SHOREWALL-INTERFACE(5) | [FIXME: manual] | SHOREWALL-INTERFACE(5) |
NAME¶
interfaces - Shorewall interfaces fileSYNOPSIS¶
/etc/shorewall/interfaces
DESCRIPTION¶
The interfaces file serves to define the firewall's network interfaces to Shorewall. The order of entries in this file is not significant in determining zone composition. Beginning with Shorewall 4.5.3, the interfaces file supports two different formats: FORMAT 1 (default - deprecated)There is a BROADCAST column which can be used
to specify the broadcast address associated with the interface.
FORMAT 2
The BROADCAST column is omitted.
The format is specified by a line as follows:
FORMAT {1|2}
The columns in the file are as follows.
ZONE - zone-name
Zone for this interface. Must match the name
of a zone declared in /etc/shorewall/zones. You may not list the firewall zone
in this column.
If the interface serves multiple zones that will be defined in the
shorewall-hosts[1](5) file, you should place "-" in this
column.
If there are multiple interfaces to the same zone, you must list them in
separate entries.
Example:
INTERFACE - interface[:port]
#ZONE INTERFACE BROADCAST loc eth1 - loc eth2 -
Logical name of interface. Each interface may
be listed only once in this file. You may NOT specify the name of a
"virtual" interface (e.g., eth0:0) here; see
http://www.shorewall.net/FAQ.htm#faq18. If the physical option
is not specified, then the logical name is also the name of the actual
interface.
You may use wildcards here by specifying a prefix followed by the plus sign
("+"). For example, if you want to make an entry that applies to all
PPP interfaces, use 'ppp+'; that would match ppp0, ppp1, ppp2, ... Please note
that the '+' means ' one or more additional characters' so 'ppp' does
not match 'ppp+'.
When using Shorewall versions before 4.1.4, care must be exercised when using
wildcards where there is another zone that uses a matching specific interface.
See shorewall-nesting[2](5) for a discussion of this problem.
Shorewall allows '+' as an interface name.
There is no need to define the loopback interface (lo) in this file.
If a port is given, then the interface must have been defined
previously with the bridge option. The OPTIONS column may not contain
the following options when a port is given.
BROADCAST (Optional) -
{-|detect|address[,address]...}
arp_filter
arp_ignore
bridge
log_martians
mss
optional
proxyarp
required
routefilter
sourceroute
upnp
wait
Only available if FORMAT 1.
If you use the special value detect, Shorewall will detect the broadcast
address(es) for you if your iptables and kernel include Address Type Match
support.
If your iptables and/or kernel lack Address Type Match support then you may list
the broadcast address(es) for the network(s) to which the interface belongs.
For P-T-P interfaces, this column is left blank. If the interface has multiple
addresses on multiple subnets then list the broadcast addresses as a
comma-separated list.
If you don't want to give a value for this column but you want to enter a value
in the OPTIONS column, enter - in this column.
OPTIONS (Optional) - [option[,option]...]
A comma-separated list of options from the
following list. The order in which you list the options is not significant but
the list should have no embedded white space.
arp_filter[={0|1}]
If specified, this interface will only respond
to ARP who-has requests for IP addresses configured on the interface. If not
specified, the interface can respond to ARP who-has requests for IP addresses
on any of the firewall's interface. The interface must be up when Shorewall is
started.
Only those interfaces with the arp_filter option will have their setting
changed; the value assigned to the setting will be the value specified (if
any) or 1 if no value is given.
Note
This option does not work with a wild-card interface name (e.g., eth0.+)
in the INTERFACE column.
arp_ignore[=number]
If specified, this interface will respond to
arp requests based on the value of number (defaults to 1).
1 - reply only if the target IP address is local address configured on the
incoming interface
2 - reply only if the target IP address is local address configured on the
incoming interface and the sender's IP address is part from same subnet on
this interface's address
3 - do not reply for local addresses configured with scope host, only
resolutions for global and link
4-7 - reserved
8 - do not reply for all local addresses
Note
This option does not work with a wild-card interface name (e.g., eth0.+)
in the INTERFACE column.
Warning
Do not specify arp_ignore for any interface involved in Proxy
ARP[3].
blacklist
Checks packets arriving on this interface
against the shorewall-blacklist[4](5) file.
Beginning with Shorewall 4.4.13:
bridge
•If a zone is given in the ZONES
column, then the behavior is as if blacklist had been specified in the
IN_OPTIONS column of shorewall-zones[5](5).
•Otherwise, the option is ignored with a
warning: WARNING: The 'blacklist' option is ignored on mult-zone
interfaces
Designates the interface as a bridge.
Beginning with Shorewall 4.4.7, setting this option also sets
routeback.
dhcp
Specify this option when any of the following
are true:
This option allows DHCP datagrams to enter and leave the interface.
ignore[=1]
1.the interface gets its IP address via
DHCP
2.the interface is used by a DHCP server
running on the firewall
3.the interface has a static IP but is on a
LAN segment with lots of DHCP clients.
