!]syn</emphasis>|<emphasis |
| role="bold">ipp2p</emphasis>|<emphasis | | role="bold">ipp2p</emphasis>|<emphasis |
| role="bold">ipp2p:udp</emphasis>|<emphasis | | role="bold">ipp2p:udp</emphasis>|<emphasis |
| role="bold">ipp2p:all</emphasis>|<emphasis>protocol-number</emphasis>|<e
mphasis>protocol-name</emphasis>|<emphasis | | role="bold">ipp2p:all</emphasis>|<emphasis>protocol-number</emphasis>|<e
mphasis>protocol-name</emphasis>|<emphasis |
| role="bold">all}[,...]}</emphasis></term> | | role="bold">all}[,...]}</emphasis></term> |
| | |
| <listitem> | | <listitem> |
| <para>See <ulink | | <para>See <ulink |
|
| url="/manpages/shorewall-rules.html">shorewall-rules(5)</ulink> for | | url="shorewall-rules.html">shorewall-rules(5)</ulink> for |
| details.</para> | | details.</para> |
| | |
| <para>Beginning with Shorewall 4.5.12, this column can accept a | | <para>Beginning with Shorewall 4.5.12, this column can accept a |
| comma-separated list of protocols.</para> | | comma-separated list of protocols.</para> |
| </listitem> | | </listitem> |
| </varlistentry> | | </varlistentry> |
| | |
| <varlistentry> | | <varlistentry> |
| <term><emphasis role="bold">DPORT</emphasis>- {<emphasis | | <term><emphasis role="bold">DPORT</emphasis>- {<emphasis |
| role="bold">-</emphasis>|<emphasis>port-name-number-or-range</emphasis>[
<emphasis | | role="bold">-</emphasis>|<emphasis>port-name-number-or-range</emphasis>[
<emphasis |
| role="bold">,</emphasis><emphasis>port-name-number-or-range</emphasis>].
..|+<replaceable>ipset</replaceable>}</term> | | role="bold">,</emphasis><emphasis>port-name-number-or-range</emphasis>].
..|+<replaceable>ipset</replaceable>}</term> |
| | |
| <listitem> | | <listitem> |
| <para>Optional destination Ports. A comma-separated list of Port | | <para>Optional destination Ports. A comma-separated list of Port |
| names (from services(5)), <emphasis>port number</emphasis>s or | | names (from services(5)), <emphasis>port number</emphasis>s or |
| <emphasis>port range</emphasis>s; if the protocol is <emphasis | | <emphasis>port range</emphasis>s; if the protocol is <emphasis |
| role="bold">icmp</emphasis>, this column is interpreted as the | | role="bold">icmp</emphasis>, this column is interpreted as the |
| destination icmp-type(s). ICMP types may be specified as a numeric | | destination icmp-type(s). ICMP types may be specified as a numeric |
| type, a numeric type and code separated by a slash (e.g., 3/4), or a | | type, a numeric type and code separated by a slash (e.g., 3/4), or a |
| typename. See <ulink | | typename. See <ulink |
|
| url="/configuration_file_basics.htm#ICMP">http://www.shorewall.net/con
figuration_file_basics.htm#ICMP</ulink>.</para> | | url="../configuration_file_basics.htm#ICMP">https://shorewall.org/conf
iguration_file_basics.htm#ICMP</ulink>.</para> |
| | |
| <para>If the protocol is <emphasis role="bold">ipp2p</emphasis>, | | <para>If the protocol is <emphasis role="bold">ipp2p</emphasis>, |
| this column is interpreted as an ipp2p option without the leading | | this column is interpreted as an ipp2p option without the leading |
| "--" (example <emphasis role="bold">bit</emphasis> for bit-torrent). | | "--" (example <emphasis role="bold">bit</emphasis> for bit-torrent). |
| If no PORT is given, <emphasis role="bold">ipp2p</emphasis> is | | If no PORT is given, <emphasis role="bold">ipp2p</emphasis> is |
| assumed.</para> | | assumed.</para> |
| | |
| <para>An entry in this field requires that the PROTO column specify | | <para>An entry in this field requires that the PROTO column specify |
| icmp (1), tcp (6), udp (17), sctp (132) or udplite (136). Use '-' if | | icmp (1), tcp (6), udp (17), sctp (132) or udplite (136). Use '-' if |
| any of the following field is supplied.</para> | | any of the following field is supplied.</para> |
| | |
| skipping to change at line 1586 | | skipping to change at line 1586 |
|---|
| </variablelist> | | </variablelist> |
| </listitem> | | </listitem> |
| </varlistentry> | | </varlistentry> |
| | |
| <varlistentry> | | <varlistentry> |
| <term><emphasis role="bold">SWITCH - | | <term><emphasis role="bold">SWITCH - |
| [!]<replaceable>switch-name</replaceable>[={0|1}]</emphasis></term> | | [!]<replaceable>switch-name</replaceable>[={0|1}]</emphasis></term> |
| | |
| <listitem> | | <listitem> |
