| SHOREWALL6-INTERFAC(5) | [FIXME: manual] | SHOREWALL6-INTERFAC(5) |
NAME¶
interfaces - shorewall6 interfaces fileSYNOPSIS¶
/etc/shorewall6/interfaces
DESCRIPTION¶
The interfaces file serves to define the firewall's network interfaces to shorewall6. The order of entries in this file is not significant in determining zone composition. Beginning with Shorewall 4.5.3, the interfaces file supports two different formats: FORMAT 1 (default - deprecated)There is a ANYCAST column which provides
compatibility with older versions of Shorewall..
FORMAT 2
The BROADCAST column is omitted.
The format is specified by a line as follows:
FORMAT {1|2}
The columns in the file are as follows.
ZONE - zone-name
Zone for this interface. Must match the name
of a zone declared in /etc/shorewall6/zones. You may not list the firewall
zone in this column.
If the interface serves multiple zones that will be defined in the
shorewall6-hosts[1](5) file, you should place "-" in this
column.
If there are multiple interfaces to the same zone, you must list them in
separate entries.
Example:
INTERFACE - interface[:port]
#ZONE INTERFACE BROADCAST loc eth1 - loc eth2 -
Logical name of interface. Each interface may
be listed only once in this file. You may NOT specify the name of a
"virtual" interface (e.g., eth0:0) here; see
http://www.shorewall.net/FAQ.htm#faq18. If the physical option
is not specified, then the logical name is also the name of the actual
interface.
You may use wildcards here by specifying a prefix followed by the plus sign
("+"). For example, if you want to make an entry that applies to all
PPP interfaces, use 'ppp+'; that would match ppp0, ppp1, ppp2, ...Please note
that the '+' means ' one or more additional characters' so 'ppp' does
not match 'ppp+'.
Care must be exercised when using wildcards where there is another zone that
uses a matching specific interface. See shorewall6-nesting[2](5) for a
discussion of this problem.
Shorewall6 allows '+' as an interface name.
There is no need to define the loopback interface (lo) in this file.
If a port is given, then the interface must have been defined
previously with the bridge option. The OPTIONS column must be empty
when a port is given.
ANYCAST - -
Enter '-' in this column. It is here
for compatibility between Shorewall6 and Shorewall and is omitted if FORMAT is
2.
OPTIONS (Optional) - [option[,option]...]
A comma-separated list of options from the
following list. The order in which you list the options is not significant but
the list should have no embedded white space.
blacklist
Check packets arriving on this interface
against the shorewall6-blacklist[3](5) file.
Beginning with Shorewall 4.4.13:
bridge
•If a zone is given in the ZONES
column, then the behavior is as if blacklist had been specified in the
IN_OPTIONS column of shorewall6-zones[4](5).
•Otherwise, the option is ignored with a
warning: WARNING: The 'blacklist' option is ignored on mult-zone
interfaces
Designates the interface as a bridge.
Beginning with Shorewall 4.4.7, setting this option also sets
routeback.
dhcp
Specify this option when any of the following
are true:
This option allows DHCP datagrams to enter and leave the interface.
forward[={0|1}]
1.the interface gets its IP address via
DHCP
2.the interface is used by a DHCP server
running on the firewall
3.the interface has a static IP but is on a
LAN segment with lots of DHCP clients.
4.the interface is a simple bridge[5]
with a DHCP server on one port and DHCP clients on another port.
Note
If you use Shorewall-perl for firewall/bridging[6], then you need to
include DHCP-specific rules in shorewall-rules[7](8). DHCP uses UDP
ports 546 and 547.
Sets the
/proc/sys/net/ipv6/conf/interface/forwarding option to the specified value. If
no value is supplied, then 1 is assumed.
ignore[=1]
When specified, causes the generated script to
ignore up/down events from Shorewall-init for this device. Additionally, the
option exempts the interface from hairpin filtering. When '=1' is omitted, the
ZONE column must contain '-' and ignore must be the only OPTION.
Beginning with Shorewall 4.5.5, may be specified as ' ignore=1' which
only causes the generated script to ignore up/down events from Shorewall-init;
hairpin filtering is still applied. In this case, the above restrictions on
the ZONE and OPTIONS columns are lifted.
mss=number
Causes forwarded TCP SYN packets entering or
leaving on this interface to have their MSS field set to the specified
number.
nets=(net[,...])
