shorewall6-lite-5.0.4/ 0000755 0000000 0000000 00000000000 12650243750 013243 5 ustar root root shorewall6-lite-5.0.4/shorewallrc.cygwin 0000644 0000000 0000000 00000002260 12650243750 017012 0 ustar root root #
# Cygwin Shorewall 5.0 rc file
#
BUILD=cygwin
HOST=cygwin
PREFIX=/usr #Top-level directory for shared files, libraries, etc.
SHAREDIR=${PREFIX}/share #Directory for arch-neutral files.
LIBEXECDIR=${PREFIX}/share #Directory for executable scripts.
PERLLIBDIR=${PREFIX}/share/shorewall #Directory to install Shorewall Perl module directory
CONFDIR=/etc #Directory where subsystem configurations are installed
SBINDIR=/bin #Directory where system administration programs are installed
MANDIR=${SHAREDIR}/man #Directory where manpages are installed.
INITDIR=/etc/init.d #Unused on Cygwin
INITFILE= #Unused on Cygwin
INITSOURCE= #Unused on Cygwin
ANNOTATED= #Unused on Cygwin
SERVICEDIR= #Unused on Cygwin
SERVICEFILE= #Unused on Cygwin
SYSCONFDIR= #Unused on Cygwin
SPARSE=Yes #Only install $PRODUCT/$PRODUCT.conf in $CONFDIR.
VARLIB=/var/lib #Unused on Cygwin
shorewall6-lite-5.0.4/shorewallrc.slackware 0000644 0000000 0000000 00000003654 12650243750 017476 0 ustar root root #
# Slackware Shorewall 5.0 rc file
#
BUILD=slackware
HOST=slackware
PREFIX=/usr #Top-level directory for shared files, libraries, etc.
SHAREDIR=${PREFIX}/share #Directory for arch-neutral files.
LIBEXECDIR=${PREFIX}/share #Directory for executable scripts.
PERLLIBDIR=${PREFIX}/share/shorewall #Directory to install Shorewall Perl module directory
CONFDIR=/etc #Directory where subsystem configurations are installed
SBINDIR=/sbin #Directory where system administration programs are installed
MANDIR=${PREFIX}/man #Directory where manpages are installed.
INITDIR=/etc/rc.d #Directory where SysV init scripts are installed.
AUXINITSOURCE=init.slackware.firewall.sh #Name of the distributed file to be installed as the SysV init script
AUXINITFILE=rc.firewall #Name of the product's installed SysV init script
INITSOURCE=init.slackware.$PRODUCT.sh #Name of the distributed file to be installed as a second SysV init script
INITFILE=rc.$PRODUCT #Name of the product's installed second init script
SERVICEDIR= #Name of the directory where .service files are installed (systems running systemd only)
SERVICEFILE= #Name of the file to install in $SYSTEMD. Default is $PRODUCT.service
SYSCONFFILE= #Name of the distributed file to be installed in $SYSCONFDIR
SYSCONFDIR= #Name of the directory where SysV init parameter files are installed.
ANNOTATED= #If non-empty, install annotated configuration files
VARLIB=/var/lib #Directory where product variable data is stored.
VARDIR=${VARLIB}/$PRODUCT #Directory where product variable data is stored.
shorewall6-lite-5.0.4/default.debian 0000644 0000000 0000000 00000001661 12647470621 016044 0 ustar root root # prevent startup with default configuration
# set the following varible to 1 in order to allow Shorewall6-lite to start
startup=0
# If your Shorewall6-lite configuration requires detection of the ip address of
# a ppp interface, you must list such interfaces in "wait_interface" to get
# Shorewall6-lite to wait until the interface is configured. Otherwise the
# script will fail because it won't be able to detect the IP address.
#
# Example:
# wait_interface="ppp0"
# or
# wait_interface="ppp0 ppp1"
# or, if you have defined in /etc/shorewall6-lite/params
# wait_interface=
#
# Startup options
#
OPTIONS=""
#
# Start options
#
STARTOPTIONS=""
#
# Restart options
#
RESTARTOPTIONS=""
#
# Init Log -- if /dev/null, use the STARTUP_LOG defined in shorewall.conf
#
INITLOG=/dev/null
#
# Set this to 1 to cause '/etc/init.d/shorewall6-lite stop' to place the firewall in
# a safe state rather than to open it
#
SAFESTOP=0
# EOF
shorewall6-lite-5.0.4/init.debian.sh 0000755 0000000 0000000 00000006163 12647470621 016001 0 ustar root root #!/bin/sh
### BEGIN INIT INFO
# Provides: shorewall6-lite
# Required-Start: $network $remote_fs
# Required-Stop: $network $remote_fs
# Default-Start: S
# Default-Stop: 0 6
# Short-Description: Configure the firewall at boot time
# Description: Configure the firewall according to the rules specified in
# /etc/shorewall6-lite
### END INIT INFO
. /lib/lsb/init-functions
SRWL=/sbin/shorewall6-lite
SRWL_OPTS="-tvv"
test -n ${INITLOG:=/var/log/shorewall6-lite-init.log}
[ "$INITLOG" = "/dev/null" ] && SHOREWALL_INIT_SCRIPT=1 || SHOREWALL_INIT_SCRIPT=0
export SHOREWALL_INIT_SCRIPT
test -x $SRWL || exit 0
test -x $WAIT_FOR_IFUP || exit 0
test -n "$INITLOG" || {
echo "INITLOG cannot be empty, please configure $0" ;
exit 1;
}
if [ "$(id -u)" != "0" ]
then
echo "You must be root to start, stop or restart \"Shorewall6 Lite firewall\"."
exit 1
fi
echo_notdone () {
if [ "$INITLOG" = "/dev/null" ] ; then
echo "not done."
else
echo "not done (check $INITLOG)."
fi
exit 1
}
not_configured () {
echo "#### WARNING ####"
echo "the firewall won't be started/stopped unless it is configured"
if [ "$1" != "stop" ]
then
echo ""
echo "Please read about Debian specific customization in"
echo "/usr/share/doc/shorewall6-lite/README.Debian.gz."
fi
echo "#################"
exit 0
}
# parse the shorewall6 params file in order to use params in
# /etc/default/shorewall6
if [ -f "/etc/shorewall6-lite/params" ]
then
. /etc/shorewall6-lite/params
fi
# check if shorewall is configured or not
if [ -f "/etc/default/shorewall6-lite" ]
then
. /etc/default/shorewall6-lite
SRWL_OPTS="$SRWL_OPTS $OPTIONS"
if [ "$startup" != "1" ]
then
not_configured
fi
else
not_configured
fi
#
# The installer may alter this
#
. /usr/share/shorewall/shorewallrc
# start the firewall
shorewall6_start () {
echo -n "Starting \"Shorewall6 Lite firewall\": "
$SRWL $SRWL_OPTS start $STARTOPTIONS >> $INITLOG 2>&1 && echo "done." || echo_notdone
return 0
}
# stop the firewall
shorewall6_stop () {
echo -n "Stopping \"Shorewall6 Lite firewall\": "
if [ "$SAFESTOP" = 1 ]; then
$SRWL $SRWL_OPTS stop >> $INITLOG 2>&1 && echo "done." || echo_notdone
else
$SRWL $SRWL_OPTS clear >> $INITLOG 2>&1 && echo "done." || echo_notdone
fi
return 0
}
# restart the firewall
shorewall6_restart () {
echo -n "Restarting \"Shorewall6 Lite firewall\": "
$SRWL $SRWL_OPTS restart $RESTARTOPTIONS >> $INITLOG 2>&1 && echo "done." || echo_notdone
return 0
}
# refresh the firewall
shorewall6_refresh () {
echo -n "Refreshing \"Shorewall6 Lite firewall\": "
$SRWL $SRWL_OPTS refresh >> $INITLOG 2>&1 && echo "done." || echo_notdone
return 0
}
# status of the firewall
shorewall6_status () {
$SRWL $SRWL_OPTS status && exit 0 || exit $?
}
case "$1" in
start)
shorewall6_start
;;
stop)
shorewall6_stop
;;
refresh)
shorewall6_refresh
;;
force-reload|restart)
shorewall6_restart
;;
status)
shorewall6_status
;;
*)
echo "Usage: /etc/init.d/shorewall6-lite {start|stop|refresh|restart|force-reload|status}"
exit 1
esac
exit 0
shorewall6-lite-5.0.4/modules 0000644 0000000 0000000 00000001325 12650243750 014637 0 ustar root root #
# Shorewall6 version 5 - Modules File
#
# /usr/share/shorewall6/modules
#
# This file loads the modules that may be needed by the firewall.
#
# THE ORDER OF THE COMMANDS BELOW IS IMPORTANT!!!!!! You MUST load in
# dependency order. i.e., if M2 depends on M1 then you must load M1
# before you load M2.
#
# If you need to modify this file, copy it to /etc/shorewall and modify the
# copy.
#
###############################################################################
#
# Essential Modules
#
INCLUDE modules.essential
#
# Other xtables modules
#
INCLUDE modules.xtables
#
# Helpers
#
INCLUDE helpers
#
# Ipset
#
INCLUDE modules.ipset
#
# Traffic Shaping
#
INCLUDE modules.tc
#
# Extensions
#
INCLUDE modules.extensions
shorewall6-lite-5.0.4/helpers 0000644 0000000 0000000 00000002547 12650243750 014640 0 ustar root root #
# Shorewall6 version 5 - Helpers File
#
# /usr/share/shorewall6/helpers
#
# This file loads the modules that may be needed by the firewall.
#
# THE ORDER OF THE COMMANDS BELOW IS IMPORTANT!!!!!! You MUST load in
# dependency order. i.e., if M2 depends on M1 then you must load M1
# before you load M2.
#
# If you need to modify this file, copy it to /etc/shorewall and modify the
# copy.
#
###############################################################################
#
# Helpers
#
loadmodule nf_conntrack_amanda
loadmodule nf_conntrack_ftp
loadmodule nf_conntrack_h323
loadmodule nf_conntrack_irc
loadmodule nf_conntrack_netbios_ns
loadmodule nf_conntrack_netbios_ns
loadmodule nf_conntrack_netlink
loadmodule nf_conntrack_pptp
loadmodule nf_conntrack_proto_sctp
loadmodule nf_conntrack_proto_udplite
loadmodule nf_conntrack_sane
loadmodule nf_conntrack_sip sip_direct_media=0
loadmodule nf_conntrack_pptp
loadmodule nf_conntrack_proto_gre
loadmodule nf_conntrack_proto_sctp
loadmodule nf_conntrack_sip
loadmodule nf_conntrack_tftp
loadmodule nf_conntrack_sane
#
# While not actually helpers, these are included here so that
# LOG_BACKEND can work correctly. Not all of them will be
# loaded, since at least one of them will be an alias on any
# given system.
#
loadmodule ip6t_LOG
loadmodule nf_log_ipv6
loadmodule xt_LOG
loadmodule xt_NFLOG
loadmodule nfnetlink_log
shorewall6-lite-5.0.4/shorewall6-lite.conf 0000644 0000000 0000000 00000003374 12647470621 017147 0 ustar root root ###############################################################################
# /etc/shorewall6-lite/shorewall6-lite.conf Version 5 - Change the following
# variables to override the values in the shorewall.conf file used to
# compile /var/lib/shorewall-lite/firewall. Those values may be found in
# /var/lib/shorewall-lite/firewall.conf.
#
# For information about the settings in this file, type
# "man shorewall6-lite.conf"
#
# Manpage also online at
# http://www.shorewall.net/manpages6/shorewall6-lite.conf.html.
###############################################################################
# N 0 T E
###############################################################################
# Entries in this file override entries in the shorewall.conf file in the
# export directory when the firewall script was compiled. Any variable
# not set here assumes the value defined at firewall compilation time.
#
# PROVIDED THAT shorewall.conf IN THE EXPORT DIRECTORY IS CORRECT, YOU DO NOT
# NEED TO MODIFY THIS FILE IN ANY WAY
###############################################################################
# V E R B O S I T Y
###############################################################################
VERBOSITY=
###############################################################################
# L O G G I N G
###############################################################################
LOGFILE=
###############################################################################
# L O C A T I O N O F F I L E S A N D D I R E C T O R I E S
###############################################################################
IP6TABLES=
PATH=
SHOREWALL_SHELL=
SUBSYSLOCK=
RESTOREFILE=
#LAST LINE -- DO NOT REMOVE
shorewall6-lite-5.0.4/README.txt 0000644 0000000 0000000 00000000066 12647470621 014750 0 ustar root root This is the Shorewall6-lite stable 4.4 branch of Git.
shorewall6-lite-5.0.4/shorewallrc.default 0000644 0000000 0000000 00000003534 12650243750 017143 0 ustar root root #
# Default Shorewall 5.0 rc file
#
HOST=linux #Generic Linux
BUILD= #Default is to detect the build system
PREFIX=/usr #Top-level directory for shared files, libraries, etc.
SHAREDIR=${PREFIX}/share #Directory for arch-neutral files.
LIBEXECDIR=${PREFIX}/share #Directory for executable scripts.
PERLLIBDIR=${PREFIX}/share/shorewall #Directory to install Shorewall Perl module directory
CONFDIR=/etc #Directory where subsystem configurations are installed
SBINDIR=/sbin #Directory where system administration programs are installed
MANDIR=${PREFIX}/man #Directory where manpages are installed.
INITDIR=/etc/init.d #Directory where SysV init scripts are installed.
INITFILE=$PRODUCT #Name of the product's installed SysV init script
INITSOURCE=init.sh #Name of the distributed file to be installed as the SysV init script
ANNOTATED= #If non-zero, annotated configuration files are installed
SERVICEDIR= #Directory where .service files are installed (systems running systemd only)
SERVICEFILE= #Name of the file to install in $SYSTEMD. Default is $PRODUCT.service
SYSCONFFILE= #Name of the distributed file to be installed in $SYSCONFDIR
SYSCONFDIR= #Directory where SysV init parameter files are installed
SPARSE= #If non-empty, only install $PRODUCT/$PRODUCT.conf in $CONFDIR
VARLIB=/var/lib #Directory where product variable data is stored.
VARDIR=${VARLIB}/$PRODUCT #Directory where product variable data is stored.
shorewall6-lite-5.0.4/shorewallrc.openwrt 0000644 0000000 0000000 00000003366 12650243750 017220 0 ustar root root #
# Created by Shorewall Core version 5.0.2-RC1 configure - Fri, Nov 06, 2015 10:02:03 AM
#
# Input: host=openwrt
#
PREFIX=/usr #Top-level directory for shared files, libraries, etc.
SHAREDIR=${PREFIX}/share #Directory for arch-neutral files.
LIBEXECDIR=${PREFIX}/share #Directory for executable scripts.
PERLLIBDIR=${PREFIX}/share/shorewall #Directory to install Shorewall Perl module directory
CONFDIR=/etc #Directory where subsystem configurations are installed
SBINDIR=/sbin #Directory where system administration programs are installed
MANDIR= #Directory where manpages are installed.
INITDIR=/etc/init.d #Directory where SysV init scripts are installed.
INITFILE=$PRODUCT #Name of the product's installed SysV init script
INITSOURCE=init.openwrt.sh #Name of the distributed file to be installed as the SysV init script
ANNOTATED= #If non-zero, annotated configuration files are installed
SYSCONFDIR=${CONFDIR}/sysconfig #Directory where SysV init parameter files are installed
SYSCONFFILE=sysconfig #Name of the distributed file to be installed in $SYSCONFDIR
SERVICEDIR= #Directory where .service files are installed (systems running systemd only)
SERVICEFILE= #Name of the file to install in $SYSTEMD. Default is $PRODUCT.service
SPARSE= #If non-empty, only install $PRODUCT/$PRODUCT.conf in $CONFDIR
VARLIB=/lib #Directory where product variable data is stored.
VARDIR=${VARLIB}/$PRODUCT #Directory where product variable data is stored.
shorewall6-lite-5.0.4/shorewallrc.apple 0000644 0000000 0000000 00000002262 12650243750 016615 0 ustar root root #
# Apple OS X Shorewall 5.0 rc file
#
BUILD=apple
HOST=apple
PREFIX=/usr #Top-level directory for shared files, libraries, etc.
SHAREDIR=${PREFIX}/share #Directory for arch-neutral files.
LIBEXECDIR=${PREFIX}/share #Directory for executable scripts.
PERLLIBDIR=${PREFIX}/share/shorewall #Directory to install Shorewall Perl module directory
CONFDIR=/etc #Directory where subsystem configurations are installed
SBINDIR=/sbin #Directory where system administration programs are installed
MANDIR=${SHAREDIR}/man #Directory where manpages are installed.
INITDIR= #Unused on OS X
INITFILE= #Unused on OS X
INITSOURCE= #Unused on OS X
ANNOTATED= #Unused on OS X
SERVICEDIR= #Unused on OS X
SERVICEFILE= #Unused on OS X
SYSCONFDIR= #Unused on OS X
SPARSE=Yes #Only install $PRODUCT/$PRODUCT.conf in $CONFDIR.
VARLIB=/var/lib #Unused on OS X
shorewall6-lite-5.0.4/shorewallrc.debian.sysvinit 0000644 0000000 0000000 00000003377 12650243750 020635 0 ustar root root #
# Debian Shorewall 4.5 rc file
#
BUILD= #Default is to detect the build system
HOST=debian
PREFIX=/usr #Top-level directory for shared files, libraries, etc.
SHAREDIR=${PREFIX}/share #Directory for arch-neutral files.
LIBEXECDIR=${PREFIX}/share #Directory for executable scripts.
PERLLIBDIR=${PREFIX}/share/shorewall #Directory to install Shorewall Perl module directory
CONFDIR=/etc #Directory where subsystem configurations are installed
SBINDIR=/sbin #Directory where system administration programs are installed
MANDIR=${PREFIX}/share/man #Directory where manpages are installed.
INITDIR=/etc/init.d #Directory where SysV init scripts are installed.
INITFILE=$PRODUCT #Name of the product's installed SysV init script
INITSOURCE=init.debian.sh #Name of the distributed file to be installed as the SysV init script
ANNOTATED= #If non-zero, annotated configuration files are installed
SYSCONFFILE=default.debian #Name of the distributed file to be installed in $SYSCONFDIR
SERVICEFILE= #Name of the file to install in $SYSTEMD. Default is $PRODUCT.service
SYSCONFDIR=/etc/default #Directory where SysV init parameter files are installed
SERVICEDIR= #Directory where .service files are installed (systems running systemd only)
SPARSE=Yes #If non-empty, only install $PRODUCT/$PRODUCT.conf in $CONFDIR
VARLIB=/var/lib #Directory where product variable data is stored.
