shorewall-rules.5

sharewall is very good

.\"     Title: shorewall-rules
.\"    Author: [FIXME: author] [see http://docbook.sf.net/el/author]
.\" Generator: DocBook XSL Stylesheets v1.74.0 <http://docbook.sf.net/>
.\"      Date: 03/19/2009
.\"    Manual: [FIXME: manual]
.\"    Source: [FIXME: source]
.\"  Language: English
.\"
.TH "SHOREWALL\-RULES" "5" "03/19/2009" "[FIXME: source]" "[FIXME: manual]"
.\" -----------------------------------------------------------------
.\" * (re)Define some macros
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" toupper - uppercase a string (locale-aware)
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.de toupper
.tr aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ
\\$*
.tr aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz
..
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" SH-xref - format a cross-reference to an SH section
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.de SH-xref
.ie n \{\
.\}
.toupper \\$*
.el \{\
\\$*
.\}
..
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" SH - level-one heading that works better for non-TTY output
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.de1 SH
.\" put an extra blank line of space above the head in non-TTY output
.if t \{\
.sp 1
.\}
.sp \\n[PD]u
.nr an-level 1
.set-an-margin
.nr an-prevailing-indent \\n[IN]
.fi
.in \\n[an-margin]u
.ti 0
.HTML-TAG ".NH \\n[an-level]"
.it 1 an-trap
.nr an-no-space-flag 1
.nr an-break-flag 1
\." make the size of the head bigger
.ps +3
.ft B
.ne (2v + 1u)
.ie n \{\
.\" if n (TTY output), use uppercase
.toupper \\$*
.\}
.el \{\
.nr an-break-flag 0
.\" if not n (not TTY), use normal case (not uppercase)
\\$1
.in \\n[an-margin]u
.ti 0
.\" if not n (not TTY), put a border/line under subheading
.sp -.6
\l'\n(.lu'
.\}
..
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" SS - level-two heading that works better for non-TTY output
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.de1 SS
.sp \\n[PD]u
.nr an-level 1
.set-an-margin
.nr an-prevailing-indent \\n[IN]
.fi
.in \\n[IN]u
.ti \\n[SN]u
.it 1 an-trap
.nr an-no-space-flag 1
.nr an-break-flag 1
.ps \\n[PS-SS]u
\." make the size of the head bigger
.ps +2
.ft B
.ne (2v + 1u)
.if \\n[.$] \&\\$*
..
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" BB/BE - put background/screen (filled box) around block of text
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.de BB
.if t \{\
.sp -.5
.br
.in +2n
.ll -2n
.gcolor red
.di BX
.\}
..
.de EB
.if t \{\
.if "\\$2"adjust-for-leading-newline" \{\
.sp -1
.\}
.br
.di
.in
.ll
.gcolor
.nr BW \\n(.lu-\\n(.i
.nr BH \\n(dn+.5v
.ne \\n(BHu+.5v
.ie "\\$2"adjust-for-leading-newline" \{\
\M[\\$1]\h'1n'\v'+.5v'\D'P \\n(BWu 0 0 \\n(BHu -\\n(BWu 0 0 -\\n(BHu'\M[]
.\}
.el \{\
\M[\\$1]\h'1n'\v'-.5v'\D'P \\n(BWu 0 0 \\n(BHu -\\n(BWu 0 0 -\\n(BHu'\M[]
.\}
.in 0
.sp -.5v
.nf
.BX
.in
.sp .5v
.fi
.\}
..
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" BM/EM - put colored marker in margin next to block of text
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.de BM
.if t \{\
.br
.ll -2n
.gcolor red
.di BX
.\}
..
.de EM
.if t \{\
.br
.di
.ll
.gcolor
.nr BH \\n(dn
.ne \\n(BHu
\M[\\$1]\D'P -.75n 0 0 \\n(BHu -(\\n[.i]u - \\n(INu - .75n) 0 0 -\\n(BHu'\M[]
.in 0
.nf
.BX
.in
.fi
.\}
..
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "Name"
rules \- Shorewall rules file
.SH "Synopsis"
.fam C
.HP \w'\fB/etc/shorewall/rules\fR\ 'u
\fB/etc/shorewall/rules\fR
.fam
.SH "Description"
.PP
Entries in this file govern connection establishment by defining exceptions to the policies layed out in
\m[blue]\fBshorewall\-policy\fR\m[]\&\s-2\u[1]\d\s+2(5)\&. By default, subsequent requests and responses are automatically allowed using connection tracking\&. For any particular (source,dest) pair of zones, the rules are evaluated in the order in which they appear in this file and the first terminating match is the one that determines the disposition of the request\&. All rules are terminating except LOG and COUNT rules\&.
.if n \{\
.sp
.\}
.RS 4
.BM yellow
.it 1 an-trap
.nr an-no-space-flag 1
.nr an-break-flag 1
.br
.ps +1
\fBWarning\fR
.ps -1
.br
.PP
If you masquerade or use SNAT from a local system to the internet, you cannot use an ACCEPT rule to allow traffic from the internet to that system\&. You
\fBmust\fR
use a DNAT rule instead\&.
