| SHOREWALL-INTERFACE(5) | Configuration Files | SHOREWALL-INTERFACE(5) |
NAME¶
interfaces - Shorewall interfaces file
SYNOPSIS¶
/etc/shorewall[6]/interfaces
DESCRIPTION¶
The interfaces file serves to define the firewall's network interfaces to Shorewall. The order of entries in this file is not significant in determining zone composition.
Beginning with Shorewall 4.5.3, the interfaces file supports two different formats:
FORMAT 1 (default - deprecated)
FORMAT 2
The format is specified by a line as follows:
?FORMAT {1|2}
The columns in the file are as follows.
ZONE - zone-name
If the interface serves multiple zones that will be defined in the shorewall-hosts[1](5) file, you should place "-" in this column.
If there are multiple interfaces to the same zone, you must list them in separate entries.
Example:
#ZONE INTERFACE BROADCAST loc eth1 - loc eth2 -
INTERFACE - interface[:port]
You may use wildcards here by specifying a prefix followed by the plus sign ("+"). For example, if you want to make an entry that applies to all PPP interfaces, use 'ppp+'; that would match ppp0, ppp1, ppp2, ...
When using Shorewall versions before 4.1.4, care must be exercised when using wildcards where there is another zone that uses a matching specific interface. See shorewall-nesting[3](5) for a discussion of this problem.
Shorewall allows '+' as an interface name, but that usage is deprecated. A better approach is to specify 'physical=+' in the OPTIONS column (see below).
There is no need to define the loopback interface (lo) in this file.
If a port is given, then the interface must have been defined previously with the bridge option. The OPTIONS column may not contain the following options when a port is given.
BROADCAST (Optional) - {-|detect|address[,address]...}
If you use the special value detect, Shorewall will detect the broadcast address(es) for you if your iptables and kernel include Address Type Match support.
If your iptables and/or kernel lack Address Type Match support then you may list the broadcast address(es) for the network(s) to which the interface belongs. For P-T-P interfaces, this column is left blank. If the interface has multiple addresses on multiple subnets then list the broadcast addresses as a comma-separated list.
If you don't want to give a value for this column but you want to enter a value in the OPTIONS column, enter - in this column.
OPTIONS (Optional) - [option[,option]...]
accept_ra[={0|1|2}]
0
1
2
If the option is specified without a value, then the value 1 is assumed.
Note
This option does not work with a wild-card physical name (e.g., eth0.+). Beginning with Shorewall 5.1.10, If this option is specified, a warning is issued and the option is ignored.
arp_filter[={0|1}]
Only those interfaces with the arp_filter option will have their setting changed; the value assigned to the setting will be the value specified (if any) or 1 if no value is given.
Note
This option does not work with a wild-card physical name (e.g., eth0.+). Beginning with Shorewall 5.1.10, If this option is specified, a warning is issued and the option is ignored.
arp_ignore[=number]
1 - reply only if the target IP address is local address configured on the incoming interface
2 - reply only if the target IP address is local address configured on the incoming interface and the sender's IP address is part from same subnet on this interface's address
3 - do not reply for local addresses configured with scope host, only resolutions for global and link
4-7 - reserved
8 - do not reply for all local addresses
Note
This option does not work with a wild-card physical name (e.g., eth0.+). Beginning with Shorewall 5.1.10, If this option is specified, a warning is issued and the option is ignored.
Warning
Do not specify arp_ignore for any interface involved in Proxy ARP[5].
blacklist
Beginning with Shorewall 4.4.13:
bridge
Note
If you have a bridge that you don't intend to define bport zones on, then it is best to omit this option and simply specify routeback.
dbl={none|src|dst|src-dst}
DYNAMIC_BLACKLIST=No
DYNAMIC_BLACKLIST=Yes
DYNAMIC_BLACKLIST=ipset[-only]
DYNAMIC_BLACKLIST=ipset[-only],src-dst...
The normal setting for this option will be dst or none for internal interfaces and src or src-dst for Internet-facing interfaces.
destonly
dhcp
Note
If you use Shorewall-perl for firewall/bridging[9], then you need to include DHCP-specific rules in shorewall-rules[10](5). DHCP uses UDP ports 67 and 68.
This option allows DHCP datagrams to enter and leave the interface.
forward[={0|1}]
Note
This option does not work with a wild-card physical name (e.g., eth0.+). Beginning with Shorewall 5.1.10, If this option is specified, a warning is issued and the option is ignored.
ignore[=1]
Beginning with Shorewall 4.5.5, may be specified as 'ignore=1' which only causes the generated script to ignore up/down events from Shorewall-init; hairpin filtering is still applied. In this case, the above restrictions on the ZONE and OPTIONS columns are lifted.
loopback
logmartians[={0|1}]
Only those interfaces with the logmartians option will have their setting changed; the value assigned to the setting will be the value specified (if any) or 1 if no value is given.
To find out if route filtering is set on a given interface, check the contents of /proc/sys/net/ipv4/conf/interface/rp_filter - a non-zero value indicates that route filtering is enabled.