VARDIR=${VARLIB}/$PRODUCT #Directory where product variable data is stored.
shorewall6-lite-5.0.4/configure 0000755 0000000 0000000 00000012204 12650243750 015151 0 ustar root root #!/bin/bash
#
# Shorewall Packet Filtering Firewall RPM configuration program - V4.6
#
# (c) 2012,2014 - Tom Eastep (teastep@shorewall.net)
#
# Shorewall documentation is available at http://www.shorewall.net
#
# This program is part of Shorewall.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by the
# Free Software Foundation, either version 2 of the license or, at your
# option, any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, see = ] ...
#
#
################################################################################################
#
# Build updates this
#
VERSION=5.0.4
case "$BASH_VERSION" in
[4-9].*)
;;
*)
echo "ERROR: This program requires Bash 4.0 or later" >&2
exit 1
;;
esac
declare -A params
declare -A options
getfileparams() {
while read option; do
case $option in
\#*)
;;
*)
on=${option%=*}
ov=${option#*=}
ov=${ov%#*}
[ -n "$on" ] && options[${on}]="${ov}"
;;
esac
done
return 0
}
for p in $@; do
if [ -n "${p}" ]; then
declare -u pn
pn=${p%=*}
pn=${pn#--}
pv=${p#*=}
if [ -n "${pn}" ]; then
case ${pn} in
VENDOR)
pn=HOST
;;
SHAREDSTATEDIR)
pn=VARLIB
;;
DATADIR)
pn=SHAREDIR
;;
esac
params[${pn}]="${pv}"
else
echo "ERROR: Invalid option ($p)" >&2
exit 1
fi
fi
done
cd $(dirname $0)
vendor=${params[HOST]}
if [ -z "$vendor" ]; then
if [ -f /etc/os-release ]; then
eval $(cat /etc/os-release | grep ^ID=)
case $ID in
fedora|rhel)
vendor=redhat
;;
debian|ubuntu)
vendor=debian
;;
opensuse)
vendor=suse
;;
*)
vendor="$ID"
;;
esac
params[HOST]="$vendor"
fi
fi
if [ -z "$vendor" ]; then
case `uname` in
Darwin)
params[HOST]=apple
rcfile=shorewallrc.apple
;;
cygwin*|CYGWIN*)
params[HOST]=cygwin
rcfile=shorewallrc.cygwin
;;
*)
if [ -f /etc/debian_version ]; then
params[HOST]=debian
ls -l /sbin/init | fgrep -q systemd && rcfile=shorewallrc.debian.systemd || rcfile=shorewallrc.debian.sysvinit
elif [ -f /etc/redhat-release ]; then
params[HOST]=redhat
rcfile=shorewallrc.redhat
elif [ -f /etc/slackware-version ] ; then
params[HOST]=slackware
rcfile=shorewallrc.slackware
elif [ -f /etc/SuSE-release ]; then
params[HOST]=suse
rcfile=shorewallrc.suse
elif [ -f /etc/arch-release ] ; then
params[HOST]=archlinux
rcfile=shorewallrc.archlinux
elif [ -f /etc/openwrt_release ]; then
params[HOST]=openwrt
rcfile=shorewallrc.openwrt
else
params[HOST]=linux
rcfile=shorewallrc.default
fi
;;
esac
vendor=${params[HOST]}
else
if [ $vendor = linux ]; then
rcfile=shorewallrc.default;
elif [ $vendor = debian -a -f /etc/debian_version ]; then
ls -l /sbin/init | fgrep -q systemd && rcfile=shorewallrc.debian.systemd || rcfile=shorewallrc.debian.sysvinit
else
rcfile=shorewallrc.$vendor
fi
if [ ! -f $rcfile ]; then
echo "ERROR: $vendor is not a recognized host type" >&2
exit 1
elif [ $vendor = default ]; then
params[HOST]=linux
vendor=linux
elif [[ $vendor == debian.* ]]; then
params[HOST]=debian
vendor=debian
fi
fi
if [ $vendor = linux ]; then
echo "INFO: Creating a generic Linux installation - " `date`;
else
echo "INFO: Creating a ${params[HOST]}-specific installation - " `date`;
fi
echo
getfileparams < $rcfile || exit 1
for p in ${!params[@]}; do
options[${p}]="${params[${p}]}"
done
echo '#' > shorewallrc
echo "# Created by Shorewall Core version $VERSION configure - " `date` >> shorewallrc
echo "# rc file: $rcfile" >> shorewallrc
echo '#' >> shorewallrc
if [ $# -gt 0 ]; then
echo "# Input: $@" >> shorewallrc
echo '#' >> shorewallrc
fi
if [ -n "${options[VARLIB]}" ]; then
if [ -z "${options[VARDIR]}" ]; then
options[VARDIR]='${VARLIB}/${PRODUCT}'
fi
elif [ -n "${options[VARDIR]}" ]; then
if [ -z "{$options[VARLIB]}" ]; then
options[VARLIB]=${options[VARDIR]}
options[VARDIR]='${VARLIB}/${PRODUCT}'
fi
fi
if [ -z "${options[SERVICEDIR]}" ]; then
options[SERVICEDIR]="${options[SYSTEMD]}"
fi
for on in \
HOST \
PREFIX \
SHAREDIR \
LIBEXECDIR \
PERLLIBDIR \
CONFDIR \
SBINDIR \
MANDIR \
INITDIR \
INITSOURCE \
INITFILE \
AUXINITSOURCE \
AUXINITFILE \
SERVICEDIR \
SERVICEFILE \
SYSCONFFILE \
SYSCONFDIR \
SPARSE \
ANNOTATED \
VARLIB \
VARDIR
do
echo "$on=${options[${on}]}"
echo "$on=${options[${on}]}" >> shorewallrc
done
shorewall6-lite-5.0.4/uninstall.sh 0000755 0000000 0000000 00000011132 12650243750 015611 0 ustar root root #!/bin/sh
#
# Script to back uninstall Shoreline Firewall 6 Lite
#
# (c) 2000-2014 - Tom Eastep (teastep@shorewall.net)
#
# Shorewall documentation is available at http://shorewall.sourceforge.net
#
# This program is part of Shorewall.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by the
# Free Software Foundation, either version 2 of the license or, at your
# option, any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, see ]"
exit $1
}
fatal_error()
{
echo " ERROR: $@" >&2
exit 1
}
qt()
{
"$@" >/dev/null 2>&1
}
split() {
local ifs
ifs=$IFS
IFS=:
set -- $1
echo $*
IFS=$ifs
}
mywhich() {
local dir
for dir in $(split $PATH); do
if [ -x $dir/$1 ]; then
return 0
fi
done
return 2
}
remove_file() # $1 = file to restore
{
if [ -f $1 -o -L $1 ] ; then
rm -f $1
echo "$1 Removed"
fi
}
#
# Change to the directory containing this script
#
cd "$(dirname $0)"
finished=0
configure=1
while [ $finished -eq 0 ]; do
option=$1
case "$option" in
-*)
option=${option#-}
while [ -n "$option" ]; do
case $option in
h)
usage 0
;;
v)
echo "$Product Firewall Installer Version $VERSION"
exit 0
;;
n*)
configure=0
option=${option#n}
;;
*)
usage 1
;;
esac
done
shift
;;
*)
finished=1
;;
esac
done
#
# Read the RC file
#
if [ $# -eq 0 ]; then
if [ -f ./shorewallrc ]; then
. ./shorewallrc
elif [ -f ~/.shorewallrc ]; then
. ~/.shorewallrc || exit 1
file=./.shorewallrc
elif [ -f /usr/share/shorewall/shorewallrc ]; then
. /usr/share/shorewall/shorewallrc
else
fatal_error "No configuration file specified and /usr/share/shorewall/shorewallrc not found"
fi
elif [ $# -eq 1 ]; then
file=$1
case $file in
/*|.*)
;;
*)
file=./$file
;;
esac
. $file
else
usage 1
fi
if [ -f ${SHAREDIR}/shorewall6-lite/version ]; then
INSTALLED_VERSION="$(cat ${SHAREDIR}/shorewall6-lite/version)"
if [ "$INSTALLED_VERSION" != "$VERSION" ]; then
echo "WARNING: Shorewall6 Lite Version $INSTALLED_VERSION is installed"
echo " and this is the $VERSION uninstaller."
VERSION="$INSTALLED_VERSION"
fi
else
echo "WARNING: Shorewall6 Lite Version $VERSION is not installed"
VERSION=""
fi
echo "Uninstalling Shorewall6 Lite $VERSION"
[ -n "$SANDBOX" ] && configure=0
if [ $configure -eq 1 ]; then
if qt ip6tables -L shorewall -n && [ ! -f ${SBINDIR}/shorewall6 ]; then
${SBINDIR}/shorewall6-lite clear
fi
fi
if [ -f ${SHAREDIR}/shorewall6-lite/init ]; then
if [ $HOST = openwrt ]; then
if [ $configure -eq 1 ] && /etc/init.d/shorewall6-lite enabled; then
/etc/init.d/shorewall6-lite disable
fi
FIREWALL=$(readlink ${SHAREDIR}/shorewall6-lite/init)
else
FIREWALL=$(readlink -m -q ${SHAREDIR}/shorewall6-lite/init)
fi
elif [ -n "$INITFILE" ]; then
FIREWALL=${INITDIR}/${INITFILE}
fi
if [ -f "$FIREWALL" ]; then
if [ $configure -eq 1 ]; then
if mywhich updaterc.d ; then
updaterc.d shorewall6-lite remove
elif mywhich insserv ; then
insserv -r $FIREWALL
elif mywhich chkconfig ; then
chkconfig --del $(basename $FIREWALL)
elif mywhich systemctl ; then
systemctl disable shorewall6-lite
fi
fi
remove_file $FIREWALL
fi
[ -z "$SERVICEDIR" ] && SERVICEDIR="$SYSTEMD"
if [ -n "$SERVICEDIR" ]; then
[ $configure -eq 1 ] && systemctl disable ${PRODUCT}
rm -f $SERVICEDIR/shorewall6-lite.service
fi
rm -f ${SBINDIR}/shorewall6-lite
rm -rf ${CONFDIR}/shorewall6-lite
rm -rf ${VARDIR}
rm -rf ${SHAREDIR}/shorewall6-lite
rm -rf ${LIBEXECDIR}/shorewall6-lite
rm -f ${CONFDIR}/logrotate.d/shorewall6-lite
rm -f ${SYSCONFDIR}/shorewall6-lite
if [ -n "${MANDIR}" ]; then
rm -f ${MANDIR}/man5/shorewall6-lite*
rm -f ${MANDIR}/man8/shorewall6-lite*
fi
echo "Shorewall6 Lite Uninstalled"
shorewall6-lite-5.0.4/modules.tc 0000644 0000000 0000000 00000001341 12650243750 015242 0 ustar root root #
# Shorewall6 version 5 - Traffic Shaping Modules File
#
# /usr/share/shorewall6/modules.tc
#
# This file loads the modules that may be needed by the firewall.
#
# THE ORDER OF THE COMMANDS BELOW IS IMPORTANT!!!!!! You MUST load in
# dependency order. i.e., if M2 depends on M1 then you must load M1
# before you load M2.
#
# If you need to modify this file, copy it to /etc/shorewall and modify the
# copy.
#
###############################################################################
loadmodule sch_sfq
loadmodule sch_ingress
loadmodule sch_htb
loadmodule sch_hfsc
loadmodule sch_prio
loadmodule sch_tbf
loadmodule sch_fq_codel
loadmodule cls_u32
loadmodule cls_fw
loadmodule cls_flow
loadmodule cls_basic
loadmodule act_police
shorewall6-lite-5.0.4/changelog.txt 0000644 0000000 0000000 00000010646 12650243750 015742 0 ustar root root Changes in 5.0.4 Final
1) Update release documents.
Changes in 5.0.4 RC 2
1) Update release documents.
2) Handle @CALLER in policy actions
3) Sort red and codel options for reproducability.
4) Remove chain restrictions from -m geoip
5) Clean up sysconfig files.
Changes in 5.0.4 RC 1
1) Update release documents.
2) Create unique chains when @caller is used.
3) Correct hashlimit in logging rules
4) Avoid errors when 'status -i' finds no .status files.
5) Improve the maintainability of action-tuple code
Changes in 5.0.4 Beta 2
1) Update release documents.
2) Added HAProxy support.
Changes in 5.0.4 Beta 1
1) Update release documents.
2) Shorewall-init installer support for OpenWRT.
3) sysconfig files included for additional distributions.
4) Make IP[6]TABLES transparent.
5) Specify the '--wait' option when creating the mangle table
capability test chain.
6) Implement the WAIT_OPTION capability.
7) Assume 2.14 or later systemd (Tuomo Soini).
Changes in 5.0.3 Final
1) Update release documents.
Changes in 5.0.3 RC 2
1) Update release documents.
2) Allow a timeout to be specified in ADD rules.
3) Allow commas in log tags when LOGTAGONLY=Yes
Changes in 5.0.3 RC 1
1) Update release documents.
Changes in 5.0.3 Beta 2
1) Update release documents.
2) Merge 5.0.2.1 install/uninstall/configure changes from Matt.
3) Fix MAC handling in IPv6.
4) Another configure.pl fix from Matt.
Changes in 5.0.3 Beta 1
1) Update release documents.
2) Merge Matt Darfeuille's installer/uninstaller changes.
3) Merge Tuomo Soini's column-name change and update manpages.
4) Redefine MODULESDIR.
5) Set IP_FORWARDING=keep in all shorewall6.conf files.
Changes in 5.0.2.1
1) Update release documents.
2) Use 'netstat' if 'ss' isn't installed.
3) Install/Uninstall fixes from Matt Darfeuille.
Changes in 5.0.2 Final
1) Update release documents.
2) 'configure' detects OpenWRT
3) Corrected the Shorewall6-lite uninstaller
Changes in 5.0.2 RC 1
1) Update release documents.
2) Add OpenWRT support in the installers (Tom and Matt Darfeuille)
3) Correct mkdir command in mutex_on.
4) Add support for openWRT's 'lock' utility
5) Enable optional interface during 'start' and 'restart'
Changes in 5.0.2 Beta 2
1) Update release documents.
2) Support for lib.cli-user
3) Support for OpenWRT BB and later
4) Correct installer/uninstaller issues
5) Improve circular buffer check
6) Correct HOST=default behavior
7) Allow remote- commands to return correct exit status
Changes in 5.0.2 Beta 1
1) Update release documents.
2) Merge Tuomo's MSSQL fix.
3) Merge Tuomo's version removal fix.
4) Add 'persistent' options to providers, rtrules and routes
5) Add 'lib.cli-user' support.
Changes in 5.0.1.1
1) Update release documents.
2) More version removal (Tuomo Soini).
3) Delete default route from main when load= or fallback.
4) Add 'persistent' options to providers, rtrules and routes.
5) Correct L2TP documentation.
Changes in 5.0.1
1) Update release documents.
2) Replace LEGACY_RESTART with RESTART
3) Merge 'seconds' and 'minutes' change from 4.6.13.
Changes in 5.0.0
1) Update release documents.
2) Remove options from 'update' warning messages.
3) Update documentation for obsolete file removal.
4) Apply Erich Titl's 'date' fix.
Changes in 5.0.0 RC 1
1) Update release documents.
2) .service file fixes from Tuomo Soini
Changes in 5.0.0 Beta 2
1) Update release documents.
2) Correct the 'reset' command
3) Allow table names in the reset command.
4) Add Gluster FS action
Changes in 5.0.0 Beta 1
1) Update release documents.
2) Redefine 'reload' and 'restart'.
3) Eliminate service.214 files.
4) Add 'reload' to the service files.
5) Allow connlimit by destination.
6) Add the LEGACY_RESTART option.
7) Deimplement support for several old options
8) Merge from 4.6.12
9) Correct a warning message to refer to 'mangle' rather than
'tcrules'.
10) Drop support for the 'tos', 'tcrules', 'routestopped', 'notrack'
and 'blacklist' files.
11) Disallow bare SECTION, COMMENT and FORMAT lines.
12) The -t update option also converts the 'tos' file.
13) Merge from 4.6.13.
14) Remove all of the individual options from the 'update' command.
15) Delimit inline matches with ';;'.
16) Allow log-tags in shorewall.conf options
17) Allow non-expoerts access to the user bits in the fw mark.