Limit the zone named in the ZONE column to
only the listed networks. If you specify this option, be sure to include the
link-local network (ff80::/10).
nets=dynamic
Added in Shorewall 4.4.21. Defines the zone as
dynamic. Requires ipset match support in your iptables and kernel. See
http://www.shorewall.net/Dynamic.html for further information.
optional
When optional is specified for an
interface, shorewall6 will be silent when:
This option may not be specified together with required.
physical=name
•a /proc/sys/net/ipv6/conf/ entry for
the interface cannot be modified.
•The first global IPv6 address of the
interface cannot be obtained.
Added in Shorewall 4.4.4. When specified, the
interface or port name in the INTERFACE column is a logical name that refers
to the name given in this option. It is useful when you want to specify the
same wildcard port name on two or more bridges. See
http://www.shorewall.net/bridge-Shorewall-perl.html#Multiple.
If the interface name is a wildcard name (ends with '+'), then the
physical name must also end in '+'.
If physical is not specified, then it's value defaults to the
interface name.
required
Added in Shorewall 4.4.10. When specified, the
firewall will fail to start if the interface named in the INTERFACE column is
not usable. May not be specified together with optional.
routeback
If specified, indicates that shorewall6 should
include rules that allow traffic arriving on this interface to be routed back
out that same interface. This option is also required when you have used a
wildcard in the INTERFACE column if you want to allow traffic between the
interfaces that match the wildcard.
Beginning with Shorewall 4.4.20, if you specify this option, then you should
also specify sfilter (see below).
sourceroute[={0|1}]
If this option is not specified for an
interface, then source-routed packets will not be accepted from that interface
(sets /proc/sys/net/ipv6/conf/ interface/accept_source_route to 1).
Only set this option if you know what you are doing. This might represent a
security risk and is not usually needed.
Only those interfaces with the sourceroute option will have their setting
changes; the value assigned to the setting will be the value specified (if
any) or 1 if no value is given.
Note
This option does not work with a wild-card interface name (e.g., eth0.+)
in the INTERFACE column.
sfilter=( net[,...])
Added in Shorewall 4.4.20. At this writing
(spring 2011), Linux does not support reverse path filtering (RFC3704) for
IPv6. In its absence, sfilter may be used as an anti-spoofing measure.
This option should be used on bridges or other interfaces with the
routeback option. On these interfaces, sfilter should list those
local networks that are connected to the firewall through other
interfaces.
tcpflags
Packets arriving on this interface are checked
for certain illegal combinations of TCP flags. Packets found to have such a
combination of flags are handled according to the setting of
TCP_FLAGS_DISPOSITION after having been logged according to the setting of
TCP_FLAGS_LOG_LEVEL.
proxyndp[={0|1}]
Sets
/proc/sys/net/ipv6/conf/interface/proxy_ndp.
Note: This option does not work with a wild-card interface name
(e.g., eth0.+) in the INTERFACE column.
Only those interfaces with the proxyndp option will have their setting
changed; the value assigned to the setting will be the value specified (if
any) or 1 if no value is given.
wait=seconds
Added in Shorewall 4.4.10. Causes the
generated script to wait up to seconds seconds for the interface to
become usable before applying the required or optional
options.
EXAMPLE¶
Example 1:Suppose you have eth0 connected to a DSL modem
and eth1 connected to your local network You have a DMZ using eth2.
Your entries for this setup would look like:
Example 4 (Shorewall 4.4.9 and later):
FORMAT 2 #ZONE INTERFACE OPTIONS net eth0 - loc eth1 - dmz eth2 -
You have a bridge with no IP address and you
want to allow traffic through the bridge.
FORMAT 2 #ZONE INTERFACE OPTIONS - br0 routeback
FILES¶
/etc/shorewall6/interfacesSEE ALSO¶
http://shorewall.net/configuration_file_basics.htm#Pairs shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5), shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-maclist(5), shoewall6-netmap(5),shorewall6-params(5), shorewall6-policy(5), shorewall6-providers(5), shorewall6-rtrules(5), shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5), shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5), shorewall6-tcrules(5), shorewall6-tos(5), shorewall6-tunnels(5), shorewall6-zones(5)NOTES¶
- 1.
- shorewall6-hosts
- 2.
- shorewall6-nesting
- 3.
- shorewall6-blacklist
- 4.
- shorewall6-zones
- 5.
- simple bridge
- 6.
- Shorewall-perl for firewall/bridging
- 7.
- shorewall-rules
| 06/28/2012 | [FIXME: source] |