| SHOREWALL6-INTERFAC(5) | Configuration Files | SHOREWALL6-INTERFAC(5) |
NAME¶
interfaces - shorewall6 interfaces fileSYNOPSIS¶
/etc/shorewall6/interfaces
DESCRIPTION¶
The interfaces file serves to define the firewall's network interfaces to shorewall6. The order of entries in this file is not significant in determining zone composition.Beginning with Shorewall 4.5.3, the interfaces file supports two different formats:
FORMAT 1 (default - deprecated)
FORMAT 2
The format is specified by a line as follows:
?FORMAT {1|2}
The columns in the file are as follows.
ZONE - zone-name
If the interface serves multiple zones that will be defined in the shorewall6-hosts[1](5) file, you should place "-" in this column.
If there are multiple interfaces to the same zone, you must list them in separate entries.
Example:
#ZONE INTERFACE BROADCAST loc eth1 - loc eth2 -
INTERFACE - interface[:port]
You may use wildcards here by specifying a prefix followed by the plus sign ("+"). For example, if you want to make an entry that applies to all PPP interfaces, use 'ppp+'; that would match ppp0, ppp1, ppp2, ...Please note that the '+' means 'one or more additional characters' so 'ppp' does not match 'ppp+'.
Care must be exercised when using wildcards where there is another zone that uses a matching specific interface. See shorewall6-nesting[4](5) for a discussion of this problem.
Shorewall6 allows '+' as an interface name.
There is no need to define the loopback interface (lo) in this file.
If a port is given, then the interface must have been defined previously with the bridge option. The OPTIONS column must be empty when a port is given.
ANYCAST - -
OPTIONS (Optional) - [option[,option]...]
accept_ra[={0|1|2}]
0
1
2
If the option is specified without a value, then the value 1 is assumed.
blacklist
Beginning with Shorewall 4.4.13:
bridge
dbl={none|src|dst|src-dst}
DYNAMIC_BLACKLIST=No
DYNAMIC_BLACKLIST=Yes
DYNAMIC_BLACKLIST=ipset[-only]
DYNAMIC_BLACKLIST=ipset[-only],src-dst...
destonly
dhcp
Note
If you use Shorewall-perl for firewall/bridging[8], then you need to include DHCP-specific rules in shorewall-rules[9](8). DHCP uses UDP ports 546 and 547.
This option allows DHCP datagrams to enter and leave the interface.
forward[={0|1}]
ignore[=1]
Beginning with Shorewall 4.5.5, may be specified as 'ignore=1' which only causes the generated script to ignore up/down events from Shorewall-init; hairpin filtering is still applied. In this case, the above restrictions on the ZONE and OPTIONS columns are lifted.
loopback
mss=number
nets=(net[,...])
nets=dynamic
nodbl
optional
This option may not be specified together with required.
physical=name
If the interface name is a wildcard name (ends with '+'), then the physical name must also end in '+'.
If physical is not specified, then it's value defaults to the interface name.
required
routeback[={0|1}]
If you specify this option, then you should also specify rpfilter (see below) if you are running Shorewall 4.5.7 or later; otherwise, you should specify sfilter (see below).
Beginning with Shorewall 4.5.18, you may specify this option to explicitly reset (e.g., routeback=0). This can be used to override Shorewall's default setting for bridge devices which is routeback=1.
rpfilter
sourceroute[={0|1}]
Only those interfaces with the sourceroute option will have their setting changed; the value assigned to the setting will be the value specified (if any) or 1 if no value is given.
Note
This option does not work with a wild-card interface name (e.g., eth0.+) in the INTERFACE column.
sfilter=(net[,...])
This option should be used on bridges or other interfaces with the routeback option. On these interfaces, sfilter should list those local networks that are connected to the firewall through other interfaces.
tcpflags[={0|1}]
Beginning with Shorewall 4.6.0, tcpflags=1 is the default. To disable this option, specify tcpflags=0.
proxyndp[={0|1}]
Note: This option does not work with a wild-card interface name (e.g., eth0.+) in the INTERFACE column.
Only those interfaces with the proxyndp option will have their setting changed; the value assigned to the setting will be the value specified (if any) or 1 if no value is given.
unmanaged
wait=seconds
EXAMPLE¶
Example 1:Your entries for this setup would look like:
FORMAT 2 #ZONE INTERFACE OPTIONS net eth0 - loc eth1 - dmz eth2 -
Example 4 (Shorewall 4.4.9 and later):
FORMAT 2 #ZONE INTERFACE OPTIONS - br0 bridge
FILES¶
/etc/shorewall6/interfacesSEE ALSO¶
http://www.shorewall.net/configuration_file_basics.htm#Pairs[12]shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5), shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-maclist(5), shorewall6-netmap(5),shorewall6-params(5), shorewall6-policy(5), shorewall6-providers(5), shorewall6-rtrules(5), shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5), shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5), shorewall6-mangle(5), shorewall6-tos(5), shorewall6-tunnels(5), shorewall6-zones(5)
NOTES¶
- 1.
- shorewall6-hosts
- 2.
- shorewall6-zones
- 4.
- shorewall6-nesting
- 5.
- shorewall6-blacklist
- 7.
- simple bridge
- 8.
- Shorewall-perl for firewall/bridging
- 9.
- shorewall-rules
| 03/16/2017 | Configuration Files |