18) Add a PROBABILITY column to the masq files
shorewall6-lite-5.0.4/modules.extensions 0000644 0000000 0000000 00000001004 12650243750 017027 0 ustar root root #
# Shorewall6 version 5 - Extensions Modules File
#
# /usr/share/shorewall6/modules.extension
#
# This file loads the modules that may be needed by the firewall.
#
# THE ORDER OF THE COMMANDS BELOW IS IMPORTANT!!!!!! You MUST load in
# dependency order. i.e., if M2 depends on M1 then you must load M1
# before you load M2.
#
# If you need to modify this file, copy it to /etc/shorewall and modify the
# copy.
#
###############################################################################
loadmodule ip6_queue
shorewall6-lite-5.0.4/configure.pl 0000755 0000000 0000000 00000013227 12650243750 015571 0 ustar root root #! /usr/bin/perl -w
#
# Shorewall Packet Filtering Firewall RPM configuration program - V4.5
#
# (c) 2012, 2014 - Tom Eastep (teastep@shorewall.net)
#
# Shorewall documentation is available at http://www.shorewall.net
#
# This program is part of Shorewall.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by the
# Free Software Foundation, either version 2 of the license or, at your
# option, any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, see = ...
#
#
################################################################################################
use strict;
#
# Build updates this
#
use constant {
VERSION => '5.0.4'
};
my %params;
my %options;
my %aliases = ( VENDOR => 'HOST',
SHAREDSTATEDIR => 'VARLIB',
DATADIR => 'SHAREDIR' );
for ( @ARGV ) {
die "ERROR: Invalid option specification ( $_ )" unless /^(?:--)?(\w+)=(.*)$/;
my $pn = uc $1;
my $pv = $2 || '';
$pn = $aliases{$pn} if exists $aliases{$pn};
$params{$pn} = $pv;
}
use File::Basename;
chdir dirname($0);
my $vendor = $params{HOST};
my $rcfile;
my $rcfilename;
unless ( defined $vendor ) {
if ( -f '/etc/os-release' ) {
my $id = `cat /etc/os-release | grep ^ID=`;
chomp $id;
$id =~ s/ID=//;
if ( $id eq 'fedora' || $id eq 'rhel' ) {
$vendor = 'redhat';
} elsif ( $id eq 'opensuse' ) {
$vendor = 'suse';
} elsif ( $id eq 'ubuntu' || $id eq 'debian' ) {
my $init = `ls -l /sbin/init`;
$vendor = $init =~ /systemd/ ? 'debian.systemd' : 'debian.sysvinit';
} else {
$vendor = $id;
}
}
$params{HOST} = $vendor;
$params{HOST} =~ s/\..*//;
}
if ( defined $vendor ) {
if ( $vendor eq 'debian' && -f '/etc/debian_version' ) {
if ( -l '/sbin/init' ) {
if ( readlink('/sbin/init') =~ /systemd/ ) {
$rcfilename = 'shorewallrc.debian.systemd';
} else {
$rcfilename = 'shorewallrc.debian.sysvinit';
}
} else {
$rcfilename = 'shorewallrc.debian.sysvinit';
}
} else {
$rcfilename = $vendor eq 'linux' ? 'shorewallrc.default' : 'shorewallrc.' . $vendor;
}
unless ( -f $rcfilename ) {
die qq("ERROR: $vendor" is not a recognized host type);
} elsif ( $vendor eq 'default' ) {
$params{HOST} = $vendor = 'linux';
} elsif ( $vendor =~ /^debian\./ ) {
$params{HOST} = $vendor = 'debian';
}
} else {
if ( -f '/etc/debian_version' ) {
$vendor = 'debian';
if ( -l '/sbin/init' ) {
if ( readlink( '/sbin/init' ) =~ /systemd/ ) {
$rcfilename = 'shorewallrc.debian.systemd';
} else {
$rcfilename = 'shorewallrc.debian.sysvinit';
}
} else {
$rcfilename = 'shorewallrc.debian.sysvinit';
}
} elsif ( -f '/etc/redhat-release' ){
$vendor = 'redhat';
$rcfilename = 'shorewallrc.redhat';
} elsif ( -f '/etc/slackware-version' ) {
$vendor = 'slackware';
$rcfilename = 'shorewallrc.slackware';
} elsif ( -f '/etc/SuSE-release' ) {
$vendor = 'suse';
$rcfilename = 'shorewallrc.suse';
} elsif ( -f '/etc/arch-release' ) {
$vendor = 'archlinux';
$rcfilename = 'shorewallrc.archlinux';
} elsif ( `uname` =~ '^Darwin' ) {
$vendor = 'apple';
$rcfilename = 'shorewallrc.apple';
} elsif ( `uname` =~ /^Cygwin/i ) {
$vendor = 'cygwin';
$rcfilename = 'shorewallrc.cygwin';
} else {
$vendor = 'linux';
$rcfilename = 'shorewallrc.default';
}
$params{HOST} = $vendor;
}
my @localtime = localtime;
my @abbr = qw( Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec );
if ( $vendor eq 'linux' ) {
printf "INFO: Creating a generic Linux installation - %s %2d %04d %02d:%02d:%02d\n\n", $abbr[$localtime[4]], $localtime[3], 1900 + $localtime[5] , @localtime[2,1,0];;
} else {
printf "INFO: Creating a %s-specific installation - %s %2d %04d %02d:%02d:%02d\n\n", $params{HOST}, $abbr[$localtime[4]], $localtime[3], 1900 + $localtime[5] , @localtime[2,1,0];;
}
open $rcfile, '<', $rcfilename or die "Unable to open $rcfilename for input: $!";
while ( <$rcfile> ) {
s/\s*#.*//;
unless ( /^\s*$/ ) {
chomp;
die "ERROR: Invalid entry ($_) in $rcfilename, line $." unless /\s*(\w+)=(.*)/;
$options{$1} = $2;
}
}
close $rcfile;
while ( my ( $p, $v ) = each %params ) {
$options{$p} = ${v};
}
my $outfile;
open $outfile, '>', 'shorewallrc' or die "Can't open 'shorewallrc' for output: $!";
printf $outfile "#\n# Created by Shorewall Core version %s configure.pl - %s %2d %04d %02d:%02d:%02d\n", VERSION, $abbr[$localtime[4]], $localtime[3], 1900 + $localtime[5] , @localtime[2,1,0];
print $outfile "# rc file: $rcfilename\n#\n";
print $outfile "# Input: @ARGV\n#\n" if @ARGV;
if ( $options{VARLIB} ) {
unless ( $options{VARDIR} ) {
$options{VARDIR} = '${VARLIB}/${PRODUCT}';
}
} elsif ( $options{VARDIR} ) {
$options{VARLIB} = $options{VARDIR};
$options{VARDIR} = '${VARLIB}/${PRODUCT}';
}
$options{SERVICEDIR}=$options{SYSTEMD} unless $options{SERVICEDIR};
for ( qw/ HOST
PREFIX
SHAREDIR
LIBEXECDIR
PERLLIBDIR
CONFDIR
SBINDIR
MANDIR
INITDIR
INITSOURCE
INITFILE
AUXINITSOURCE
AUXINITFILE
SERVICEDIR
SERVICEFILE
SYSCONFFILE
SYSCONFDIR
SPARSE
ANNOTATED
VARLIB
VARDIR / ) {
my $val = $options{$_} || '';
print "$_=$val\n";
print $outfile "$_=$val\n";
}
close $outfile;
1;
shorewall6-lite-5.0.4/shorewallrc.redhat 0000644 0000000 0000000 00000003472 12650243750 016767 0 ustar root root #
# RedHat/FedoraShorewall 5.0 rc file
#
BUILD= #Default is to detect the build system
HOST=redhat
PREFIX=/usr #Top-level directory for shared files, libraries, etc.
SHAREDIR=${PREFIX}/share #Directory for arch-neutral files.
LIBEXECDIR=${PREFIX}/libexec #Directory for executable scripts.
PERLLIBDIR=/usr/share/perl5/vendor_perl #Directory to install Shorewall Perl module directory
CONFDIR=/etc #Directory where subsystem configurations are installed
SBINDIR=/sbin #Directory where system administration programs are installed
MANDIR=${SHAREDIR}/man #Directory where manpages are installed.
INITDIR=/etc/rc.d/init.d #Directory where SysV init scripts are installed.
INITFILE=$PRODUCT #Name of the product's installed SysV init script
INITSOURCE=init.fedora.sh #Name of the distributed file to be installed as the SysV init script
ANNOTATED= #If non-zero, annotated configuration files are installed
SERVICEDIR=/lib/systemd/system #Directory where .service files are installed (systems running systemd only)
SYSCONFFILE=sysconfig #Name of the distributed file to be installed as $SYSCONFDIR/$PRODUCT
SERVICEFILE= #Name of the file to install in $SYSTEMD. Default is $PRODUCT.service
SYSCONFDIR=/etc/sysconfig/ #Directory where SysV init parameter files are installed
SPARSE= #If non-empty, only install $PRODUCT/$PRODUCT.conf in $CONFDIR
VARLIB=/var/lib #Directory where product variable data is stored.
VARDIR=${VARLIB}/$PRODUCT #Directory where product variable data is stored.
shorewall6-lite-5.0.4/init.suse.sh 0000644 0000000 0000000 00000005544 12647470621 015535 0 ustar root root #!/bin/sh
#
# The Shoreline Firewall (Shorewall) Packet Filtering Firewall - V4.5
#
# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
#
# (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2012 - Tom Eastep (teastep@shorewall.net)
#
# On most distributions, this file should be called /etc/init.d/shorewall.
#
# Complete documentation is available at http://shorewall.net
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of Version 2 of the GNU General Public License
# as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
# If an error occurs while starting or restarting the firewall, the
# firewall is automatically stopped.
#
# Commands are:
#
# shorewall6-lite start Starts the firewall
# shorewall6-lite restart Restarts the firewall
# shorewall6-lite reload Reload the firewall
# (same as restart)
# shorewall6-lite stop Stops the firewall
# shorewall6-lite status Displays firewall status
#
### BEGIN INIT INFO
# Provides: shorewall6-lite
# Required-Start: $local_fs $remote_fs $syslog $network
# Required-Stop: $network $remote_fs
# Default-Start: 2 3 5
# Default-Stop: 0 1 6
# Description: starts and stops the shorewall firewall
# Short-Description: Packet filtering firewall
### END INIT INFO
################################################################################
# Give Usage Information #
################################################################################
usage() {
echo "Usage: $0 start|stop|reload|restart|status"
exit 1
}
################################################################################
# Get startup options (override default)
################################################################################
OPTIONS=
#
# The installer may alter this
#
. /usr/share/shorewall/shorewallrc
export SHOREWALL_INIT_SCRIPT=1
################################################################################
# E X E C U T I O N B E G I N S H E R E #
################################################################################
command="$1"
case "$command" in
start)
exec ${SBINDIR}/shorewall6-lite $OPTIONS start $STARTOPTIONS
;;
restart|reload)
exec ${SBINDIR}/shorewall6-lite $OPTIONS restart $RESTARTOPTIONS
;;
status|stop)
exec ${SBINDIR}/shorewall6-lite $OPTIONS $command $@
;;
*)
usage
;;
esac
shorewall6-lite-5.0.4/configpath 0000644 0000000 0000000 00000000270 12647470621 015314 0 ustar root root #
# Shorewall6 Lite version 5 - Default Config Path
#
# /usr/share/shorewall-lite/configpath
#
CONFIG_PATH=${CONFDIR}/shorewall-lite:${SHAREDIR}/shorewall6-lite:${SHAREDIR}/shorewall
shorewall6-lite-5.0.4/shorewall6-lite 0000755 0000000 0000000 00000002652 12647470621 016224 0 ustar root root #!/bin/sh
#
# Shorewall6 Lite Packet Filtering Firewall Control Program - V4.5
#
# (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011, 2012-2014
# Tom Eastep (teastep@shorewall.net)
#
# Shorewall documentation is available at http://www.shorewall.net
#
# This program is part of Shorewall.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by the
# Free Software Foundation, either version 2 of the license or, at your
# option, any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, see
Group: Networking/Utilities
Source: %{name}-%{version}.tgz
URL: http://www.shorewall.net/
BuildArch: noarch
BuildRoot: %{_tmppath}/%{name}-%{version}-root
Requires: iptables iproute shorewall-core
Provides: shoreline_firewall = %{version}-%{release}
%description
The Shoreline Firewall 6, more commonly known as "Shorewall6", is a Netfilter
(ip6tables) based firewall that can be used on a dedicated firewall system,
a multi-function gateway/ router/server or on a standalone GNU/Linux system.
Shorewall6 Lite is a companion product to Shorewall6 that allows network
administrators to centralize the configuration of Shorewall6-based firewalls.
%prep
%setup
%build
%install
./configure.pl --host=%{_vendor} \
--prefix=%{_prefix} \
--tmpdir=%{_tmpdir} \
--perllibdir=%{perl_vendorlib} \
--libexecdir=%{_libexecdir} \
--sbindir=%{_sbindir}
DESTDIR=%{buildroot} ./install.sh
%clean
rm -rf $RPM_BUILD_ROOT
%pre
%post
if [ $1 -eq 1 ]; then
if [ -x %{_sbindir}/insserv ]; then
%{_sbindir}/insserv /etc/rc.d/shorewall6-lite
elif [ -x %{_sbindir}/chkconfig ]; then
%{_sbindir}/chkconfig --add shorewall6-lite;
fi
fi
%preun
if [ $1 -eq 0 ]; then
if [ -x %{_sbindir}/insserv ]; then
%{_sbindir}/insserv -r %{_initddir}/shorewall6-lite
elif [ -x %{_sbindir}/chkconfig ]; then
%{_sbindir}/chkconfig --del shorewall6-lite
fi
fi
%files
%defattr(0644,root,root,0755)
%attr(0755,root,root) %dir /etc/shorewall6-lite
%attr(0644,root,root) /etc/shorewall6-lite/Makefile
%attr(0644,root,root) %config(noreplace) /etc/shorewall6-lite/shorewall6-lite.conf
%attr(0544,root,root) %{_initddir}/shorewall6-lite
%attr(0755,root,root) %dir /usr/share/shorewall6-lite
%attr(0700,root,root) %dir /var/lib/shorewall6-lite
%attr(0755,root,root) %dir /etc/sysconfig/
%attr(0600,root,root) %config(noreplace) /etc/sysconfig/shorewall6-lite
%attr(0644,root,root) /etc/logrotate.d/shorewall6-lite
%attr(0755,root,root) %{_sbindir}/shorewall6-lite
%attr(0644,root,root) /usr/share/shorewall6-lite/version
%attr(0644,root,root) /usr/share/shorewall6-lite/configpath
%attr(- ,root,root) /usr/share/shorewall6-lite/functions
%attr(0644,root,root) /usr/share/shorewall6-lite/lib.base
%attr(0644,root,root) /usr/share/shorewall6-lite/modules*
%attr(0644,root,root) /usr/share/shorewall6-lite/helpers
%attr(0544,root,root) %{_libexecdir}/shorewall6-lite/shorecap
%attr(0644,root,root) %{_mandir}/man5/shorewall6-lite.conf.5.gz
%attr(0644,root,root) %{_mandir}/man5/shorewall6-lite-vardir.5.gz
%attr(0644,root,root) %{_mandir}/man8/shorewall6-lite.8.gz
%doc COPYING changelog.txt releasenotes.txt
%changelog
* Wed Jan 20 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.4-0base
* Tue Jan 19 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.4-0RC2
* Mon Jan 11 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.4-0RC1
* Tue Jan 05 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.4-0Beta2
* Sat Jan 02 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.4-0Beta1
* Sun Dec 27 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.3-0base
* Thu Dec 24 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.3-0RC2
* Sun Dec 13 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.3-0RC1
* Sat Dec 05 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.3-0Beta2
* Sat Nov 28 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.3-0Beta1
* Sat Nov 21 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.2-1
* Sat Nov 07 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.2-0base
* Sun Nov 01 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.2-0RC1
* Mon Oct 26 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.2-0Beta2
* Mon Oct 26 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.2-0Beta1
* Tue Oct 13 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.1-1
* Mon Oct 12 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.1-0base
* Sat Oct 03 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.0-0base
* Mon Sep 21 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.0-0RC1
* Thu Sep 10 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.0-0Beta2
* Mon Jul 27 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.0-0Beta1
* Mon Jul 13 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.12-0Beta2
* Wed Jul 08 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.12-0Beta1
* Fri Jul 03 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.11-0base
* Mon Jun 29 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.11-0RC1
* Fri Jun 26 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.11-0Beta3
* Mon Jun 22 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.11-0Beta2
* Sun May 31 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.11-0Beta1
* Fri May 29 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.10-0base
* Mon May 25 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.10-0RC1
* Sun May 17 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.10-0Beta2
* Tue May 05 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.10-0Beta1
* Tue May 05 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.9-0base
* Tue May 05 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.9-0RC2
* Mon Apr 27 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.9-0RC1
* Fri Apr 17 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.9-0Beta3
* Mon Apr 06 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.9-0Beta2
* Fri Apr 03 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.9-0Beta1
* Sun Mar 29 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.8-0base
* Tue Mar 24 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.8-0RC1
* Tue Mar 17 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.8-0Beta3
* Sat Mar 14 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.8-0Beta2
* Fri Mar 06 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.8-0Beta1
* Thu Mar 05 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.7-0base
* Tue Mar 03 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.7-0RC1
* Sat Jan 17 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.7-0Beta1
* Sat Jan 10 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.6-0base
* Tue Jan 06 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.6-0RC1
* Fri Jan 02 2015 Tom Eastep tom@shorewall.net
- Updated to 4.6.6-0Beta3
* Fri Dec 26 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.6-0Beta2
* Fri Dec 19 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.6-0Beta1
* Mon Dec 15 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.5-3
* Sat Nov 15 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.5-2
* Fri Nov 14 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.5-1
* Thu Nov 06 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.5-0base
* Sat Nov 01 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.5-0RC1
* Thu Oct 30 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.5-0Beta3
* Mon Oct 20 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.5-0Beta2
* Wed Oct 08 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.5-0Beta1
* Mon Oct 06 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.4-0base
* Thu Oct 02 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.4-0RC1
* Sun Sep 28 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.4-0Beta3
* Wed Sep 24 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.4-0Beta2
* Sun Aug 24 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.4-0Beta1
* Thu Aug 21 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.3-1
* Thu Aug 14 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.3-0base
* Sun Aug 10 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.3-0RC1
* Sun Aug 03 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.3-0Beta2
* Fri Jul 25 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.3-0Beta1
* Fri Jul 18 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.2-2
* Fri Jul 18 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.2-1
* Sun Jul 13 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.2-0base
* Fri Jul 04 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.2-0RC1
* Wed Jul 02 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.2-0Beta2
* Wed Jun 18 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.2-0Beta1
* Sun Jun 08 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.1-1
* Wed Jun 04 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.1-0base
* Mon Jun 02 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.0-4
* Fri May 23 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.0-3
* Fri May 16 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.0-2
* Fri May 16 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.0-1
* Sat May 10 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.0-0base
* Wed May 07 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.0-0RC3
* Sun Apr 20 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.0-0RC2
* Sun Mar 23 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.0-0RC1
* Fri Mar 07 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.0-0Beta6
* Sat Feb 15 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.0-0Beta5
* Sat Feb 15 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.0-0Beta6
* Tue Feb 04 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.0-0Beta4
* Thu Jan 16 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.0-0Beta3
* Wed Jan 01 2014 Tom Eastep tom@shorewall.net
- Updated to 4.6.0-0Beta2
* Wed Nov 27 2013 Tom Eastep tom@shorewall.net
- Updated to 4.6.0-0Beta1
* Mon Nov 04 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.21-4
* Fri Oct 25 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.21-3
* Mon Oct 21 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.21-2
* Fri Oct 04 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.21-1
* Fri Sep 27 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.21-0base
* Thu Sep 19 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.21-0RC1
* Thu Sep 12 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.21-0Beta3
* Fri Sep 06 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.21-0Beta2
* Sun Sep 01 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.21-0Beta1
* Sun Aug 18 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.20-0base
* Sun Aug 11 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.20-0RC1
* Tue Aug 06 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.20-0Beta3
* Mon Jul 29 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.20-0Beta2
* Mon Jul 22 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.20-0Beta1
* Sun Jul 21 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.19-0base
* Mon Jul 15 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.19-0RC1
* Thu Jul 11 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.19-0Beta3
* Mon Jul 08 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.19-0Beta2
* Mon Jul 01 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.19-0Beta1
* Thu Jun 27 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.18-0base
* Mon Jun 24 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.18-0RC2
* Mon Jun 17 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.18-0RC1
* Tue Jun 11 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.18-0Beta3
* Tue Jun 04 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.18-0Beta2
* Thu May 30 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.18-0Beta1
* Mon May 27 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.17-0base
* Sun May 26 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.17-0RC2
* Wed May 22 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.17-0RC1
* Sun May 12 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.17-0Beta3
* Sat May 11 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.17-0Beta2
* Tue May 07 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.17-0Beta1
* Wed May 01 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.16-2
* Wed May 01 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.16-1
* Tue Apr 30 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.16-0base
* Fri Apr 26 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.16-0RC2
* Sat Apr 20 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.16-0RC1
* Sat Apr 20 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.16-0Beta6
* Wed Apr 17 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.16-0Beta5
* Mon Apr 15 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.16-0Beta4
* Thu Apr 11 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.16-0Beta3
* Fri Apr 05 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.16-0Beta2
* Fri Mar 29 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.16-0Beta1
* Thu Mar 28 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.15-0base