Example:
teastep@lists:~$ cat /proc/sys/net/ipv4/conf/eth0/rp_filter
1
teastep@lists:~$
Note
This option does not work with a wild-card physical name (e.g., eth0.+). Beginning with Shorewall 5.1.10, If this option is specified, a warning is issued and the option is ignored.
maclist
mss=number
nets=(net[,...])
nets=dynamic
nodbl
nosmurfs
Smurfs will be optionally logged based on the setting of SMURF_LOG_LEVEL in shorewall.conf[7](5). After logging, the packets are dropped.
omitanycast
Shorewall6 has traditionally generated rules for IPv6 anycast addresses. These rules include:
This can be inhibited for individual interfaces by specifying noanycast for those interfaces.
Note
RFC 2526 describes IPv6 subnet anycast addresses. The RFC makes a distinction between subnets with "IPv6 address types required to have 64-bit interface identifiers in EUI-64 format" and all other subnets. When generating these anycast addresses, the Shorewall compiler does not make this distinction and unconditionally assumes that the last 128 addresses in the subnet are reserved as anycast addresses.
optional
When optional is specified for an interface, Shorewall will be silent when:
May not be specified with required.
physical=name
If the interface name is a wildcard name (ends with '+'), then the physical name must also end in '+'. The physical name may end in '+' (or be exactly '+') when the interface name is not a wildcard name.
If physical is not specified, then it's value defaults to the interface name.
proxyarp[={0|1}]
Note
This option does not work with a wild-card physical name (e.g., eth0.+). Beginning with Shorewall 5.1.10, If this option is specified, a warning is issued and the option is ignored.
proxyndp[={0|1}]
Note
This option does not work with a wild-card physical name (e.g., eth0.+). Beginning with Shorewall 5.1.10, If this option is specified, a warning is issued and the option is ignored.
required
routeback[={0|1}]
Beginning with Shorewall 4.4.20, if you specify this option, then you should also specify either sfilter (see below) or routefilter on all interfaces (see below).
Beginning with Shorewall 4.5.18, you may specify this option to explicitly reset (e.g., routeback=0). This can be used to override Shorewall's default setting for bridge devices which is routeback=1.
routefilter[={0|1|2}]
Only those interfaces with the routefilter option will have their setting changes; the value assigned to the setting will be the value specified (if any) or 1 if no value is given.
The value 2 is only available with Shorewall 4.4.5.1 and later when the kernel version is 2.6.31 or later. It specifies a loose form of reverse path filtering.
Note
This option does not work with a wild-card physical name (e.g., eth0.+). Beginning with Shorewall 5.1.10, If this option is specified, a warning is issued and the option is ignored.
Important
If ROUTE_FILTER=Yes in shorewall.conf[7](5), or if your distribution sets net.ipv4.conf.all.rp_filter=1 in /etc/sysctl.conf, then setting routefilter=0 in an interface entry will not disable route filtering on that interface! The effective setting for an interface is the maximum of the contents of /proc/sys/net/ipv4/conf/all/rp_filter and the routefilter setting specified in this file (/proc/sys/net/ipv4/conf/interface/rp_filter).
Note
There are certain cases where routefilter cannot be used on an interface:
rpfilter
sfilter=(net[,...])
sourceroute[={0|1}]
Only those interfaces with the sourceroute option will have their setting changed; the value assigned to the setting will be the value specified (if any) or 1 if no value is given.
Note
This option does not work with a wild-card physical name (e.g., eth0.+). Beginning with Shorewall 5.1.10, If this option is specified, a warning is issued and the option is ignored.
tcpflags[={0|1}]
Beginning with Shorewall 4.6.0, tcpflags=1 is the default. To disable this option, specify tcpflags=0.
unmanaged
upnp
upnpclient
wait=seconds
EXAMPLE¶
IPv4 Example 1:
Your entries for this setup would look like:
?FORMAT 1 #ZONE INTERFACE BROADCAST OPTIONS net eth0 206.191.149.223 dhcp loc eth1 192.168.1.255 dmz eth2 192.168.2.255
Example 2:
?FORMAT 2 #ZONE INTERFACE OPTIONS net eth0 dhcp loc eth1 dmz eth2
Example 3:
?FORMAT 2 #ZONE INTERFACE OPTIONS net ppp0 -
Example 4 (Shorewall 4.4.9 and later):
?FORMAT 2 #ZONE INTERFACE OPTIONS - br0 bridge
FILES¶
/etc/shorewall/interfaces
/etc/shorewall6/interfaces
SEE ALSO¶
https://shorewall.org/configuration_file_basics.htm#Pairs[18]
NOTES¶
- 1.
- shorewall-hosts
- 3.
- shorewall-nesting
- 4.
- shorewall6-zones
- 5.
- Proxy ARP
- 6.
- shorewall-blacklist
- 8.
- simple bridge
- 9.
- Shorewall-perl for firewall/bridging
- 10.
- shorewall-rules
- 11.
- shorewall-maclist
- 14.
- shorewall-proxyarp
- 16.
- shorewall-providers
| 09/24/2020 | Configuration Files |