.sp .5v
.EM yellow
.RE
.PP
The rules file is divided into sections\&. Each section is introduced by a "Section Header" which is a line beginning with SECTION and followed by the section name\&.
.PP
Sections are as follows and must appear in the order listed:
.PP
\fBESTABLISHED\fR
.RS 4
Packets in the ESTABLISHED state are processed by rules in this section\&.
.sp
The only ACTIONs allowed in this section are ACCEPT, DROP, REJECT, LOG and QUEUE
.sp
There is an implicit ACCEPT rule inserted at the end of this section\&.
.RE
.PP
\fBRELATED\fR
.RS 4
Packets in the RELATED state are processed by rules in this section\&.
.sp
The only ACTIONs allowed in this section are ACCEPT, DROP, REJECT, LOG and QUEUE
.sp
There is an implicit ACCEPT rule inserted at the end of this section\&.
.RE
.PP
\fBNEW\fR
.RS 4
Packets in the NEW, INVALID and UNTRACKED states are processed by rules in this section\&.
.RE
.if n \{\
.sp
.\}
.RS 4
.BM yellow
.it 1 an-trap
.nr an-no-space-flag 1
.nr an-break-flag 1
.br
.ps +1
\fBNote\fR
.ps -1
.br
.PP
If you are not familiar with Netfilter to the point where you are comfortable with the differences between the various connection tracking states, then it is suggested that you omit the
\fBESTABLISHED\fR
and
\fBRELATED\fR
sections and place all of your rules in the NEW section (That\'s after the line that reads SECTION NEW\')\&.
.sp .5v
.EM yellow
.RE
.if n \{\
.sp
.\}
.RS 4
.BM yellow
.it 1 an-trap
.nr an-no-space-flag 1
.nr an-break-flag 1
.br
.ps +1
\fBWarning\fR
.ps -1
.br
.PP
If you specify FASTACCEPT=Yes in
\m[blue]\fBshorewall\&.conf\fR\m[]\&\s-2\u[2]\d\s+2(5) then the
\fBESTABLISHED\fR
and
\fBRELATED\fR
sections must be empty\&.
.sp .5v
.EM yellow
.RE
.PP
You may omit any section that you don\'t need\&. If no Section Headers appear in the file then all rules are assumed to be in the NEW section\&.
.PP
When defining rules that rewrite the destination IP address and/or port number (namely DNAT and REDIRECT rules), it is important to keep straight which columns in the file specify the packet before rewriting and which specify how the packet will look after rewriting\&.
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
The DEST column specifies the final destination for the packet after rewriting and can include the final IP address and/or port number\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
The remaining columns specify characteristics of the packet before rewriting\&. In particular, the ORIGINAL DEST column gives the original destination IP address of the packet and the DEST PORT(S) column give the original destination port(s)\&.
.RE
.PP
The columns in the file are as follows\&.
.PP
\fBACTION\fR \- {\fBACCEPT\fR[\fB\fB+\fR\fR\fB|\fR\fB\fB!\fR\fR]|\fBNONAT\fR|\fBDROP[\fR\fB\fB!\fR\fR\fB]\fR|\fBREJECT\fR[\fB!\fR]|\fBDNAT\fR[\fB\-\fR]|\fBSAME\fR[\fB\-\fR]|\fBREDIRECT\fR[\fB\-\fR]|\fBCONTINUE\fR[\fB!\fR]|\fBLOG\fR|\fBQUEUE\fR[\fB!\fR]|\fBNFQUEUE[!]\fR|COUNT[\fB(\fR\fIqueuenumber\fR\fB)\fR]\fB|COMMENT\fR|\fIaction\fR|\fImacro\fR[\fB(\fR\fItarget\fR\fB)\fR]}\fB[:\fR{\fIlog\-level\fR|\fBnone\fR}[\fB\fB!\fR\fR][\fB:\fR\fItag\fR]]
.RS 4
Specifies the action to be taken if the connection request matches the rule\&. Must be one of the following\&.
.PP
\fBACCEPT\fR
.RS 4
Allow the connection request\&.
.RE
.PP
\fBACCEPT+\fR
.RS 4
like ACCEPT but also excludes the connection from any subsequent matching
\fBDNAT\fR[\fB\-\fR] or
\fBREDIRECT\fR[\fB\-\fR] rules
.RE
.PP
\fBACCEPT!\fR
.RS 4
like ACCEPT but exempts the rule from being suppressed by OPTIMIZE=1 in
\m[blue]\fBshorewall\&.conf\fR\m[]\&\s-2\u[2]\d\s+2(5)\&.
.RE
.PP
\fBNONAT\fR
.RS 4
Excludes the connection from any subsequent
\fBDNAT\fR[\-] or
\fBREDIRECT\fR[\-] rules but doesn\'t generate a rule to accept the traffic\&.
.RE
.PP
\fBDROP\fR
.RS 4
Ignore the request\&.