* Sun Mar 24 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.15-0RC1
* Fri Mar 22 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.15-0Beta3
* Sun Mar 17 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.15-0Beta2
* Tue Mar 05 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.15-0Beta1
* Sat Mar 02 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.14-0base
* Sat Feb 23 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.14-0RC1
* Sun Feb 17 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.14-0Beta3
* Wed Feb 13 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.14-0Beta2
* Tue Feb 12 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.14-0Beta1
* Fri Feb 08 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.13-0base
* Mon Feb 04 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.13-0RC3
* Sun Feb 03 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.13-0RC2
* Thu Jan 31 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.13-0RC1
* Tue Jan 29 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.13-0Beta4
* Mon Jan 21 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.13-0Beta3
* Sun Jan 20 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.13-0Beta2
* Tue Jan 15 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.13-0Beta1
* Tue Jan 15 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.12-0base
* Thu Jan 10 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.12-0RC1
* Tue Jan 08 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.12-0Beta5
* Sat Jan 05 2013 Tom Eastep tom@shorewall.net
- Updated to 4.5.12-0Beta4
* Mon Dec 31 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.12-0Beta3
* Thu Dec 27 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.12-0Beta2
* Wed Dec 26 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.12-0Beta1
* Wed Dec 19 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.11-0RC1
* Thu Dec 13 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.11-0Beta3
* Sun Dec 09 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.11-0Beta2
* Mon Dec 03 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.11-0Beta1
* Sun Dec 02 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.10-0base
* Wed Nov 28 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.10-0RC1
* Sat Nov 24 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.10-0Beta3
* Tue Nov 20 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.10-0Beta2
* Fri Nov 16 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.10-0Beta1
* Sun Nov 11 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.9-2
* Sat Nov 03 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.9-1
* Fri Oct 26 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.9-0base
* Sun Oct 21 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.9-0RC1
* Tue Oct 16 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.9-0Beta3
* Thu Oct 04 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.9-0Beta2
* Thu Sep 20 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.9-0Beta1
* Wed Sep 19 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.8-0base
* Thu Sep 13 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.8-0RC2
* Mon Sep 10 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.8-0RC1
* Tue Sep 04 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.8-0Beta3
* Mon Sep 03 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.8-0Beta2
* Thu Aug 09 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.8-0Beta1
* Tue Aug 07 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.7-0RC1
* Mon Aug 06 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.7-0Beta5
* Sun Aug 05 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.7-0Beta4
* Sat Aug 04 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.7-0Beta3
* Tue Jul 17 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.7-0Beta2
* Sun Jul 08 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.7-0Beta1
* Thu Jul 05 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.6-0base
* Sat Jun 30 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.6-0RC1
* Wed Jun 27 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.6-0Beta4
* Mon Jun 18 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.6-0Beta3
* Fri Jun 15 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.6-0Beta2
* Sat Jun 09 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.6-0Beta1
* Wed Jun 06 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.5-0base
* Tue Jun 05 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.5-0RC1
* Sat Jun 02 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.5-0Beta2
* Thu May 24 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.5-0Beta1
* Thu May 24 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.4-0base
* Tue May 22 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.4-0RC2
* Fri May 18 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.4-0RC1
* Thu May 17 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.4-0Beta3
* Tue May 15 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.4-0Beta2
* Sun May 13 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.4-0Beta2
* Thu May 10 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.4-0Beta1
* Sun May 06 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.3-0base
* Thu May 03 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.3-0RC1
* Fri Apr 27 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.3-0Beta2
* Tue Apr 10 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.2-1
* Sat Apr 07 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.2-0base
* Wed Apr 04 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.2-0RC2
* Sun Apr 01 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.2-0RC1
* Thu Mar 29 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.2-0Beta5
* Mon Mar 26 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.2-0Beta4
* Tue Mar 20 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.2-0Beta3
* Sat Mar 17 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.2-0Beta2
* Wed Mar 14 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.2-0Beta1
* Sat Mar 10 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.1-0base
* Sat Mar 03 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.1-0RC1
* Thu Feb 23 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.1-0Beta3
* Sun Feb 19 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.1-0Beta2
* Fri Feb 03 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.1-0Beta1
* Wed Jan 18 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.0-0RC1
* Sun Jan 15 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.0-0Beta4
* Thu Jan 05 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.0-0Beta3
* Mon Jan 02 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.0-0Beta2
* Sun Jan 01 2012 Tom Eastep tom@shorewall.net
- Updated to 4.5.0-0Beta1
* Sun Dec 25 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.27-0base
* Fri Dec 23 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.27-0RC2
* Sat Dec 17 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.27-0RC1
* Sun Dec 11 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.27-0Beta3
* Mon Dec 05 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.27-0Beta2
* Sat Dec 03 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.27-0Beta1
* Sat Dec 03 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.26-1
* Tue Nov 29 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.26-0base
* Sun Nov 20 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.26-0RC1
* Sat Nov 19 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.26-0Beta4
* Thu Nov 17 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.26-0Beta3
* Sat Nov 12 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.26-0Beta2
* Wed Nov 02 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.26-0Beta1
* Sun Oct 30 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.25-1
* Thu Oct 27 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.25-0base
* Sun Oct 23 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.25-0RC1
* Sat Oct 22 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.25-0Beta4
* Tue Oct 18 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.25-0Beta3
* Tue Oct 11 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.25-0Beta2
* Tue Oct 04 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.25-0Beta1
* Sat Oct 01 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.24-0RC1
* Mon Sep 26 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.24-0Beta4
* Wed Sep 21 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.24-0Beta3
* Sun Sep 18 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.24-0Beta2
* Thu Sep 15 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.24-0Beta1
* Tue Sep 13 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.23-3
* Fri Sep 09 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.23-2
* Wed Sep 07 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.23-1
* Sat Sep 03 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.23-0base
* Fri Sep 02 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.23-0RC2
* Mon Aug 29 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.23-0RC1
* Sat Aug 27 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.23-0Beta4
* Sun Aug 21 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.23-0Beta3
* Wed Aug 17 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.23-0Beta2
* Fri Aug 05 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.23-0Beta1
* Wed Aug 03 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.22-2
* Tue Aug 02 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.22-1
* Sat Jul 30 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.22-0base
* Sat Jul 30 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.22-0RC2
* Fri Jul 22 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.22-0RC1
* Thu Jul 21 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.22-0Beta3
* Mon Jul 18 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.22-0Beta2
* Mon Jul 04 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.22-0Beta1
* Wed Jun 29 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.21-0base
* Thu Jun 23 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.21-0RC1
* Sun Jun 19 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.21-0Beta3
* Sat Jun 18 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.21-0Beta2
* Tue Jun 07 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.21-0Beta1
* Mon Jun 06 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.20-1
* Tue May 31 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.20-0base
* Fri May 27 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.20-0RC1
* Tue May 24 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.20-0Beta5
* Sun May 22 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.20-0Beta4
* Thu May 19 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.20-0Beta3
* Wed May 18 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.20-0Beta2
* Sat Apr 16 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.20-0Beta1
* Wed Apr 13 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.19-1
* Sat Apr 09 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.19-0base
* Sun Apr 03 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.19-0RC1
* Sun Apr 03 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.19-0Beta5
* Sat Apr 02 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.19-0Beta4
* Sat Mar 26 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.19-0Beta3
* Sat Mar 05 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.19-0Beta1
* Wed Mar 02 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.18-0base
* Mon Feb 28 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.18-0RC1
* Sun Feb 20 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.18-0Beta4
* Sat Feb 19 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.18-0Beta3
* Sun Feb 13 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.18-0Beta2
* Sat Feb 05 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.18-0Beta1
* Fri Feb 04 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.17-0base
* Sun Jan 30 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.17-0RC1
* Fri Jan 28 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.17-0Beta3
* Wed Jan 19 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.17-0Beta2
* Sat Jan 08 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.17-0Beta1
* Mon Jan 03 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.16-0base
* Thu Dec 30 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.16-0RC1
* Thu Dec 30 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.16-0Beta8
* Sun Dec 26 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.16-0Beta7
* Mon Dec 20 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.16-0Beta6
* Fri Dec 10 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.16-0Beta5
* Sat Dec 04 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.16-0Beta4
* Fri Dec 03 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.16-0Beta3
* Fri Dec 03 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.16-0Beta2
* Tue Nov 30 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.16-0Beta1
* Fri Nov 26 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.15-0base
* Mon Nov 22 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.15-0RC1
* Mon Nov 15 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.15-0Beta2
* Sat Oct 30 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.15-0Beta1
* Sat Oct 23 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.14-0base
* Wed Oct 06 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.14-0RC1
* Fri Oct 01 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.14-0Beta4
* Sun Sep 26 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.14-0Beta3
* Thu Sep 23 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.14-0Beta2
* Tue Sep 21 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.14-0Beta1
* Fri Sep 17 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.13-0RC1
* Fri Sep 17 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.13-0Beta6
* Mon Sep 13 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.13-0Beta5
* Sat Sep 04 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.13-0Beta4
* Mon Aug 30 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.13-0Beta3
* Wed Aug 25 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.13-0Beta2
* Wed Aug 18 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.13-0Beta1
* Sun Aug 15 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.12-0base
* Fri Aug 06 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.12-0RC1
* Sun Aug 01 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.12-0Beta4
* Sat Jul 31 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.12-0Beta3
* Sun Jul 25 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.12-0Beta2
* Wed Jul 21 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.12-0Beta1
* Fri Jul 09 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.11-0base
* Mon Jul 05 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.11-0RC1
* Sat Jul 03 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.11-0Beta3
* Thu Jul 01 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.11-0Beta2
* Sun Jun 06 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.11-0Beta1
* Sat Jun 05 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.10-0base
* Fri Jun 04 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.10-0RC2
* Thu May 27 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.10-0RC1
* Wed May 26 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.10-0Beta4
* Tue May 25 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.10-0Beta3
* Thu May 20 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.10-0Beta2
* Thu May 20 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.10-0Beta2
* Thu May 13 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.10-0Beta1
* Mon May 03 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.9-0base
* Sun May 02 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.9-0RC2
* Sun Apr 25 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.9-0RC1
* Sat Apr 24 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.9-0Beta5
* Fri Apr 16 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.9-0Beta4
* Fri Apr 09 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.9-0Beta3
* Thu Apr 08 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.9-0Beta2
* Sat Mar 20 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.9-0Beta1
* Fri Mar 19 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.8-0base
* Tue Mar 16 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.8-0RC2
* Mon Mar 08 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.8-0RC1
* Sun Feb 28 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.8-0Beta2
* Thu Feb 11 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.8-0Beta1
* Fri Feb 05 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.7-0base
* Tue Feb 02 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.7-0RC2
* Wed Jan 27 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.7-0RC1
* Mon Jan 25 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.7-0Beta4
* Fri Jan 22 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.7-0Beta3
* Fri Jan 22 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.7-0Beta2
* Sun Jan 17 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.7-0Beta1
* Wed Jan 13 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.6-0base
* Tue Jan 12 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.6-0Beta1
* Thu Dec 24 2009 Tom Eastep tom@shorewall.net
- Updated to 4.4.5-0base
* Sat Nov 21 2009 Tom Eastep tom@shorewall.net
- Updated to 4.4.4-0base
* Fri Nov 13 2009 Tom Eastep tom@shorewall.net
- Updated to 4.4.4-0Beta2
* Wed Nov 11 2009 Tom Eastep tom@shorewall.net
- Updated to 4.4.4-0Beta1
* Tue Nov 03 2009 Tom Eastep tom@shorewall.net
- Updated to 4.4.3-0base
* Sun Sep 06 2009 Tom Eastep tom@shorewall.net
- Updated to 4.4.2-0base
* Fri Sep 04 2009 Tom Eastep tom@shorewall.net
- Updated to 4.4.2-0base
* Fri Aug 14 2009 Tom Eastep tom@shorewall.net
- Updated to 4.4.1-0base
* Mon Aug 03 2009 Tom Eastep tom@shorewall.net
- Updated to 4.4.0-0base
* Tue Jul 28 2009 Tom Eastep tom@shorewall.net
- Updated to 4.4.0-0RC2
* Sun Jul 12 2009 Tom Eastep tom@shorewall.net
- Updated to 4.4.0-0RC1
* Thu Jul 09 2009 Tom Eastep tom@shorewall.net
- Updated to 4.4.0-0Beta4
* Sat Jun 27 2009 Tom Eastep tom@shorewall.net
- Updated to 4.4.0-0Beta3
* Mon Jun 15 2009 Tom Eastep tom@shorewall.net
- Updated to 4.4.0-0Beta2
* Fri Jun 12 2009 Tom Eastep tom@shorewall.net
- Updated to 4.4.0-0Beta1
* Sun Jun 07 2009 Tom Eastep tom@shorewall.net
- Updated to 4.3.13-0base
* Fri Jun 05 2009 Tom Eastep tom@shorewall.net
- Updated to 4.3.12-0base
* Sun May 10 2009 Tom Eastep tom@shorewall.net
- Updated to 4.3.11-0base
* Sun Apr 19 2009 Tom Eastep tom@shorewall.net
- Updated to 4.3.10-0base
* Sat Apr 11 2009 Tom Eastep tom@shorewall.net
- Updated to 4.3.9-0base
* Tue Mar 17 2009 Tom Eastep tom@shorewall.net
- Updated to 4.3.8-0base
* Sun Mar 01 2009 Tom Eastep tom@shorewall.net
- Updated to 4.3.7-0base
* Fri Feb 27 2009 Tom Eastep tom@shorewall.net
- Updated to 4.3.6-0base
* Sun Feb 22 2009 Tom Eastep tom@shorewall.net
- Updated to 4.3.5-0base
* Wed Feb 04 2009 Tom Eastep tom@shorewall.net
- Updated to 4.2.6-0base
* Thu Jan 29 2009 Tom Eastep tom@shorewall.net
- Updated to 4.2.6-0base
* Tue Jan 06 2009 Tom Eastep tom@shorewall.net
- Updated to 4.2.5-0base
* Thu Dec 25 2008 Tom Eastep tom@shorewall.net
- Updated to 4.2.4-0base
* Sun Dec 21 2008 Tom Eastep tom@shorewall.net
- Updated to 4.2.4-0RC2
* Wed Dec 17 2008 Tom Eastep tom@shorewall.net
- Updated to 4.2.4-0RC1
* Tue Dec 16 2008 Tom Eastep tom@shorewall.net
- Updated to 4.3.4-0base
* Sat Dec 13 2008 Tom Eastep tom@shorewall.net
- Updated to 4.3.3-0base
* Fri Dec 12 2008 Tom Eastep tom@shorewall.net
- Updated to 4.3.2-0base
* Thu Dec 11 2008 Tom Eastep tom@shorewall.net
- Updated to 4.3.1-0base
* Wed Dec 10 2008 Tom Eastep tom@shorewall.net
- Updated to 4.3.0-0base
* Wed Dec 10 2008 Tom Eastep tom@shorewall.net
- Updated to 2.3.0-0base
* Tue Dec 09 2008 Tom Eastep tom@shorewall.net
- Initial Version
shorewall6-lite-5.0.4/releasenotes.txt 0000644 0000000 0000000 00000056432 12650243750 016507 0 ustar root root ----------------------------------------------------------------------------
S H O R E W A L L 5 . 0 . 4
----------------------------
J a n u a r y 2 2 , 2 0 1 6
----------------------------------------------------------------------------
I. PROBLEMS CORRECTED IN THIS RELEASE
II. KNOWN PROBLEMS REMAINING
III. NEW FEATURES IN THIS RELEASE
IV. MIGRATION ISSUES
V. PROBLEMS CORRECTED AND NEW FEATURES IN PRIOR RELEASES
----------------------------------------------------------------------------
I. P R O B L E M S C O R R E C T E D I N T H I S R E L E A S E
----------------------------------------------------------------------------
1) There previously existed a slight possibility that starting both
Shorewall and Shorewall6 simultaneously could lead to a failure
such as this one:
Dec 18 13:18:35 elmo.example.com shorewall6[1889]: Loading Modules...
Dec 18 13:18:38 elmo.example.com shorewall6[1889]: Another app is
currently holding the xtables lock. Perhaps you want to use
the -w option?
Dec 18 13:18:40 elmo.example.com shorewall6[1889]:
ERROR: Cannot Create Mangle chain fooX2349
Dec 18 13:18:40 elmo.example.com systemd[1]: shorewall6.service:
main process exited, code=exited, status=255/n/a
That problem can no longer occur.
2) Previously, when a source- or destination-specific RATE was
specified on a logging rule (LOG, ULOG or NFLOG), the compiler
incorrectly applied both the specified RATE as well as the global
LOGLIMIT. That has been corrected so that only the specified RATE
is applied.
3) Previously, when @caller was used within an action body, the
compiler would not create unique ip[6]tables chains for each
invocation of the action, even though the invocations had different
values of @caller. Now, each invocation of such an action creates a
separate ip[6]tables chain for each unique caller.
4) Previously, the 'status -i' command produced error output when
there were no optional interfaces. That erroneous output is no
longer produced.
5) Traffic shaping configurations that use red or codel will now
produce consistent compiled scripts. Previously, these
configurations could produce equivalent but different scripts on
consecutive compilations.
6) Previously, the Shoreall compiler enforced old rules about where
country codes could appear. As those restrictions have now been
removed, the compiler no longer issues messages such as these:
ERROR: A countrycode list may not be used in this context
----------------------------------------------------------------------------
I I. K N O W N P R O B L E M S R E M A I N I N G
----------------------------------------------------------------------------
1) On systems running Upstart, shorewall-init cannot reliably secure
the firewall before interfaces are brought up.
