NAME¶

shorewall6.conf - Shorewall6 global configuration file

SYNOPSIS¶

DESCRIPTION¶

This file sets options that apply to Shorewall6 as a whole. The file consists of Shell comments (lines beginning with '#'), blank lines and assignment statements ( variable=value). If the value contains shell metacharacters or white-space, then it must be enclosed in quotes. Example: LOG_LEVEL="NFLOG(1,0,1)".

OPTIONS¶

Many options have as their value a log-level. Log levels are a method of describing to syslog (8) the importance of a message and a number of parameters in this file have log levels as their value. These levels are defined by syslog and are used to determine the destination of the messages through entries in /etc/syslog.conf (5). The syslog documentation refers to these as "priorities"; Netfilter calls them "levels" and Shorewall6 also uses that term. Valid levels are: For most Shorewall6 logging, a level of 6 (info) is appropriate. Shorewall6 log messages are generated by NetFilter and are logged using facility 'kern' and the level that you specifify. If you are unsure of the level to choose, 6 (info) is a safe bet. You may specify levels by name or by number. If you have built your kernel with NFLOG target support, you may also specify a log level of NFLOG (must be all caps). Rather than log its messages to syslogd, Shorewall6 will direct netfilter to log the messages via the NFLOG target which will send them to a process called 'ulogd'. ulogd is available with most Linux distributions (although it probably isn't installed by default). Ulogd is also available from http://www.netfilter.org/projects/ulogd/index.html and can be configured to log all Shorewall6 message to their own log file The following options may be set in shorewall6.conf. ACCEPT_DEFAULT={action|none} DROP_DEFAULT={action|none} NFQUEUE_DEFAULT={action|none} QUEUE_DEFAULT={action|none} REJECT_DEFAULT={action|none} ACCOUNTING=[Yes|No] ACCOUNTING_TABLE=[filter|mangle] ADMINISABSENTMINDED=[Yes|No] AUTO_COMMENT=[Yes|No] AUTOMAKE=[Yes|No] BLACKLIST_DISPOSITION=[DROP|A_DROP|REJECT|A_REJECT] BLACKLIST_LOGLEVEL=[log-level] BLACKLISTNEWONLY={Yes|No} CLAMPMSS=[Yes|No|value] CLEAR_TC=[Yes|No] COMPLETE=[Yes|No] CONFIG_PATH=[directory[:directory]...] DELETE_THEN_ADD={Yes|No} DONT_LOAD=[module[,module]...] DYNAMIC_BLACKLIST={Yes|No} EXPAND_POLICIES={Yes|No} EXPORTMODULES=[Yes|No] EXPORTPARAMS={Yes|No} FASTACCEPT={Yes|No} FORWARD_CLEAR_MARK={Yes|No} GEOIPDIR=[pathname] HIGH_ROUTE_MARKS={Yes|No} IMPLICIT_CONTINUE={Yes|No} IP=[pathname] IP_FORWARDING=[On|Off|Keep] IP6TABLES=[pathname] IPSET=[pathname] IPSET_WARNINGS={Yes|No} KEEP_RT_TABLES={Yes|No} LEGACY_FASTSTART={Yes|No} LOAD_HELPERS_ONLY={Yes|No} LOCKFILE=[pathname] LOG_VERBOSITY=[number] LOGALLNEW=[log-level] LOGFILE=[pathname] LOGFORMAT=["formattemplate"] LOGLIMIT=[[{s|d}:]rate/{sec|min|hour|day}[:burst]] LOGBURST=[burst] LOGRATE=[rate/{minute|second}] LOGTAGONLY=[Yes|No] MACLIST_DISPOSITION=[ACCEPT|DROP|REJECT|A_DROP|A_REJECT] MACLIST_LOG_LEVEL=[log-level] MACLIST_TABLE=[filter|mangle] MACLIST_TTL=[number] MANGLE_ENABLED=[Yes|No] MARK_IN_FORWARD_CHAIN=[Yes|No] MASK_BITS=[number] MODULE_SUFFIX=["extension ..."] MODULESDIR=[pathname[:pathname]...] MUTEX_TIMEOUT=[seconds] OPTIMIZE=[value] OPTIMIZE_ACCOUNTING=[Yes|No] PATH=pathname[:pathname]... PERL=pathname PROVIDER_BITS=[number] PROVIDER_OFFSET=[number] RCP_COMMAND="command" RSH_COMMAND="command" The default values for these are as follows:.RS 4 RSH_COMMAND: ssh ${root}@${system} ${command} Shell variables that will be set when the commands are envoked are as follows:.RS 4 root - root user. Normally
root but may be overridden using the '-r'
option. RELATED_DISPOSITION=[ACCEPT|A_ACCEPT|A_DROP|A_REJECT|DROP|REJECT] RELATED_LOG_LEVEL=log-level REQUIRE_INTERFACE=[Yes|No] RESTOREFILE=filename SHOREWALL_SHELL=[pathname] SMURF_DISPOSITION=[DROP|A_DROP] SMURF_LOG_LEVEL=[log-level] SFILTER_DISPOSITION=[DROP|REJECT|A_DROP|A_REJECT] SFILTER_LOG_LEVEL=log-level STARTUP_ENABLED={Yes|No} STARTUP_LOG=[pathname] SUBSYSLOCK=[pathname] TC=[pathname] TC_BITS=[number] TC_ENABLED=[Yes|No|Internal|Shared] TC_EXPERT={Yes|No} TC_PRIOMAP=map TCP_FLAGS_DISPOSITION=[ACCEPT|DROP|REJECT] TCP_FLAGS_LOG_LEVEL=[log-level] TRACK_PROVIDERS={Yes|No} USE_DEFAULT_RT=[Yes|No] USE_PHYSICAL_NAMES=[Yes|No] VERBOSITY=[number] WIDE_TC_MARKS={Yes|No} ZONE_BITS=[number] ZONE2ZONE={2|-}

FILES¶

/etc/shorewall6/shorewall6.conf

SEE ALSO¶

shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5), shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-interfaces(5), shorewall6-ipsec(5), shorewall6-maclist(5), shorewall6-masq(5), shorewall6-nat(5), shorewall6-netmap(5), shoewall6-netmap(5),shorewall6-params(5), shorewall6-policy(5), shorewall6-providers(5), shorewall6-proxyarp(5), shorewall6-rtrules(5), shorewall6-routestopped(5), shorewall6-rules(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5), shorewall6-tcrules(5), shorewall6-tos(5), shorewall6-tunnels(5), shorewall6-zones(5)

NOTES¶

1.

shorewall6-policy

2.

shorewall6-accounting

3.

shorewall-accounting

4.

shorewall6-routestopped

5.

shorewall6-rules

6.

shorewall6-blrules

7.

shorewall-blrules

8.

shorewall6-tcrules

9.

shorewall-conf

10.

shorewall6-zones

11.

shorewall6-nesting

12.

shorewall-maclist

13.

shorewall.conf

14.

the complete matrix of host groups defined by the zones, interfaces and hosts files

15.

shorewall6-rules

16.

shorewall6-rules

17.

Shorewall Init Package

18.

shorewall-interfaces

19.

shorewall6-interfaces

20.

Hairpin packets are packets that are routed out of the same interface that they arrived on.

21.

Hairpin packets are packets that are routed out of the same interface that they arrived on.

22.

shorewall6-tcrules

23.

shorewall6-providers

24.

shorewall6-tcpri

25.

shorewall6-rtrules

26.

shorewall6-routing_rules