.RE
.PP
\fBDROP!\fR
.RS 4
like DROP but exempts the rule from being suppressed by OPTIMIZE=1 in
\m[blue]\fBshorewall\&.conf\fR\m[]\&\s-2\u[2]\d\s+2(5)\&.
.RE
.PP
\fBREJECT\fR
.RS 4
disallow the request and return an icmp\-unreachable or an RST packet\&.
.RE
.PP
\fBREJECT!\fR
.RS 4
like REJECT but exempts the rule from being suppressed by OPTIMIZE=1 in
\m[blue]\fBshorewall\&.conf\fR\m[]\&\s-2\u[2]\d\s+2(5)\&.
.RE
.PP
\fBDNAT\fR
.RS 4
Forward the request to another system (and optionally another port)\&.
.RE
.PP
\fBDNAT\-\fR
.RS 4
Advanced users only\&.
.sp
Like
\fBDNAT\fR
but only generates the
\fBDNAT\fR
iptables rule and not the companion
\fBACCEPT\fR
rule\&.
.RE
.PP
\fBSAME\fR
.RS 4
Similar to
\fBDNAT\fR
except that the port may not be remapped and when multiple server addresses are listed, all requests from a given remote system go to the same server\&..if n \{\
.sp
.\}
.RS 4
.BM yellow
.it 1 an-trap
.nr an-no-space-flag 1
.nr an-break-flag 1
.br
.ps +1
\fBWarning\fR
.ps -1
.br
Support for SAME is scheduled for removal from the Linux kernel in 2008\&.
.sp .5v
.EM yellow
.RE
.RE
.PP
\fBSAME\-\fR
.RS 4
Advanced users only\&.
.sp
Like SAME but only generates the nat iptables rule and not the companion
\fBACCEPT\fR
rule\&.
.RE
.PP
\fBREDIRECT\fR
.RS 4
Redirect the request to a server running on the firewall\&.
.RE
.PP
\fBREDIRECT\-\fR
.RS 4
Advanced users only\&.
.sp
Like
\fBREDIRECT\fR
but only generates the
\fBREDIRECT\fR
iptables rule and not the companion
\fBACCEPT\fR
rule\&.
.RE
.PP
\fBCONTINUE\fR
.RS 4
For experts only\&.
.sp
Do not process any of the following rules for this (source zone,destination zone)\&. If the source and/or destination IP address falls into a zone defined later in
\m[blue]\fBshorewall\-zones\fR\m[]\&\s-2\u[3]\d\s+2(5) or in a parent zone of the source or destination zones, then this connection request will be passed to the rules defined for that (those) zone(s)\&. See
\m[blue]\fBshorewall\-nesting\fR\m[]\&\s-2\u[4]\d\s+2(5) for additional information\&.
.RE
.PP
\fBCONTINUE!\fR
.RS 4
like CONTINUE but exempts the rule from being suppressed by OPTIMIZE=1 in
\m[blue]\fBshorewall\&.conf\fR\m[]\&\s-2\u[2]\d\s+2(5)\&.
.RE
.PP
\fBLOG\fR
.RS 4
Simply log the packet and continue with the next rule\&.
.RE
.PP
\fBQUEUE\fR
.RS 4
Queue the packet to a user\-space application such as ftwall (http://p2pwall\&.sf\&.net)\&. The application may reinsert the packet for further processing\&.
.RE
.PP
\fBQUEUE!\fR
.RS 4
like QUEUE but exempts the rule from being suppressed by OPTIMIZE=1 in
\m[blue]\fBshorewall\&.conf\fR\m[]\&\s-2\u[2]\d\s+2(5)\&.
.RE
.PP
NFQUEUE
.RS 4
Only supported by Shorewall\-perl >= 4\&.0\&.3\&.
.sp
Queues the packet to a user\-space application using the nfnetlink_queue mechanism\&. If a
\fIqueuenumber\fR
is not specified, queue zero (0) is assumed\&.
.RE
.PP
\fBNFQUEUE!\fR
.RS 4
like NFQUEUE but exempts the rule from being suppressed by OPTIMIZE=1 in
\m[blue]\fBshorewall\&.conf\fR\m[]\&\s-2\u[2]\d\s+2(5)\&.
.RE
.PP
COUNT
.RS 4
Simply increment the rule\'s packet and byte count and pass the packet to the next rule\&.
.RE
.PP
\fBCOMMENT\fR
.RS 4
the rest of the line will be attached as a comment to the Netfilter rule(s) generated by the following entries\&. The comment will appear delimited by "/* \&.\&.\&. */" in the output of "shorewall show <chain>"\&. To stop the comment from being attached to further rules, simply include COMMENT on a line by itself\&.
.RE
.PP
\fIaction\fR
.RS 4
The name of an
\fIaction\fR
declared in
\m[blue]\fBshorewall\-actions\fR\m[]\&\s-2\u[5]\d\s+2(5) or in /usr/share/shorewall/actions\&.std\&.
.RE
.PP
\fImacro\fR
.RS 4