----------------------------------------------------------------------------
I I I. N E W F E A T U R E S I N T H I S R E L E A S E
----------------------------------------------------------------------------
1) Shorewall Init is now supported on OpenWRT.
2) The IPTABLES and IP6TABLES actions in the rules and mangle files
can now correctly handle logging targets (LOG, ULOG and
NFLOG). Previously, an attempt to use these targets would result in
an error similar to:
ERROR: LOG requires a level
3) To further reduce the possibility of failures caused by Shorewall
and Shorewall6 starting concurrently, a new WAIT_OPTION capability
has been implemented. On systems with that capability, all
'iptables' and 'ip6tables' commands will use the --wait option.
4) The .214.service files have been removed and the .service files
(with the exception of Debian) have been updated to use the
network-pre.target (Tuomo Soini).
5) Shorewall, Shorewall6, Shorewall-lite and Shorewall6-lite now
install /etc/sysconfig/ files for specifying
start/restart/reload options on those distributions that use
/etc/sysconfig.
6) The mangle file now supports an DIVERTHA action that provides
support for HAProxy.
To setup the HAProxy configuration described at
http://www.loadbalancer.org/blog/setting-up-haproxy-with-transparent-mode-on-centos-6-x,
place this entry in shorewall-providers(5):
#NAME NUMBER MARK DUPLICATE INTERFACE GATEWAY OPTIONS
TProxy 1 - - lo - tproxy
and use this DIVERTHA entry:
#ACTION SOURCE DEST PROTO ...
DIVERTHA - - tcp
----------------------------------------------------------------------------
I V. M I G R A T I O N I S S U E S
----------------------------------------------------------------------------
1) If you are migrating from Shorewall 4.4.x or earlier, please see
http://www.shorewall.net/pub/shorewall/4.5/shorewall-4.5.21/releasenotes.txt
2) It is strongly recommended that you first upgrade your installation
to a 4.6 release >= 4.6.12 prior to upgrading to Shorewall 5.0.
Once you are on the Shorewall 4.6 release:
- shorewall update -A
If you also run Shorewall6:
- shorewall6 update -A
These steps are necessary because Shorewall 5.0:
- Does not contain support for the 'tcrules' and 'tos' files --
existing 'tcrules' and 'tos' files must be converted to an
equivalent set of 'mangle' file entries.
- Does not contain support for the 'blacklist' file -- it must
be converted to an equivalent 'blrules' file.
- Does not contain support for the 'notrack' file -- it must be
converted to an equivalent 'conntrack' file.
- Does not contain support for the 'routestopped' file -- it must
be converted to an equivalent 'stoppedrules' file.
Note that you can run the update command(s) after you upgrade to
Shorewall 5 but your firewall will not work correctly until
you do those update(s).
3) The following configuration options have been eliminated:
- EXPORTPARAMS
- IPSECFILE
- LEGACY_FASTSTART
- LOGRATE *
- LOGBURST *
- WIDE_TC_MARKS *
- HIGH_ROUTE_MARKS *
- BLACKLISTNEWONLY *
A fatal error results if those flagged with an asterisk ("*")
appear in the .conf file -- run the 'shorewall[6] update' command
to convert their settings to use supported options.
A warning is issued if any of the rest appear in the .conf file.
'shorewall[6] update' will drop them from the file.
4) To make the command names more accurately reflect what they do,
several changes have been included:
a) Beginning with this release, the 'restart' command now does a
true restart and is equivalent to a 'stop' followed by a
'start'.
b) The pre-5.0.0 'load' command has been renamed 'remote_start'.
c) The pre-5.0.0 'reload' command has been renamed 'remote_reload'.
c) The 'reload' command now performs the same function as the
pre-5.0.0 'restart' command.
d) A 'remote_restart' command has been added to Shorewall and
Shorewall6 to allow a remote 'restart' after updating the
remote firewall system's compiled script.
For those that can't get used to the idea of using 'reload' in
place of 'restart', a RESTART option has been added. The
option defaults to 'reload' for compatibility with earlier
releases. If set to 'restart', then the 'restart' command
does a true restart (stop followed by start)
5) While the WORKAROUNDS setting is still present in the
shorewall[6].conf file:
a) It's default setting has been changed to No.
b) All workarounds for old distributions have been eliminated. See
the Migration Issues for additional information.
6) Beginning with Shorewall 5.0.0, all macros and actions are assumed
to be FORMAT-2. FORMAT-1 macros and actions are no longer supported
and will be silently processed as if they were FORMAT-2. For most
macros and actions, this change will be of no concern, but may cause
compilation errors in rare cases.
To review, FORMAT-1 actions have the following columns:
TARGET
SOURCE
DEST
PROTO
DEST PORT(S)
SOURCE PORT(S)
RATE
USER/GROUP
MARK
FORMAT-1 macros have these columns:
TARGET
SOURCE
DEST
PROTO
DEST PORT(S)
SOURCE PORT(S)
RATE
USER/GROUP
FORMAT-2 actions and macros, on the other hand, have:
TARGET
SOURCE
DEST
PROTO
DEST PORT(S)
SOURCE PORT(S)
ORIGINAL DEST
RATE
USER/GROUP
MARK
CONNLIMIT
TIME
HEADERS (Only valid for IPv6)
SWITCH
HELPER
To summarize, if your action or macro only uses the first 6
columns (which most do), then it will process fine as
FORMAT-2. Otherwise, it must be modified to place specifications in
the proper columns.
7) COMMENT, FORMAT and SECTION lines must now begin with a question
mark ("?"). The 'update' command will change all bare COMMENT,
FORMAT and SECTION lines to include the question mark.
----------------------------------------------------------------------------
V. N O T E S F R O M O T H E R 5 . 0 R E L E A S E S
----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 5 . 0 . 3
----------------------------------------------------------------------------
1) This release includes defect repair through Shorewall 5.0.2.1.
2) To avoid interference with other subsystem settings, all released
shorewall6.conf files now specify IP_FORWARDING=keep. Previously,
the settings were inconsistent among the various sample files.
3) This release includes more fixes to the configure, install and
uninstall scripts (Matt Darfeuille).
4) Previously, Shorewall6 rejected rules in which the SOURCE contained
both an interface name and a MAC address (in Shorewall
format). That defect has been corrected so that such rules are now
accepted.
----------------------------------------------------------------------------
N E W F E A T U R E S I N 5 . 0 . 2
----------------------------------------------------------------------------
1) The MODULESDIR option in shorewall[6].conf has been extended to
allow specification of additional directories to be added to those
defaulted by Shorewall. If the specified value begins with "+",
then the remainder of the value is assumed to be a colon-separated
list of directory names that are relative to /lib/modules/`uname
-r`.
For example, to load the xt_RTPENGINE module, you would create
/etc/shorewall/modules as follows:
INCLUDE /usr/share/shorewall/modules
loadmodule xt_RTPENGINE
You would then set MODULESDIR as:
MODULESDIR="+extra/rtpengine"
2) Previously, some of the column headings in the configuration files
required two lines to display. For example, in the rules file:
#ACTION SOURCE DESTINATION PROTOCOL DEST SOURCE
# PORT(S) PORT(S)
To use the alternative input format for such two-word columns, a
one-word abbreviation was required. For example, DEST PORTS(S) is
abbreviated as 'dport' and SOURCE PORT(S) is abbreviated as
'sport'.
The two-line column headings are also a nuisance for Emacs users
because when the key is struck, Emacs positions the cursor
based on the white space in the preceding line. So if an ACTION is
typed and the key is then depressed, rather than position the
cursor in the SOURCE column, Emacs positions it in the DEST PORT(S)
column.
To eliminate these issues, the multi-word columns have been
relabled to use their abbreviated names. Note that this relabelling
does not require modification of existing configurations. It simply
means that the sample files released with Shorewall and the
manpages that describe column-oriented files now use the
abbreviated names rather than the previous names (Tuomo Soini and
Tom Eastep).
3) ADD rules may now include a timeout value which will override
any timeout that was specified when the related ipset was created.
4) Commas are now allowed in log tags when LOGTAGONLY=Yes. Previously,
characters after the first comma in a log tag were discarded when
LOGTAGONLY=Yes.
----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 5 . 0 . 2
----------------------------------------------------------------------------
5.0.2.1
1) When processing the 'dump' command, the CLI now uses 'netstat' to
print socket information when the 'ss' utility is not installed.
2) Several defects in the installers/uninstallers have been corrected
(Matt Darfeuille).
5.0.2
1) This release includes defect repair up through Shoreall 5.0.1.1.
2) The MSSQL macro now allows UDP port 1434 (Tuomo Soini).
3) A number of issues with param file processing on Cygwin have been
corrected. The most serious of these issues was introduction of
syntax errors into the generated firewall script.
4) More version numbers have been removed from configuration files
and Macros (Tuomo Soini).
5) The check for use of a circular kernel log buffer (as opposed to a
log file) has been improved.
6) Previously, HOST=default was accepted by configure[.pl], but the
generated shorewallrc file was unusable. Now, HOST=default is
equivalent to HOST=linux.
7) Previously, if a circular log buffer was being used, the output of
various commands still displayed '/var/log/messages' as the log
file. Now, it is displayed as 'logread'.
8) The 'remote-*' commands now return correct exit status.
9) Previously, if LOCKFILE specified a file in a directory other than
$VARDIR, and that directory did not exist, it was not created
automatically.
10) Previously, optional interfaces were not enabled during 'start' and
'restart' unless there was at least one entry in the 'providers'
file. This resulted in these interfaces not appearing in the
output of 'shorewall[6] status -i'.
----------------------------------------------------------------------------
N E W F E A T U R E S I N 5 . 0 . 2
----------------------------------------------------------------------------
1) The providers file now supports a 'persistent' option. When
specified, this option removes the need to configure host routes to
systems used as the 'checkip' in LSM.
As part of this change, two other configuration files have changed:
a) The 'rtrules' file now allows the rule priority to be followed
by an exclaimation mark ("!").
b) An OPTION column has been added to the 'routes' file. The only
option currently supported is 'persistent'.
The option affects the routing configuration when the provider is
disabled:
- The provider's routing table still exists and contains the
provider's default route.
- Unless 'noautosrc' is specified, connections originating from the
interfaces IP address(es) are routed via the provider's default
gateway.
- Routing rules for the provider that specify '!' after the
priority are left in place.
- 'persistent' routes for the provider are left in place, allowing
communication with local networks that are still accessible.
2) It is now possible to replace any function in the CLI libraries
except for get_config(). This is accomplished by placing the
replacement function(s) in a shell library named 'lib.cli-user' in
a directory on the CONFIG_PATH. This allows for customization of
commands as well as working around distribution-specific issues.
3) Support for OpenWRT versions BB and later has been added. Included
in this support are:
- The log display commands (show log, logwatch, etc.) no longer
depend on the 'tac' utility (although it will be used if it is
installed).
- Shorewall-core's 'configure' script detects OpenWRT and accepts
HOST=openwrt as an argument.
- Shorewall-core, Shorewall-lite and Shoreawll6-lite installers
support openwrt. Additionally, those installers no longer depend
on the 'install' utility.
- Shorewall[6]-lite will use OpenWRT's 'lock' utility to create the
LOCKFILE.
A special thanks to Matt Darfeuille for his help in making this
support possible.
4) Configuration files and extension scripts now have uniform
introductory comments (Tuomo Soini).
----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 5 . 0 . 1
----------------------------------------------------------------------------
1) Previously, if statistical load balancing was used in the providers
file, the default route in the main table was not deleted during
firewall start/restart. That route is now correctly deleted.
2) Certain files in /etc/shorewall[6] previously had permissions 644.
Those have been changed to 600 to match the other files in the
directories.
3) Previously, the CLI programs did not deal properly with the absense
of the 'hostname' utility. Now, if that utility is not present, the
programs look for 'uname' and if it is present, they use the 'uname
-n' command. If neither 'hostname' nor 'uname' are installed, the
programs display 'localhost' as the system name.
----------------------------------------------------------------------------
N E W F E A T U R E S I N 5 . 0 . 1
----------------------------------------------------------------------------
1) 'second' and 'minute' are now allowed in the LOGLIMIT
specification in place of 'sec' and 'min' respectively. This
enhancement was present in Shorewall 4.6.13 but was not available
in Shoreall 5.0.0.
2) The LEGACY_RESTART option has been superseded by the RESTART
option. RESTART may be set as follows:
RESTART=reload
Causes the 'restart' command to perform the same action as the
'reload' command. This is the default if RESTART is not set.
RESTART=restart
Causes the 'restart' command to perform a true restart (stop
followed by start).
If LEGACY_RESTART is present in shorewall[6].conf and RESTART is
not, then its setting will govern the behavior of 'restart'. The
'update' command will convert the LEGACY_RESTART setting to the
equivalent RESTART setting.
----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 5 . 0 . 0
----------------------------------------------------------------------------
1) This release includes defect repair up through Shorewall 4.6.13.1.
2) The compiled script now uses the %e date format rather than %_d,
for Busybox compatibilty. (Erich Titl)
----------------------------------------------------------------------------
N E W F E A T U R E S I N 5 . 0 . 0
----------------------------------------------------------------------------
1) To make the command names more accurately reflect what they do,
several changes have been included:
a) Beginning with this release, the 'restart' command now does a
true restart and is equivalent to a 'stop' followed by a
'start'.
b) The pre-5.0.0 'load' command has been renamed 'remote_start'.
c) The pre-5.0.0 'reload' command has been renamed 'remote_reload'.
c) The 'reload' command now performs the same function as the
pre-5.0.0 'restart' command.
d) A 'remote_restart' command has been added to Shorewall and
Shorewall6 to allow a remote 'restart' after updating the
remote firewall system's compiled script.
2) For those that can't get used to the idea of using 'reload' in
place of 'restart', a LEGACY_RESTART option has been added. The
option defaults to No but if set to Yes, then the 'restart' command
does what it has always done.
3) It is now possible to limit connections by destination address in
the rules file by prefixing the CONNLIMIT setting with 'd:'.
4) While the WORKAROUNDS setting is still present in the
shorewall[6].conf files:
a) Its default setting has been changed to No.
b) All workarounds for old distributions have been eliminated. See
the Migration Issues for additional information.
5) A number of configuration options have been eliminated:
- EXPORTPARAMS
- IPSECFILE
- LEGACY_FASTSTART
- LOGRATE *
- LOGBURST *
- WIDE_TC_MARKS *
- HIGH_ROUTE_MARKS *
- BLACKLISTNEWONLY *
A fatal error results if those flagged with an asterisk ("*")
appear in the .conf file -- run the 'shorewall[6] update' command
to convert their settings to use supported options.
A warning is issued if any of the rest appear in the .conf file.
'shorewall[6] update' will drop them from the file.
7) The -b, -D, -r, -s, -t and -n options have been removed from the
'update' command. The command now behaves as if all of those
options had been specified.
6) Support has been removed for the 'blacklist', 'tcrules',
'routestopped', 'notrack' and 'tos' files.
The 'update' command will:
- convert the 'tcrules' and 'tos' files to the equivalent 'mangle'
file.
- convert the 'blacklist' file into an equivalent 'blrules' file.
- convert the routestopped' file into the equivalent 'stoppedrules'
file.
- convert a 'notrack' file to the equivalent 'conntrack' file.
7) Beginning with this release, all macros and actions are assumed
to be FORMAT-2. FORMAT-1 macros and actions are no longer supported
and will be silently processed as if they were FORMAT-2. For most
macros and actions, this change will be of no concern, but may cause
compilation errors in rare cases.
8) Beginning with this release, COMMENT, FORMAT and SECTION lines must
begin with a question mark ("?"). The 'update' command makes these
changes for you.
9) As an alternative to INLINE_MATCHES=Yes, you may now specify inline
matches (raw ip[6]tables text) after a double semicolon (';;').
Example from the 'masq' file to split SNAT between two public
addresses on eth1:
#INTERFACE SOURCE ADDRESS
eth1 - 1.2.3.1 ;; -m statistic --mode random --probability 0.50
eth1 - 1.2.3.2
10) Options in shorewall[6].conf that accept a log level now also allow
specification of a log tag.
Example:
TCP_FLAGS_LOG_LEVEL=info:,tcpflags
11) A PROBABILITY column has been added to the masq file. One usage
scenario is to balance SNAT between two or more IP addresses on a
WAN interface:
#INTERFACE SOURCE ADDRESS
eth1 - 1.2.3.4 { probability=0.50 }
eth2 - 1.2.3.5
12) Previously, when chain names were included in a 'reset' command,
they were assumed to be filter table chains. Now, both a table name
and a chain name can be given (e.g., mangle:PREROUTING). The
specified table remains the default for the remainder of the
command unless a following entry also includes a table name.
13) An action for Gluster FS (action.GlusterFS) has been added. See the
action file for a description of the parameters.
shorewall6-lite-5.0.4/shorewallrc.debian.systemd 0000644 0000000 0000000 00000002746 12650243750 020434 0 ustar root root #
# Debian Shorewall 4.5 rc file
#
BUILD= #Default is to detect the build system
HOST=debian
PREFIX=/usr #Top-level directory for shared files, libraries, etc.
SHAREDIR=${PREFIX}/share #Directory for arch-neutral files.
LIBEXECDIR=${PREFIX}/share #Directory for executable scripts.
PERLLIBDIR=${PREFIX}/share/shorewall #Directory to install Shorewall Perl module directory
CONFDIR=/etc #Directory where subsystem configurations are installed
SBINDIR=/sbin #Directory where system administration programs are installed
MANDIR=${PREFIX}/share/man #Directory where manpages are installed.
INITDIR= #Directory where SysV init scripts are installed.
INITFILE= #Name of the product's installed SysV init script
INITSOURCE=init.debian.sh #Name of the distributed file to be installed as the SysV init script
ANNOTATED= #If non-zero, annotated configuration files are installed
SYSCONFFILE=default.debian #Name of the distributed file to be installed in $SYSCONFDIR
SERVICEFILE=$PRODUCT.service.debian #Name of the file to install in $SYSTEMD. Default is $PRODUCT.service
SYSCONFDIR=/etc/default #Directory where SysV init parameter files are installed
SERVICEDIR=/lib/systemd/system #Directory where .service files are installed (systems running systemd only)
SPARSE=Yes #If non-empty, only install $PRODUCT/$PRODUCT.conf in $CONFDIR
VARLIB=/var/lib #Directory where product variable data is stored.