| <para>Added in Shorewall 5.1.0 and allows enabling and disabling the | | <para>Added in Shorewall 5.1.0 and allows enabling and disabling the |
|
| rule without requiring <command>shorewall restart</command>.</para> | | rule without requiring <command>shorewall reload</command>.</para> |
| | |
| <para>The rule is enabled if the value stored in | | <para>The rule is enabled if the value stored in |
| <filename>/proc/net/nf_condition/<replaceable>switch-name</replaceable
></filename> | | <filename>/proc/net/nf_condition/<replaceable>switch-name</replaceable
></filename> |
| is 1. The rule is disabled if that file contains 0 (the default). If | | is 1. The rule is disabled if that file contains 0 (the default). If |
| '!' is supplied, the test is inverted such that the rule is enabled | | '!' is supplied, the test is inverted such that the rule is enabled |
| if the file contains 0.</para> | | if the file contains 0.</para> |
| | |
| <para>Within the <replaceable>switch-name</replaceable>, '@0' and | | <para>Within the <replaceable>switch-name</replaceable>, '@0' and |
| '@{0}' are replaced by the name of the chain to which the rule is a | | '@{0}' are replaced by the name of the chain to which the rule is a |
| added. The <replaceable>switch-name</replaceable> (after '@...' | | added. The <replaceable>switch-name</replaceable> (after '@...' |
| | |
| skipping to change at line 1617 | | skipping to change at line 1617 |
|---|
| </simplelist> | | </simplelist> |
| | |
| <para>To turn it <emphasis role="bold">off</emphasis> again:</para> | | <para>To turn it <emphasis role="bold">off</emphasis> again:</para> |
| | |
| <simplelist> | | <simplelist> |
| <member><command>echo 0 > | | <member><command>echo 0 > |
| /proc/net/nf_condition/<replaceable>switch-name</replaceable></comma
nd></member> | | /proc/net/nf_condition/<replaceable>switch-name</replaceable></comma
nd></member> |
| </simplelist> | | </simplelist> |
| | |
| <para>Switch settings are retained over <command>shorewall | | <para>Switch settings are retained over <command>shorewall |
|
| restart</command>.</para> | | reload</command>.</para> |
| | |
| <para>When the <replaceable>switch-name</replaceable> is followed by | | <para>When the <replaceable>switch-name</replaceable> is followed by |
| <option>=0</option> or <option>=1</option>, then the switch is | | <option>=0</option> or <option>=1</option>, then the switch is |
| initialized to off or on respectively by the | | initialized to off or on respectively by the |
| <command>start</command> command. Other commands do not affect the | | <command>start</command> command. Other commands do not affect the |
| switch setting.</para> | | switch setting.</para> |
| </listitem> | | </listitem> |
| </varlistentry> | | </varlistentry> |
| </variablelist> | | </variablelist> |
| </refsect1> | | </refsect1> |
| | |
| skipping to change at line 1727 | | skipping to change at line 1727 |
|---|
| | |
| <para>/etc/shorewall/mangle</para> | | <para>/etc/shorewall/mangle</para> |
| | |
| <para>/etc/shorewall6/mangle</para> | | <para>/etc/shorewall6/mangle</para> |
| </refsect1> | | </refsect1> |
| | |
| <refsect1> | | <refsect1> |
| <title>See ALSO</title> | | <title>See ALSO</title> |
| | |
| <para><ulink | | <para><ulink |
|
| url="/traffic_shaping.htm">http://www.shorewall.net/traffic_shaping.htm</uli
nk></para> | | url="../traffic_shaping.htm">https://shorewall.org/traffic_shaping.htm</ulin
k></para> |
| | |
| <para><ulink | | <para><ulink |
|
| url="/MultiISP.html">http://www.shorewall.net/MultiISP.html</ulink></para> | | url="../MultiISP.html">https://shorewall.org/MultiISP.html</ulink></para> |
| | |
| <para><ulink | | <para><ulink |
|
| url="/PacketMarking.html">http://www.shorewall.net/PacketMarking.html</ulink
></para> | | url="../PacketMarking.html">https://shorewall.org/PacketMarking.html</ulink>
</para> |
| | |
| <para><ulink | | <para><ulink |
|
| url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configur
ation_file_basics.htm#Pairs</ulink></para> | | url="../configuration_file_basics.htm#Pairs">https://shorewall.org/configura
tion_file_basics.htm#Pairs</ulink></para> |
| | |
| <para>shorewall(8)</para> | | <para>shorewall(8)</para> |
| </refsect1> | | </refsect1> |
| </refentry> | | </refentry> |
| | | |
| End of changes. 28 change blocks. |
|---|
| 28 lines changed or deleted | | 28 lines changed or added |
|---|
"Fossies" - the Fresh Open Source Software Archive 