I've opened up development of Shorewall 4.1. While I had previously announced that Shorewall 4.1 would focus on IPv6, I have since learned that the netfilter team are developing 'xtables', a unified IP0v4/IPv6 utility. It seems silly to spend the effort to add Shorewall support for IPv6 only to then have to turn around and convert it to use xtables. So I've decided to wait.
Here are the changes in this first release:
1) Shorewall 4.1.0 contains experimental support for multiple Internet
providers through a single Ethernet interface. Configuring two
providers through a single interface differs from two providers
through two interfaces in several ways.
a) Only Ethernet (or Ethernet-like) interfaces can be used. For
inbound traffic, the MAC addresses of the gateway routers are used
to determine which provider a packet was received through. Note
that only routed traffic can be categorized using this technique.
b) The 'shared' provider option must be specified for both providers.
c) Entries in /etc/shorewall/masq must be qualified by the provider
name (or number).
d) This feature requires Realm Match support in your kernel and
iptables. If you use a capabilities file, you need to regenerate
the file with Shorewall 4.0.6 or Shorewall-lite 4.0.6.
Example:
Providers Blarg (1) and Avvanta (2) are both connected to
eth0. The firewall's IP address with Blarg is 206.124.146.176
(gateway 206.124.146.254) and the IP address from Avvanta is
130.252.144.8 (gateway 130.252.144.254).
/etc/shorewall/providers:
#PROVIDER NUMBER MARK DUPLICATE GATEWAY OPTIONS
Blarg 1 1 main 206.124.146.254 shared,...
Avvanta 2 2 main 130.252.144.254 shared,...
/etc/shorewall/masq:
#INTERFACE SOURCE ADDRESS
eth0(Blarg) 130.252.144.254 206.124.146.176
eth0(Avvanta) 206.124.146.176 130.252.144.254
eth0(Blarg) eth1 206.124.146.176
eth0(Avvanta) eth1 130.252.144.254
2) You may now include the name of a table (nat, mangle or filter) in
a 'shorewall refresh' command by following the name with a colon
(e.g., mangle:). This causes all non-builtin chains in the table to
be reloaded.
Example:
shorewall refresh nat:
3) When no chain name is given to the 'shorewall refresh' command, the
mangle table is refreshed along with the blacklist chain (if
any). This allows you to modify /etc/shorewall/tcrules and install
the changes using 'shorewall refresh'.
4) Support for the NFLOG log target has been added. NFLOG is a
successor to ULOG. In addition, both ULOG and NFLOG may be followed
by a list of up to three numbers in parentheses.
The first number specifies the netlink group (1-32). If omitted
(e.g., NFLOG(,0,10)) then a value of 1 is assumed.
The second number specifies the maximum number of bytes to copy. If
omitted, 0 (no limit) is assumed.
The third number specifies the number of log messages that should
be buffered in the kernel before they are sent to user space. The
default is 1.
Examples:
/etc/shorewall/shorewall.conf:
MACLIST_LOG_LEVEL=NFLOG(1,0,1)
/etc/shorewall/rules:
ACCEPT:NFLOG(1,0,1) vpn fw tcp ssh,time,631,8080
5) Shorewall-perl 4.1.0 implements an alternative syntax for macro
parameters and for the NFQUEUE queue number. Rather than following
the macro name (or NFQUEUE) with a slash ("/") and the parameter,
the parameter may be enclosed in parentheses.
Examples -- each pair shown below are equivalent:
DNS/ACCEPT DNS(ACCEPT)
NFQUEUE/3 NFQUEUE(3)
The old syntax is still be accepted but will cease to be documented
in some future Shorewall release.
-Tom
--
Tom Eastep \ Nothing is foolproof to a sufficiently talented fool
Shoreline, \ http://shorewall.net
Washington USA \ [EMAIL PROTECTED]
PGP Public Key \ https://lists.shorewall.net/teastep.pgp.key
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2005. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________ Shorewall-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-devel