VARDIR=${VARLIB}/$PRODUCT #Directory where product variable data is stored.
shorewall6-lite-5.0.4/install.sh 0000755 0000000 0000000 00000036041 12650243750 015254 0 ustar root root #!/bin/sh
#
# Script to install Shoreline Firewall Lite
#
# (c) 2000-2011,2014 - Tom Eastep (teastep@shorewall.net)
#
# Shorewall documentation is available at http://shorewall.net
#
# This program is part of Shorewall.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by the
# Free Software Foundation, either version 2 of the license or, at your
# option, any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, see ]"
echo " $ME -v"
echo " $ME -h"
echo " $ME -n"
exit $1
}
fatal_error()
{
echo " ERROR: $@" >&2
exit 1
}
split() {
local ifs
ifs=$IFS
IFS=:
set -- $1
echo $*
IFS=$ifs
}
qt()
{
"$@" >/dev/null 2>&1
}
mywhich() {
local dir
for dir in $(split $PATH); do
if [ -x $dir/$1 ]; then
echo $dir/$1
return 0
fi
done
return 2
}
cant_autostart()
{
echo
echo "WARNING: Unable to configure $Product to start automatically at boot" >&2
}
delete_file() # $1 = file to delete
{
rm -f $1
}
install_file() # $1 = source $2 = target $3 = mode
{
if cp -f $1 $2; then
if chmod $3 $2; then
if [ -n "$OWNER" ]; then
if chown $OWNER:$GROUP $2; then
return
fi
else
return 0
fi
fi
fi
echo "ERROR: Failed to install $2" >&2
exit 1
}
make_directory() # $1 = directory , $2 = mode
{
mkdir -p $1
chmod 755 $1
[ -n "$OWNERSHIP" ] && chown $OWNERSHIP $1
}
require()
{
eval [ -n "\$$1" ] || fatal_error "Required option $1 not set"
}
#
# Change to the directory containing this script
#
cd "$(dirname $0)"
if [ -f shorewall-lite ]; then
PRODUCT=shorewall-lite
Product="Shorewall Lite"
else
PRODUCT=shorewall6-lite
Product="Shorewall6 Lite"
fi
#
# Parse the run line
#
finished=0
configure=1
while [ $finished -eq 0 ] ; do
option=$1
case "$option" in
-*)
option=${option#-}
while [ -n "$option" ]; do
case $option in
h)
usage 0
;;
v)
echo "$Product Firewall Installer Version $VERSION"
exit 0
;;
n*)
configure=0
option=${option#n}
;;
*)
usage 1
;;
esac
done
shift
;;
*)
finished=1
;;
esac
done
#
# Read the RC file
#
if [ $# -eq 0 ]; then
if [ -f ./shorewallrc ]; then
. ./shorewallrc || exit 1
file=./shorewallrc
elif [ -f ~/.shorewallrc ]; then
. ~/.shorewallrc
elif [ -f /usr/share/shorewall/shorewallrc ]; then
. /usr/share/shorewall/shorewallrc
else
fatal_error "No configuration file specified and /usr/share/shorewall/shorewallrc not found"
fi
elif [ $# -eq 1 ]; then
file=$1
case $file in
/*|.*)
;;
*)
file=./$file
;;
esac
. $file
else
usage 1
fi
if [ -z "${VARLIB}" ]; then
VARLIB=${VARDIR}
VARDIR=${VARLIB}/${PRODUCT}
elif [ -z "${VARDIR}" ]; then
VARDIR=${VARLIB}/${PRODUCT}
fi
for var in SHAREDIR LIBEXECDIR CONFDIR SBINDIR VARLIB VARDIR; do
require $var
done
[ -n "${INITFILE}" ] && require INITSOURCE && require INITDIR
PATH=${SBINDIR}:/bin:/usr${SBINDIR}:/usr/bin:/usr/local/bin:/usr/local${SBINDIR}
[ -n "$SANDBOX" ] && configure=0
#
# Determine where to install the firewall script
#
cygwin=
if [ -z "$BUILD" ]; then
case $(uname) in
cygwin*|CYGWIN*)
BUILD=cygwin
;;
Darwin)
BUILD=apple
;;
*)
if [ -f /etc/os-release ]; then
eval $(cat /etc/os-release | grep ^ID)
case $ID in
fedora|rhel|centos|foobar)
BUILD=redhat
;;
debian)
BUILD=debian
;;
gentoo)
BUILD=gentoo
;;
opensuse)
BUILD=suse
;;
*)
BUILD="$ID"
;;
esac
elif [ -f ${CONFDIR}/debian_version ]; then
BUILD=debian
elif [ -f /etc/gentoo-release ]; then
BUILD=gentoo
elif [ -f ${CONFDIR}/redhat-release ]; then
BUILD=redhat
elif [ -f ${CONFDIR}/SuSE-release ]; then
BUILD=suse
elif [ -f ${CONFDIR}/slackware-version ] ; then
BUILD=slackware
elif [ -f ${CONFDIR}/arch-release ] ; then
BUILD=archlinux
elif [ -f ${CONFDIR}/openwrt_release ]; then
BUILD=openwrt
else
BUILD=linux
fi
;;
esac
fi
case $BUILD in
cygwin*|CYGWIN*)
OWNER=$(id -un)
GROUP=$(id -gn)
;;
apple)
[ -z "$OWNER" ] && OWNER=root
[ -z "$GROUP" ] && GROUP=wheel
;;
*)
if [ $(id -u) -eq 0 ]; then
[ -z "$OWNER" ] && OWNER=root
[ -z "$GROUP" ] && GROUP=root
fi
;;
esac
[ -n "$OWNER" ] && OWNERSHIP="$OWNER:$GROUP"
[ -n "$HOST" ] || HOST=$BUILD
case "$HOST" in
cygwin)
echo "$PRODUCT is not supported on Cygwin" >&2
exit 1
;;
apple)
echo "$PRODUCT is not supported on OS X" >&2
exit 1
;;
debian)
echo "Installing Debian-specific configuration..."
;;
gentoo)
echo "Installing Gentoo-specific configuration..."
;;
redhat)
echo "Installing Redhat/Fedora-specific configuration..."
;;
slackware)
echo "Installing Slackware-specific configuration..."
;;
archlinux)
echo "Installing ArchLinux-specific configuration..."
;;
suse)
echo "Installing Suse-specific configuration..."
;;
openwrt)
echo "Installing OpenWRT-specific configuration..."
;;
linux)
;;
*)
echo "ERROR: Unknown HOST \"$HOST\"" >&2
exit 1;
;;
esac
[ -z "$INITDIR" ] && INITDIR="${CONFDIR}/init.d"
if [ -n "$DESTDIR" ]; then
if [ `id -u` != 0 ] ; then
echo "Not setting file owner/group permissions, not running as root."
OWNERSHIP=""
fi
make_directory ${DESTDIR}${SBINDIR} 755
make_directory ${DESTDIR}${INITDIR} 755
else
if [ ! -f ${SHAREDIR}/shorewall/coreversion ]; then
echo "$PRODUCT $VERSION requires Shorewall Core which does not appear to be installed" >&2
exit 1
fi
fi
echo "Installing $Product Version $VERSION"
#
# Check for ${CONFDIR}/$PRODUCT
#
if [ -z "$DESTDIR" -a -d ${CONFDIR}/$PRODUCT ]; then
if [ ! -f ${SHAREDIR}/shorewall/coreversion ]; then
echo "$PRODUCT $VERSION requires Shorewall Core which does not appear to be installed" >&2
exit 1
fi
[ -f ${CONFDIR}/$PRODUCT/shorewall.conf ] && \
mv -f ${CONFDIR}/$PRODUCT/shorewall.conf ${CONFDIR}/$PRODUCT/$PRODUCT.conf
else
rm -rf ${DESTDIR}${CONFDIR}/$PRODUCT
rm -rf ${DESTDIR}${SHAREDIR}/$PRODUCT
rm -rf ${DESTDIR}${VARDIR}
[ "$LIBEXECDIR" = /usr/share ] || rm -rf ${DESTDIR}/usr/share/$PRODUCT/wait4ifup ${DESTDIR}/usr/share/$PRODUCT/shorecap
fi
#
# Check for ${SBINDIR}/$PRODUCT
#
if [ -f ${DESTDIR}${SBINDIR}/$PRODUCT ]; then
first_install=""
else
first_install="Yes"
fi
delete_file ${DESTDIR}/usr/share/$PRODUCT/xmodules
install_file $PRODUCT ${DESTDIR}${SBINDIR}/$PRODUCT 0544
[ -n "${INITFILE}" ] && make_directory ${DESTDIR}${INITDIR} 755
echo "$Product control program installed in ${DESTDIR}${SBINDIR}/$PRODUCT"
#
# Create ${CONFDIR}/$PRODUCT, /usr/share/$PRODUCT and /var/lib/$PRODUCT if needed
#
mkdir -p ${DESTDIR}${CONFDIR}/$PRODUCT
mkdir -p ${DESTDIR}${SHAREDIR}/$PRODUCT
mkdir -p ${DESTDIR}${LIBEXECDIR}/$PRODUCT
mkdir -p ${DESTDIR}${VARDIR}
chmod 755 ${DESTDIR}${CONFDIR}/$PRODUCT
chmod 755 ${DESTDIR}${SHAREDIR}/$PRODUCT
if [ -n "$DESTDIR" ]; then
mkdir -p ${DESTDIR}${CONFDIR}/logrotate.d
chmod 755 ${DESTDIR}${CONFDIR}/logrotate.d
mkdir -p ${DESTDIR}${INITDIR}
chmod 755 ${DESTDIR}${INITDIR}
fi
if [ -n "$INITFILE" ]; then
if [ -f "${INITSOURCE}" ]; then
initfile="${DESTDIR}${INITDIR}/${INITFILE}"
install_file ${INITSOURCE} "$initfile" 0544
[ "${SHAREDIR}" = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' "$initfile"
echo "SysV init script $INITSOURCE installed in $initfile"
fi
fi
#
# Install the .service file
#
if [ -z "${SERVICEDIR}" ]; then
SERVICEDIR="$SYSTEMD"
fi
if [ -n "$SERVICEDIR" ]; then
mkdir -p ${DESTDIR}${SERVICEDIR}
[ -z "$SERVICEFILE" ] && SERVICEFILE=$PRODUCT.service
install_file $SERVICEFILE ${DESTDIR}${SERVICEDIR}/$PRODUCT.service 644
[ ${SBINDIR} != /sbin ] && eval sed -i \'s\|/sbin/\|${SBINDIR}/\|\' ${DESTDIR}${SERVICEDIR}/$PRODUCT.service
echo "Service file $SERVICEFILE installed as ${DESTDIR}${SERVICEDIR}/$PRODUCT.service"
fi
#
# Install the config file
#
if [ ! -f ${DESTDIR}${CONFDIR}/$PRODUCT/$PRODUCT.conf ]; then
install_file $PRODUCT.conf ${DESTDIR}${CONFDIR}/$PRODUCT/$PRODUCT.conf 0744
echo "Config file installed as ${DESTDIR}${CONFDIR}/$PRODUCT/$PRODUCT.conf"
fi
if [ $HOST = archlinux ] ; then
sed -e 's!LOGFILE=/var/log/messages!LOGFILE=/var/log/messages.log!' -i ${DESTDIR}${CONFDIR}/$PRODUCT/$PRODUCT.conf
elif [ $HOST = gentoo ]; then
# Adjust SUBSYSLOCK path (see https://bugs.gentoo.org/show_bug.cgi?id=459316)
perl -p -w -i -e "s|^SUBSYSLOCK=.*|SUBSYSLOCK=/run/lock/$PRODUCT|;" ${DESTDIR}${CONFDIR}/$PRODUCT/$PRODUCT.conf
fi
#
# Install the Makefile
#
install_file Makefile ${DESTDIR}${CONFDIR}/$PRODUCT/Makefile 0600
[ $SHAREDIR = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${CONFDIR}/$PRODUCT/Makefile
[ $SBINDIR = /sbin ] || eval sed -i \'s\|/sbin/\|${SBINDIR}/\|\' ${DESTDIR}${CONFDIR}/$PRODUCT/Makefile
echo "Makefile installed as ${DESTDIR}${CONFDIR}/$PRODUCT/Makefile"
#
# Install the default config path file
#
install_file configpath ${DESTDIR}${SHAREDIR}/$PRODUCT/configpath 0644
echo "Default config path file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/configpath"
#
# Install the libraries
#
for f in lib.* ; do
if [ -f $f ]; then
install_file $f ${DESTDIR}${SHAREDIR}/$PRODUCT/$f 0644
echo "Library ${f#*.} file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/$f"
fi
done
ln -sf lib.base ${DESTDIR}${SHAREDIR}/$PRODUCT/functions
echo "Common functions linked through ${DESTDIR}${SHAREDIR}/$PRODUCT/functions"
#
# Install Shorecap
#
install_file shorecap ${DESTDIR}${LIBEXECDIR}/$PRODUCT/shorecap 0755
[ $SHAREDIR = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${LIBEXECDIR}/$PRODUCT/shorecap
echo
echo "Capability file builder installed in ${DESTDIR}${LIBEXECDIR}/$PRODUCT/shorecap"
#
# Install the Modules files
#
if [ -f modules ]; then
install_file modules ${DESTDIR}${SHAREDIR}/$PRODUCT/modules 0600
echo "Modules file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/modules"
fi
if [ -f helpers ]; then
install_file helpers ${DESTDIR}${SHAREDIR}/$PRODUCT/helpers 600
echo "Helper modules file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/helpers"
fi
for f in modules.*; do
install_file $f ${DESTDIR}${SHAREDIR}/$PRODUCT/$f 644
echo "Module file $f installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/$f"
done
#
# Install the Man Pages
#
if [ -d manpages ]; then
cd manpages
mkdir -p ${DESTDIR}${MANDIR}/man5/ ${DESTDIR}${MANDIR}/man8/
for f in *.5; do
gzip -c $f > $f.gz
install_file $f.gz ${DESTDIR}${MANDIR}/man5/$f.gz 644
echo "Man page $f.gz installed to ${DESTDIR}${MANDIR}/man5/$f.gz"
done
for f in *.8; do
gzip -c $f > $f.gz
install_file $f.gz ${DESTDIR}${MANDIR}/man8/$f.gz 644
echo "Man page $f.gz installed to ${DESTDIR}${MANDIR}/man8/$f.gz"
done
cd ..
echo "Man Pages Installed"
fi
if [ -d ${DESTDIR}${CONFDIR}/logrotate.d ]; then
install_file logrotate ${DESTDIR}${CONFDIR}/logrotate.d/$PRODUCT 644
echo "Logrotate file installed as ${DESTDIR}${CONFDIR}/logrotate.d/$PRODUCT"
fi
#
# Create the version file
#
echo "$VERSION" > ${DESTDIR}${SHAREDIR}/$PRODUCT/version
chmod 644 ${DESTDIR}${SHAREDIR}/$PRODUCT/version
#
# Remove and create the symbolic link to the init script
#
if [ -z "${DESTDIR}" -a -n "${INITFILE}" ]; then
rm -f ${SHAREDIR}/$PRODUCT/init
ln -s ${INITDIR}/${INITFILE} ${SHAREDIR}/$PRODUCT/init
fi
delete_file ${DESTDIR}${SHAREDIR}/$PRODUCT/lib.common
delete_file ${DESTDIR}${SHAREDIR}/$PRODUCT/lib.cli
delete_file ${DESTDIR}${SHAREDIR}/$PRODUCT/wait4ifup
#
# Note -- not all packages will have the SYSCONFFILE so we need to check for its existance here
#
if [ -n "$SYSCONFFILE" -a -f "$SYSCONFFILE" -a ! -f ${DESTDIR}${SYSCONFDIR}/${PRODUCT} ]; then
if [ ${DESTDIR} ]; then
mkdir -p ${DESTDIR}${SYSCONFDIR}
chmod 755 ${DESTDIR}${SYSCONFDIR}
fi
install_file ${SYSCONFFILE} ${DESTDIR}${SYSCONFDIR}/${PRODUCT} 0640
echo "$SYSCONFFILE installed in ${DESTDIR}${SYSCONFDIR}/${PRODUCT}"
fi
if [ ${SHAREDIR} != /usr/share ]; then
eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/${PRODUCT}/lib.base
eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SBINDIR}/$PRODUCT
fi
if [ $configure -eq 1 -a -z "$DESTDIR" -a -n "$first_install" -a -z "${cygwin}${mac}" ]; then
if [ -n "$SERVICEDIR" ]; then
if systemctl enable ${PRODUCT}.service; then
echo "$Product will start automatically at boot"
fi
elif mywhich insserv; then
if insserv ${INITDIR}/${INITFILE} ; then
echo "$PRODUCT will start automatically at boot"
if [ $HOST = debian ]; then
echo "Set startup=1 in ${CONFDIR}/default/$PRODUCT to enable"
touch /var/log/$PRODUCT-init.log
perl -p -w -i -e 's/^STARTUP_ENABLED=No/STARTUP_ENABLED=Yes/;s/^IP_FORWARDING=On/IP_FORWARDING=Keep/;s/^SUBSYSLOCK=.*/SUBSYSLOCK=/;' ${CONFDIR}/$PRODUCT/$PRODUCT.conf
else
echo "Set STARTUP_ENABLED=Yes in ${CONFDIR}/$PRODUCT/$PRODUCT.conf to enable"
fi
else
cant_autostart
fi
elif mywhich chkconfig; then
if chkconfig --add $PRODUCT ; then
echo "$PRODUCT will start automatically in run levels as follows:"
echo "Set STARTUP_ENABLED=Yes in ${CONFDIR}/$PRODUCT/${PRODUCT}.conf to enable"
chkconfig --list $PRODUCT
else
cant_autostart
fi
elif mywhich update-rc.d ; then
echo "$PRODUCT will start automatically at boot"
echo "Set startup=1 in ${CONFDIR}/default/$PRODUCT to enable"
touch /var/log/$PRODUCT-init.log
perl -p -w -i -e 's/^STARTUP_ENABLED=No/STARTUP_ENABLED=Yes/;s/^IP_FORWARDING=On/IP_FORWARDING=Keep/;s/^SUBSYSLOCK=.*/SUBSYSLOCK=/;' ${CONFDIR}/$PRODUCT/$PRODUCT.conf
update-rc.d $PRODUCT enable
elif mywhich rc-update ; then
if rc-update add $PRODUCT default; then
echo "$PRODUCT will start automatically at boot"
if [ $HOST = debian ]; then
echo "Set startup=1 in ${CONFDIR}/default/$PRODUCT to enable"
touch /var/log/$PRODUCT-init.log
perl -p -w -i -e 's/^STARTUP_ENABLED=No/STARTUP_ENABLED=Yes/;s/^IP_FORWARDING=On/IP_FORWARDING=Keep/;s/^SUBSYSLOCK=.*/SUBSYSLOCK=/;' ${CONFDIR}/$PRODUCT/$PRODUCT.conf
else
echo "Set STARTUP_ENABLED=Yes in ${CONFDIR}/$PRODUCT/$PRODUCT.conf to enable"
fi
else
cant_autostart
fi
elif [ $HOST = openwrt -a -f ${CONFDIR}/rc.common ]; then
/etc/init.d/$PRODUCT enable
if /etc/init.d/$PRODUCT enabled; then
echo "$PRODUCT will start automatically at boot"
else
cant_autostart
fi
elif [ "$INITFILE" != rc.${PRODUCT} ]; then #Slackware starts this automatically
cant_autostart
fi
fi
#
# Report Success
#
echo "$Product Version $VERSION Installed"
shorewall6-lite-5.0.4/lib.base 0000644 0000000 0000000 00000002217 12647470621 014654 0 ustar root root #
# Shorewall 4.4 -- /usr/share/shorewall6-lite/lib.base
#
# (c) 2011, 2014 - Tom Eastep (teastep@shorewall.net)
#
# Complete documentation is available at http://shorewall.net
#
# This program is part of Shorewall.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by the
# Free Software Foundation, either version 2 of the license or, at your
# option, any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, see
Copyright (C) 19yy
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
Also add information on how to contact you by electronic and paper mail.
If the program is interactive, make it output a short notice like this
when it starts in an interactive mode:
Gnomovision version 69, Copyright (C) 19yy name of author
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
This is free software, and you are welcome to redistribute it
under certain conditions; type `show c' for details.
The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License. Of course, the commands you use may
be called something other than `show w' and `show c'; they could even be
mouse-clicks or menu items--whatever suits your program.
You should also get your employer (if you work as a programmer) or your
school, if any, to sign a "copyright disclaimer" for the program, if
necessary. Here is a sample; alter the names:
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
`Gnomovision' (which makes passes at compilers) written by James Hacker.
, 1 April 1989
Ty Coon, President of Vice
This General Public License does not permit incorporating your program into
proprietary programs. If your program is a subroutine library, you may
consider it more useful to permit linking proprietary applications with the
library. If this is what you want to do, use the GNU Library General
Public License instead of this License.
shorewall6-lite-5.0.4/manpages/ 0000755 0000000 0000000 00000000000 12650244211 015027 5 ustar root root shorewall6-lite-5.0.4/manpages/shorewall6-lite-vardir.xml 0000644 0000000 0000000 00000005752 12647470621 022104 0 ustar root root
shorewall6-lite-vardir
5
Configuration Files
vardir
Shorewall6 Lite file
/etc/shorewall6-lite/vardir
Description
This file does not exist by default. You may create the file if you
want to change the directory used by Shorewall6 Lite to store state
information, including compiled firewall scripts. By default, the
directory used is /var/lib/shorewall6-lite/ .
The file contains a single variable assignment:
VARDIR= directory where directory is the name of a
directory. If you add this file, you should copy the files from
/var/lib/shorewall6-lite to the new directory before
performing a shorewall6-lite restart .
Beginning with Shorewall 4.5.2, use of this file is deprecated in
favor of specifying VARDIR in the shorewallrc file
used during installation of Shorewall Core. While the name of the
variable remains VARDIR, the meaning is slightly different. When set in
shorewallrc, Shorewall6 Lite will create a directory under the specified
path name to hold state information.
Example:
VARDIR=/opt/var/lib/
The state directory for Shorewall Lite will be
/opt/var/lib/shorewall6-lite .
When VARDIR is set in
/etc/shorewall6-lite/vardir , Shorewall Lite will
save its state in the directory
specified.
Example
VARDIR=/root/shorewall6
FILES
/etc/shorewall6-lite/vardir
See ALSO
shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5),
shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-interfaces(5),
shorewall6-maclist(5), shorewall6-params(5), shorewall6-policy(5),
shorewall6-providers(5), shorewall6-route_rules(5),
shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5),
shorewall6-tcclasses(5), shorewall6-tcdevices(5), shorewall6-tcrules(5),
shorewall6-tos(5), shorewall6-tunnels(5), shorewall6-zones(5)
shorewall6-lite-5.0.4/manpages/shorewall6-lite.xml 0000644 0000000 0000000 00000156071 12650244211 020604 0 ustar root root
shorewall6-lite
8
Administrative Commands
shorewall6-lite
Administration tool for Shoreline 6 Firewall Lite (Shorewall6
Lite)
shorewall6-lite
trace |debug nolock -options
add interface [:host-list ]zone
shorewall6-lite
trace |debug nolock -options
allow address
shorewall6-lite
trace |debug nolock -options
call function parameter
...
shorewall6-lite
trace |debug nolock -options
clear -f
shorewall6-lite
trace |debug nolock -options
close
open-number |
source dest protocol
port
shorewall6-lite
trace |debug nolock -options
close
source dest
protocol port
shorewall6-lite
trace |debug nolock -options
delete interface [:host-list ]zone
shorewall6-lite
trace |debug nolock -options
disable { interface |
provider }
shorewall6-lite
trace |debug nolock -options
drop address
shorewall6-lite
trace |debug -options
dump -x -l -m -c
shorewall6-lite
trace |debug nolock -options
enable { interface |
provider }
shorewall6-lite
trace |debug nolock -options
forget filename
shorewall6-lite
trace |debug -options
help
shorewall6-lite
trace |debug -options
hits -t
shorewall6-lite
trace |debug -options
iptrace iptables match
expression
shorewall6-lite
trace |debug nolock -options
logdrop address
shorewall6-lite
trace |debug -options
logwatch -m refresh-interval
shorewall6-lite
trace |debug nolock -options
logreject address
shorewall6-lite
trace |debug -options
noiptrace iptables match
expression
shorewall6-lite
trace |debug nolock -options
open
source dest
protocol port
shorewall6-lite
trace |debug nolock -options
reenable { interface |
provider }
shorewall6-lite
trace |debug nolock -options
reject address
shorewall6-lite
trace |debug nolock -options
reset
shorewall6-lite
trace |debug nolock -options
restart -n -p -C
shorewall6-lite
trace |debug nolock -options
restore -C filename
shorewall6-lite
trace |debug nolock -options
run command
parameter ...
shorewall6-lite
trace |debug nolock -options
save -C filename
shorewall6-lite
trace |debug nolock -options
savesets
shorewall6-lite
trace |debug -options
show | list | ls -b -x -l -t
{filter |mangle |nat |raw|rawpost }chain chain
shorewall6-lite
trace |debug -options
show | list | ls -f capabilities
shorewall6-lite
trace |debug -options
show | list | ls -x {bl|blacklists}
shorewall6-lite
trace |debug -options
show | list | ls classifiers|connections|config|events|filters|ip|ipa|zones|policies|marks
shorewall6-lite
trace |debug -options
show | list | ls event event
shorewall6-lite
trace |debug -options
show | list | ls -c routing
shorewall6-lite
trace |debug -options
show | list | ls -x mangle|nat|raw|rawpost
shorewall6-lite
trace |debug -options
show | list | ls tc
shorewall6-lite
trace |debug -options
show | list | ls -m log
shorewall6-lite
trace |debug nolock -options
start -n -p -f -C
shorewall6-lite
trace |debug nolock -options
stop
shorewall6-lite
trace |debug -options
status -i
shorewall6-lite
trace |debug -options
version -a
Description
The shorewall6-lite utility is used to control the Shoreline
Firewall Lite (Shorewall Lite).
Options
The trace and debug options are
used for debugging. See http://www.shorewall.net/starting_and_stopping_shorewall.htm#Trace .
The nolock option prevents the command from
attempting to acquire the shorewall6-lite lockfile. It is useful if you
need to include shorewall commands in the
started extension script .
The options control the amount of output that
the command produces. They consist of a sequence of the letters v and q . If the
options are omitted, the amount of output is determined by the setting of
the VERBOSITY parameter in shorewall6.conf (5). Each v adds one to the effective verbosity and each
q subtracts one from the effective
VERBOSITY. Alternately, v may be followed
immediately with one of -1,0,1,2 to specify VERBOSITY. There may be no
white-space between v and the
VERBOSITY.
The options may also include the letter
t which causes all progress messages to be
timestamped.
Commands
The available commands are listed below.
add {
interface [:host-list ]...
zone | zone
host-list }
Adds a list of hosts or subnets to a dynamic zone usually used
with VPN's.
The interface argument names an
interface defined in the shorewall-interfaces (5)
file. A host-list is comma-separated list
whose elements are host or network addresses.
The add command is not very robust. If
there are errors in the host-list , you
may see a large number of error messages yet a subsequent
shorewall6-lite show zones command will
indicate that all hosts were added. If this happens, replace
add by delete and run the
same command again. Then enter the correct command.
allow
address
Re-enables receipt of packets from hosts previously
blacklisted by a drop ,
logdrop , reject , or
logreject command.
call function [
parameter ... ]
Added in Shorewall 4.6.10. Allows you to call a function in
one of the Shorewall libraries or in your compiled script. function
must name the shell function to be called. The listed parameters are
passed to the function.
The function is first searched for in
lib.base , lib.common and
lib.cli . If it is not found, the call command
is passed to the generated script to be executed.
clear
[-f ]
Clear will remove all rules and chains installed by
shorewall6-lite. The firewall is then wide open and unprotected.
Existing connections are untouched. Clear is often used to see if
the firewall is causing connection problems.
If -f is given, the command will be processed
by the compiled script that executed the last successful
start , reload , restart or refresh command
if that script exists.
close {
open-number |
source dest [
protocol [ port
] ] }
Added in Shorewall 4.5.8. This command closes a temporary open
created by the open command. In the first form,
an open-number specifies the open to be
closed. Open numbers are displayed in the num column of the output of the
shorewall6-lite show opens command.
When the second form of the command is used, the parameters
must match those given in the earlier open
command.
delete {
interface [:host-list ]...
zone | zone
host-list }
The delete command reverses the effect of an earlier
add command.
The interface argument names an
interface defined in the shorewall-interfaces (5)
file. A host-list is comma-separated list
whose elements are a host or network address.
disable {
interface |
provider }
Added in Shorewall 4.4.26. Disables the optional provider
associated with the specified interface
or provider . Where more than one provider
share a single network interface, a
provider name must be given.
drop
address
Causes traffic from the listed
address es to be silently dropped.
dump [-x ]
[-l ] [-m ]
[-c ]
Produces a verbose report about the firewall configuration for
the purpose of problem analysis.
The -x option causes actual packet and byte
counts to be displayed. Without that option, these counts are
abbreviated.
The -m option causes any MAC addresses
included in shorewall6-lite log messages to be displayed.
The -l option causes the rule number for each
Netfilter rule to be displayed.
The -c option causes the route cache to be
dumped in addition to the other routing information.
enable {
interface |
provider }
Added in Shorewall 4.4.26. Enables the optional provider
associated with the specified interface
or provider . Where more than one provider
share a single network interface, a
provider name must be given.
forget [
filename ]
Deletes
/var/lib/shorewall6-lite/filename
and /var/lib/shorewall6-lite/save . If no
filename is given then the file specified
by RESTOREFILE in shorewall6.conf (5) is
assumed.
help
Displays a syntax summary.
hits
Generates several reports from shorewall6-lite log messages in
the current log file. If the -t option is included,
the reports are restricted to log messages generated today.
iptrace ip6tables
match expression
This is a low-level debugging command that causes iptables
TRACE log records to be created. See iptables(8) for details.
The iptables match expression must
be one or more matches that may appear in both the raw table OUTPUT
and raw table PREROUTING chains.
The trace records are written to the kernel's log buffer with
facility = kernel and priority = warning, and they are routed from
there by your logging daemon (syslogd, rsyslog, syslog-ng, ...) --
shorewall6-lite has no control over where the messages go; consult
your logging daemon's documentation.
list
list is a synonym for
show -- please see below.
logdrop
address
Causes traffic from the listed
address es to be logged then discarded.
Logging occurs at the log level specified by the BLACKLIST_LOGLEVEL
setting in shorewall6.conf
(5).
logwatch [-m ]
[refresh-interval ]
Monitors the log file specified by the LOGFILE option in
shorewall6.conf (5) and
produces an audible alarm when new shorewall6-lite messages are
logged.
The -m option causes the MAC address of each
packet source to be displayed if that information is
available.
The refresh-interval specifies the
time in seconds between screen refreshes. You can enter a negative
number by preceding the number with "--" (e.g.,
shorewall6-lite logwatch -- -30 ). In this case,
when a packet count changes, you will be prompted to hit any key to
resume screen refreshes.
logreject
address
Causes traffic from the listed
address es to be logged then rejected.
Logging occurs at the log level specified by the BLACKLIST_LOGLEVEL
setting in shorewall6.conf
(5).
ls
ls is a synonym for show
-- please see below.
noiptrace
ip6tables match
expression
This is a low-level debugging command that cancels a trace
started by a preceding iptrace command.
The ip6tables match expression must
be one given in the iptrace command being
canceled.
open
source dest [
protocol [ port
] ]
Added in Shorewall 4.6.8. This command requires that the
firewall be in the started state and that DYNAMIC_BLACKLIST=Yes in
shorewall6.conf
(5) . The effect of the command is to temporarily open the
firewall for connections matching the parameters.
The source and
dest parameters may each be specified as
all if you don't wish to restrict
the connection source or destination respectively. Otherwise, each
must contain a host or network address or a valid DNS name.
The protocol may be specified
either as a number or as a name listed in /etc/protocols. The
port may be specified numerically or as a
name listed in /etc/services.
To reverse the effect of a successful open
command, use the close command with the same
parameters or simply restart the firewall.
Example: To open the firewall for SSH connections to address
2001:470:b:227::1, the command would be:
shorewall6-lite open all 2001:470:b:227::1 tcp 22
To reverse that command, use:
shorewall6-lite close all 2001:470:b:227::1 tcp 22
reenable {
interface |
provider }
Added in Shorewall 4.6.9. This is equivalent to a
disable command followed by an
enable command on the specified
interface or
provider .
reject
address
Causes traffic from the listed address es
to be silently rejected.
reload [-n] [-p]
[-C ]
Added in Shorewall 5.0.0, reload is similar to shorewall6-lite
start except that it assumes that the firewall is already
started. Existing connections are maintained.
The -n option causes shorewall6-lite to avoid
updating the routing table(s).
The -p option causes the connection tracking
table to be flushed; the conntrack utility must
be installed to use this option.
The -C option was added in Shorewall 4.6.5.
If the specified (or implicit) firewall script is the one that
generated the current running configuration, then the running
netfilter configuration will be reloaded as is so as to preserve the
iptables packet and byte counters.
reset [chain ,
...]
Resets the packet and byte counters in the specified
chain (s). If no
chain is specified, all the packet and
byte counters in the firewall are reset.
restart [-n] [-p]
[-C ]
Beginning with Shorewall 5.0.0, this command performs a true
restart. The firewall is completely stopped as if a
stop command had been issued then it is started
again.
The -n option causes shorewall6-lite to avoid
updating the routing table(s).
The -p option causes the connection tracking
table to be flushed; the conntrack utility must
be installed to use this option.
The -C option was added in Shorewall 4.6.5.
If the specified (or implicit) firewall script is the one that
generated the current running configuration, then the running
netfilter configuration will be reloaded as is so as to preserve the
iptables packet and byte counters.
restore [-n ]
[-p ] [-C ] [
filename ]
Restore shorewall6-lite to a state saved using the
shorewall6-lite save command. Existing
connections are maintained. The filename
names a restore file in /var/lib/shorewall6-lite created using
shorewall6-lite save ; if no
filename is given then shorewall6-lite
will be restored from the file specified by the RESTOREFILE option
in shorewall6.conf (5).
If your ip6tables ruleset depends on variables that are
detected at run-time, either in your params file or by
Shorewall-generated code, restore will use the
values that were current when the ruleset was saved, which may be
different from the current values.
The -C option was added in Shorewall 4.6.5.
If the -C option was specified during
shorewall7-lite save , then the counters saved by
that operation will be restored.
run
command [
parameter ... ]
Added in Shorewall 4.6.3. Executes
command in the context of the generated
script passing the supplied parameter s.
Normally, the command will be a function
declared in lib.private .
Before executing the command, the script will detect the
configuration, setting all SW_* variables and will run your
init extension script with $COMMAND =
'run'.
save [-C ] [
filename ]
The dynamic blacklist is stored in
/var/lib/shorewall6-lite/save . The state of the
firewall is stored in
/var/lib/shorewall6-lite/filename
for use by the shorewall6-lite restore command.
If filename is not given then the state
is saved in the file specified by the RESTOREFILE option in shorewall6.conf (5).
The -C option, added in Shorewall 4.6.5,
causes the ip6tables packet and byte counters to be saved along with
the chains and rules.
savesets
Added in shorewall 4.6.8. Performs the same action as the
stop command with respect to saving ipsets (see
the SAVE_IPSETS option in shorewall6.conf (5)).
This command may be used to proactively save your ipset contents in
the event that a system failure occurs prior to issuing a
stop command.
show
The show command can have a number of different
arguments:
[-x ] bl|blacklists
Added in Shorewall 4.6.2. Displays the dynamic chain
along with any chains produced by entries in
shorewall6-blrules(5).The -x option is passed
directly through to ip6tables and causes actual packet and
byte counts to be displayed. Without this option, those counts
are abbreviated.
[-f ] capabilities
Displays your kernel/iptables capabilities. The
-f option causes the display to be formatted
as a capabilities file for use with compile
-e .
[-b ] [-x ]
[-l ] [-t
{filter |mangle |nat |raw |rawpost }][
chain ... ]
The rules in each chain are
displayed using the iptables
-L chain -n -v command. If no
chain is given, all of the chains in the
filter table are displayed.
The -x option is passed directly
through to iptables and causes actual packet and byte counts
to be displayed. Without this option, those counts are
abbreviated.
The -t option specifies the Netfilter
table to display. The default is filter .
The -b ('brief') option causes rules
which have not been used (i.e. which have zero packet and byte
counts) to be omitted from the output. Chains with no rules
displayed are also omitted from the output.
The -l option causes the rule number
for each Netfilter rule to be displayed.
If the -t option and the
chain keyword are both omitted and any of the
listed chain s do not exist, a usage
message is displayed.
classifiers|filters
Displays information about the packet classifiers
defined on the system as a result of traffic shaping
configuration.
config
Displays distribution-specific defaults.
connections
[filter_parameter
...]
Displays the IP connections currently being tracked by
the firewall.
If the conntrack utility is
installed, beginning with Shorewall 4.6.11 the set of
connections displayed can be limited by including conntrack
filter parameters (-p , -s, --dport, etc). See conntrack(8)
for details.
event
event
Added in Shorewall 4.5.19. Displays the named
event.
events
Added in Shorewall 4.5.19. Displays all events.
ip
Displays the system's IPv4 configuration.
ipa
Added in Shorewall 4.4.17. Displays the per-IP
accounting counters (shorewall-accounting
(5)).
[-m ] log
Displays the last 20 shorewall6-lite messages from the
log file specified by the LOGFILE option in shorewall6.conf (5).
The -m option causes the MAC address of
each packet source to be displayed if that information is
available.
[-x ] mangle
Displays the Netfilter mangle table using the command
ip6tables -t mangle -L -n -v .The
-x option is passed directly through to
ip6tables and causes actual packet and byte counts to be
displayed. Without this option, those counts are
abbreviated.
marks
Added in Shorewall 4.4.26. Displays the various fields
in packet marks giving the min and max value (in both decimal
and hex) and the applicable mask (in hex).
opens
Added in Shorewall 4.5.8. Displays the iptables rules in
the 'dynamic' chain created through use of the open
command..
[-x ] nat
Displays the Netfilter nat table using the command
ip6tables -t nat -L -n -v .The
-x option is passed directly through to
iptables and causes actual packet and byte counts to be
displayed. Without this option, those counts are
abbreviated.
policies
Added in Shorewall 4.4.4. Displays the applicable policy
between each pair of zones. Note that implicit intrazone
ACCEPT policies are not displayed for zones associated with a
single network where that network doesn't specify
routeback .
[-x ] raw
Displays the Netfilter raw table using the command
iptables -t raw -L -n -v .The
-x option is passed directly through to
iptables and causes actual packet and byte counts to be
displayed. Without this option, those counts are
abbreviated.
[-c ]
routing
Displays the system's IPv4 routing configuration. The -c
option causes the route cache to be displayed in addition to
the other routing information.
tc
Displays information about queuing disciplines, classes
and filters.
zones
Displays the current composition of the Shorewall zones
on the system.
start [-p ]
[-n ] [-f ]
[-C ]
Start Shorewall6 Lite. Existing connections through
shorewall6-lite managed interfaces are untouched. New connections
will be allowed only if they are allowed by the firewall rules or
policies.
The -p option causes the connection tracking
table to be flushed; the conntrack utility must
be installed to use this option.
The -n option prevents the firewall script
from modifying the current routing configuration.
The -f option was added in Shorewall 4.6.5.
If the RESTOREFILE named in shorewall.conf (5) exists, is
executable and is not older than the current filewall script, then
that saved configuration is restored.
The -C option was added in Shorewall 4.6.5
and is only meaningful when the -f option is also
specified. If the previously-saved configuration is restored, and if
the -C option was also specified in the
save command, then the packet and byte counters
will be restored.
stop
[-f ]
Stops the firewall. All existing connections, except those
listed in shorewall-routestopped (5)
or permitted by the ADMINISABSENTMINDED option in shorewall6.conf (5), are taken
down. The only new traffic permitted through the firewall is from
systems listed in shorewall-routestopped (5)
or by ADMINISABSENTMINDED.
If -f is given, the command will be processed
by the compiled script that executed the last successful
start , restart or
refresh command if that script exists.
status
Produces a short report about the state of the
Shorewall-configured firewall.
The -i option was added in Shorewall 4.6.2
and causes the status of each optional or provider interface to be
displayed.
version
[-a ]
Displays Shorewall's version. The -a option
is included for compatibility with earlier Shorewall releases and is
ignored.
EXIT STATUS
In general, when a command succeeds, status 0 is returned; when the
command fails, a non-zero status is returned.
The status command returns exit status as
follows:
0 - Firewall is started.
3 - Firewall is stopped or cleared
4 - Unknown state; usually means that the firewall has never been
started.
See ALSO
http://www.shorewall.net/starting_and_stopping_shorewall.htm shorewall6-accounting(5), shorewall6-actions(5),
shorewall6-blacklist(5), shorewall6-hosts(5), shorewall_interfaces(5),
shorewall6-ipsets(5), shorewall6-maclist(5), shorewall6-masq(5),
shorewall6-netmap(5), shorewall6-params(5), shorewall6-policy(5),
shorewall6-providers(5), shorewall6-proxyarp(5), shorewall6-rtrules(5),
shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5),
shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5),
shorewall6-tcrules(5), shorewall6-tos(5), shorewall6-tunnels(5),
shorewall6-zones(5)
shorewall6-lite-5.0.4/manpages/shorewall6-lite.8 0000644 0000000 0000000 00000075066 12650244211 020157 0 ustar root root '\" t
.\" Title: shorewall6-lite
.\" Author: [FIXME: author] [see http://docbook.sf.net/el/author]
.\" Generator: DocBook XSL Stylesheets v1.78.1
shorewall6-lite.conf
5
Configuration Files
shorewall6-lite.conf
Shorewall6 Lite global configuration file
/etc/shorewall6-lite/shorewall6-lite.conf
Description
This file sets options that apply to Shorewall6 Lite as a
whole.
The file consists of Shell comments (lines beginning with '#'),
blank lines and assignment statements
(variable =value ). Each
variable's setting is preceded by comments that describe the variable and
it's effect.
Any option not specified in this file gets its value from the
shorewall6.conf file used during compilation of
/var/lib/shorewall6-lite/firewall. Those settings may be found in the file
/var/lib/shorewall6-lite/firewall.conf.
OPTIONS
The following options may be set in shorewall6.conf.
IP6TABLES= [pathname ]
This parameter names the ip6tables executable to be used by
Shorewall6. If not specified or if specified as a null value, then
the ip6tables executable located using the PATH option is
used.
LOGFILE= [pathname ]
This parameter tells the /sbin/shorewall6 program where to
look for Shorewall6 messages when processing the dump , logwatch , show
log , and hits commands.
If not assigned or if assigned an empty value, /var/log/messages is
assumed.
LOGFORMAT= [" formattemplate " ]
The value of this variable generate the --log-prefix setting
for Shorewall6 logging rules. It contains a “printf” formatting
template which accepts three arguments (the chain name, logging rule
number (optional) and the disposition). To use LOGFORMAT with
fireparse, set it as:
LOGFORMAT="fp=%s:%d a=%s "
If the LOGFORMAT value contains the substring “%d” then the
logging rule number is calculated and formatted in that position; if
that substring is not included then the rule number is not included.
If not supplied or supplied as empty (LOGFORMAT="") then
“Shorewall6:%s:%s:” is assumed.
PATH = pathname [: pathname ]...
Determines the order in which Shorewall6 searches directories
for executable files.
RESTOREFILE= [filename ]
Specifies the simple name of a file in /var/lib/shorewall6 to
be used as the default restore script in the shorewall6 save , shorewall6 restore , shorewall6 forget and shorewall6 -f start commands.
SHOREWALL_SHELL= [pathname ]
This option is used to specify the shell program to be used to
interpret the compiled script. If not specified or specified as a
null value, /bin/sh is assumed. Using a light-weight shell such as
ash or dash can significantly improve performance.
SUBSYSLOCK= [pathname ]
This parameter should be set to the name of a file that the
firewall should create if it starts successfully and remove when it
stops. Creating and removing this file allows Shorewall6 to work
with your distribution's initscripts. For RedHat, this should be set
to /var/lock/subsys/shorewall6. For Debian, the value is
/var/state/shorewall6 and in LEAF it is /var/run/shorewall.
VERBOSITY= [number
Shorewall6 has traditionally been very noisy (produced lots of
output). You may set the default level of verbosity using the
VERBOSITY OPTION.
Values are:
0 - Silent. You may make it more verbose using the -v
option
1 - Major progress messages displayed
2 - All progress messages displayed (old default
behavior)
If not specified, then 2 is assumed.
FILES
/etc/shorewall6-lite/shorewall6.conf
See ALSO
http://www.shorewall.net/Documentation_Index.html shorewall6-lite(8), shorewall6-accounting(5), shorewall6-actions(5),
shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-interfaces(5),
shorewall6-ipsec(5), shorewall6-maclist(5), shorewall6-masq(5),
shorewall6-nat(5), shorewall6-netmap(5), shorewall6-params(5),
shorewall6-policy(5), shorewall6-providers(5), shorewall6-proxyarp(5),
shorewall6-route_rules(5), shorewall6-routestopped(5),
shorewall6-rules(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5),
shorewall6-tcrules(5), shorewall6-tos(5), shorewall6-tunnels(5),
shorewall6-zones(5)
shorewall6-lite-5.0.4/init.openwrt.sh 0000755 0000000 0000000 00000005453 12647470621 016256 0 ustar root root #!/bin/sh /etc/rc.common
#
# The Shoreline Firewall (Shorewall) Packet Filtering Firewall - V4.5
#
# (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2012,2014 - Tom Eastep (teastep@shorewall.net)
# (c) 2015 - Matt Darfeuille - (matdarf@gmail.com)
#
# On most distributions, this file should be called /etc/init.d/shorewall.
#
# Complete documentation is available at http://shorewall.net
#
# This program is part of Shorewall.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by the
# Free Software Foundation, either version 2 of the license or, at your
# option, any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, see ] [ MODULESDIR= ] [ MODULE_SUFFIX="" ] shorecap > capabilities
#
# Now move the capabilities file to the compilation system. The file must
# be placed in a directory on the CONFIG_PATH to be used when compiling firewalls
# for the target system.
#
# Default values for the two variables are:
#
# IPTABLES - iptables
# MODULESDIR - /lib/modules/$(uname -r)/kernel/net/ipv4/netfilter
# MODULE_SUFFIX - "o gz xz ko o.gz o.xz ko.gz ko.xz"
#
# Shorewall need not be installed on the target system to run shorecap. If the '-e' flag is
# used during firewall compilation, then the generated firewall program will likewise not
# require Shorewall to be installed.
g_program=shorewall6-lite
#
# This is modified by the installer when ${SHAREDIR} != /usr/share
#
. /usr/share/shorewall/shorewallrc
g_sharedir="$SHAREDIR"/shorewall6-lite
g_confdir="$CONFDIR"/shorewall6-lite
g_readrc=1
. ${SHAREDIR}/shorewall/lib.cli
. ${SHAREDIR}/shorewall-lite/configpath
[ -n "$PATH" ] || PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
SHOREWALL_VERSION=$(cat /usr/share/shorewall6-lite/version)
[ -n "$IP6TABLES" ] || IP6TABLES=$(mywhich ip6tables)
g_tool=$IP6TABLES
VERBOSITY=0
load_kernel_modules No
determine_capabilities
report_capabilities1
shorewall6-lite-5.0.4/shorewallrc.suse 0000644 0000000 0000000 00000004042 12650243750 016471 0 ustar root root #
# SuSE Shorewall 5.0 rc file
#
BUILD= #Default is to detect the build system
HOST=suse
PREFIX=/usr #Top-level directory for shared files, libraries, etc.
CONFDIR=/etc #Directory where subsystem configurations are installed
SHAREDIR=${PREFIX}/share #Directory for arch-neutral files.
LIBEXECDIR=${PREFIX}/lib #Directory for executable scripts.
PERLLIBDIR=${PREFIX}/lib/perl5/vendor_perl/5.14.2 #Directory to install Shorewall Perl module directory
SBINDIR=/usr/sbin #Directory where system administration programs are installed
MANDIR=${SHAREDIR}/man/ #Directory where manpages are installed.
INITDIR=/etc/init.d #Directory where SysV init scripts are installed.
INITFILE=$PRODUCT #Name of the product's SysV init script
INITSOURCE=init.suse.sh #Name of the distributed file to be installed as the SysV init script
ANNOTATED= #If non-zero, annotated configuration files are installed
SERVICEDIR= #Directory where .service files are installed (systems running systemd only)
SERVICEFILE= #Name of the file to install in $SYSTEMD. Default is $PRODUCT.service
SYSCONFFILE=sysconfig #Name of the distributed file to be installed in $SYSCONFDIR
SYSCONFDIR=/etc/sysconfig/ #Directory where SysV init parameter files are installed
SPARSE= #If non-empty, only install $PRODUCT/$PRODUCT.conf in $CONFDIR
VARLIB=/var/lib #Directory where persistent product data is stored.
VARDIR=${VARLIB}/$PRODUCT #Directory where product variable data is stored.
shorewall6-lite-5.0.4/shorewall6-lite.service.debian 0000644 0000000 0000000 00000001106 12647470621 021072 0 ustar root root #
# The Shoreline Firewall (Shorewall) Packet Filtering Firewall
#
# Copyright 2011 Jonathan Underwood
#
[Unit]
Description=Shorewall IPv6 firewall (lite)
Wants=network-online.target
After=network-online.target
Conflicts=ip6tables.service firewalld.service
[Service]
Type=oneshot
RemainAfterExit=yes
EnvironmentFile=-/etc/default/shorewall6-lite
StandardOutput=syslog
ExecStart=/sbin/shorewall6-lite $OPTIONS start
ExecStop=/sbin/shorewall6-lite $OPTIONS stop
ExecReload=/sbin/shorewall6-lite $OPTIONS reload
[Install]
WantedBy=basic.target
shorewall6-lite-5.0.4/modules.xtables 0000644 0000000 0000000 00000002272 12650243750 016302 0 ustar root root #
# Shorewall6 version 5 - Xtables Modules File
#
# /usr/share/shorewall6/modules.xtables
#
# This file loads the modules that may be needed by the firewall.
#
# THE ORDER OF THE COMMANDS BELOW IS IMPORTANT!!!!!! You MUST load in
# dependency order. i.e., if M2 depends on M1 then you must load M1
# before you load M2.
#
# If you need to modify this file, copy it to /etc/shorewall and modify the
# copy.
#
###############################################################################
loadmodule xt_AUDIT
loadmodule xt_CLASSIFY
loadmodule xt_connmark
loadmodule xt_CONNMARK
loadmodule xt_conntrack
loadmodule xt_dccp
loadmodule xt_dscp
loadmodule xt_DSCP
loadmodule xt_hashlimit
loadmodule xt_helper
loadmodule xt_iprange
loadmodule xt_length
loadmodule xt_limit
loadmodule xt_mac
loadmodule xt_mark
loadmodule xt_MARK
loadmodule xt_multiport
loadmodule xt_NFQUEUE
loadmodule xt_owner
loadmodule xt_physdev
loadmodule xt_pkttype
loadmodule xt_policy
loadmodule xt_sctp
loadmodule xt_tcpmss
loadmodule xt_TCPMSS
loadmodule xt_time
loadmodule xt_IPMARK
loadmodule xt_TPROXY
#
# From xtables-addons
#
loadmodule xt_condition
loadmodule xt_geoip
loadmodule xt_ipp2p
loadmodule xt_LOGMARK
loadmodule xt_RAWNAT
shorewall6-lite-5.0.4/shorewall6-lite.service 0000644 0000000 0000000 00000001045 12647470621 017653 0 ustar root root #
# The Shoreline Firewall (Shorewall) Packet Filtering Firewall
#
# Copyright 2011 Jonathan Underwood
#
[Unit]
Description=Shorewall IPv6 firewall (lite)
Wants=network-online.target
After=network-online.target
Conflicts=ip6tables.service firewalld.service
[Service]
Type=oneshot
RemainAfterExit=yes
EnvironmentFile=-/etc/sysconfig/shorewall6-lite
StandardOutput=syslog
ExecStart=/sbin/shorewall6-lite $OPTIONS start $STARTOPTIONS
ExecStop=/sbin/shorewall6-lite $OPTIONS stop
[Install]
WantedBy=basic.target
shorewall6-lite-5.0.4/shorewallrc.archlinux 0000644 0000000 0000000 00000003300 12650243750 017503 0 ustar root root #
# Arch Linux Shorewall 5.0 rc file
#
BUILD= #Default is to detect the build system
HOST=archlinux
PREFIX=/usr #Top-level directory for shared files, libraries, etc.
SHAREDIR=${PREFIX}/share #Directory for arch-neutral files.
LIBEXECDIR=${PREFIX}/share #Directory for executable scripts.
PERLLIBDIR=${PREFIX}/share/shorewall #Directory to install Shorewall Perl module directory
CONFDIR=/etc #Directory where subsystem configurations are installed
SBINDIR=/usr/bin #Directory where system administration programs are installed
MANDIR=${SHAREDIR}/man #Directory where manpages are installed.
INITDIR= #Directory where SysV init scripts are installed.
INITFILE= #Name of the product's installed SysV init script
INITSOURCE= #Name of the distributed file to be installed as the SysV init script
ANNOTATED= #If non-zero, annotated configuration files are installed
SYSCONFDIR= #Directory where SysV init parameter files are installed
SERVICEDIR=/usr/lib/systemd/system #Directory where .service files are installed (systems running systemd only)
SERVICEFILE= #Name of the file to install in $SYSTEMD. Default is $PRODUCT.service
SPARSE= #If non-empty, only install $PRODUCT/$PRODUCT.conf in $CONFDIR
VARLIB=/var/lib #Directory where product variable data is stored.
VARDIR=${VARLIB}/$PRODUCT #Directory where product variable data is stored.
shorewall6-lite-5.0.4/Makefile 0000644 0000000 0000000 00000001007 12647470621 014706 0 ustar root root # Shorewall6 Lite Makefile to restart if firewall script is newer than last restart
VARDIR=$(shell /sbin/shorewall6-lite show vardir)
SHAREDIR=/usr/share/shorewall6-lite
RESTOREFILE?=.restore
all: $(VARDIR)/$(RESTOREFILE)
$(VARDIR)/$(RESTOREFILE): $(VARDIR)/firewall
@/sbin/shorewall6-lite -q save >/dev/null; \
if \
/sbin/shorewall6-lite -q restart >/dev/null 2>&1; \
then \
/sbin/shorewall6-lite -q save >/dev/null; \
else \
/sbin/shorewall6-lite -q restart 2>&1 | tail >&2; exit 1; \
fi
# EOF