4.the interface is a simple bridge[6]
with a DHCP server on one port and DHCP clients on another port.
Note
If you use Shorewall-perl for firewall/bridging[7], then you need to
include DHCP-specific rules in shorewall-rules[8](8). DHCP uses UDP
ports 67 and 68.
When specified, causes the generated script to
ignore up/down events from Shorewall-init for this device. Additionally, the
option exempts the interface from hairpin filtering. When '=1' is omitted, the
ZONE column must contain '-' and ignore must be the only OPTION.
Beginning with Shorewall 4.5.5, may be specified as ' ignore=1' which
only causes the generated script to ignore up/down events from Shorewall-init;
hairpin filtering is still applied. In this case, the above restrictions on
the ZONE and OPTIONS columns are lifted.
logmartians[={0|1}]
Turn on kernel martian logging (logging of
packets with impossible source addresses. It is strongly suggested that if you
set routefilter on an interface that you also set logmartians.
Even if you do not specify the routefilter option, it is a good idea to
specify logmartians because your distribution may have enabled route
filtering without you knowing it.
Only those interfaces with the logmartians option will have their setting
changed; the value assigned to the setting will be the value specified (if
any) or 1 if no value is given.
To find out if route filtering is set on a given interface, check the
contents of /proc/sys/net/ipv4/conf/ interface/rp_filter - a non-zero
value indicates that route filtering is enabled.
Example:
Note
This option does not work with a wild-card interface name (e.g., eth0.+)
in the INTERFACE column.
This option may also be enabled globally in the shorewall.conf[9](5)
file.
maclist
teastep@lists:~$ cat /proc/sys/net/ipv4/conf/eth0/rp_filter 1 teastep@lists:~$
Connection requests from this interface are
compared against the contents of shorewall-maclist[10](5). If this
option is specified, the interface must be an ethernet NIC and must be up
before Shorewall is started.
mss=number
Added in Shorewall 4.0.3. Causes forwarded TCP
SYN packets entering or leaving on this interface to have their MSS field set
to the specified number.
nets=(net[,...])
Limit the zone named in the ZONE column to
only the listed networks. The parentheses may be omitted if only a single
net is given (e.g., nets=192.168.1.0/24). Limited broadcast to the zone
is supported. Beginning with Shorewall 4.4.1, multicast traffic to the zone is
also supported.
nets=dynamic
Defines the zone as dynamic. Requires ipset
match support in your iptables and kernel. See
http://www.shorewall.net/Dynamic.html for further information.
nosmurfs
Filter packets for smurfs (packets with a
broadcast address as the source).
Smurfs will be optionally logged based on the setting of SMURF_LOG_LEVEL in
shorewall.conf[9](5). After logging, the packets are dropped.
optional
When optional is specified for an
interface, Shorewall will be silent when:
May not be specified with required.
physical=name
•a /proc/sys/net/ipv4/conf/ entry for
the interface cannot be modified (including for proxy ARP).
•The first address of the interface
cannot be obtained.
Added in Shorewall 4.4.4. When specified, the
interface or port name in the INTERFACE column is a logical name that refers
to the name given in this option. It is useful when you want to specify the
same wildcard port name on two or more bridges. See
http://www.shorewall.net/bridge-Shorewall-perl.html#Multiple.
If the interface name is a wildcard name (ends with '+'), then the
physical name must also end in '+'.
If physical is not specified, then it's value defaults to the
interface name.
proxyarp[={0|1}]
Sets
/proc/sys/net/ipv4/conf/interface/proxy_arp. Do NOT use this option if
you are employing Proxy ARP through entries in
shorewall-proxyarp[11](5). This option is intended solely for use with
Proxy ARP sub-networking as described at:
http://tldp.org/HOWTO/Proxy-ARP-Subnet/index.html.[12]
Note: This option does not work with a wild-card interface name
(e.g., eth0.+) in the INTERFACE column.
Only those interfaces with the proxyarp option will have their setting
changed; the value assigned to the setting will be the value specified (if
any) or 1 if no value is given.
required
Added in Shorewall 4.4.10. If this option is
set, the firewall will fail to start if the interface is not usable. May not
be specified together with optional.
routeback
If specified, indicates that Shorewall should
include rules that allow traffic arriving on this interface to be routed back
out that same interface. This option is also required when you have used a
wildcard in the INTERFACE column if you want to allow traffic between the
interfaces that match the wildcard.
Beginning with Shorewall 4.4.20, if you specify this option, then you should
also specify either sfilter (see below) or routefilter on all
interfaces (see below).
routefilter[={0|1|2}]
Turn on kernel route filtering for this
interface (anti-spoofing measure).
Only those interfaces with the routefilter option will have their setting
changes; the value assigned to the setting will be the value specified (if
any) or 1 if no value is given.
The value 2 is only available with Shorewall 4.4.5.1 and later when the kernel
version is 2.6.31 or later. It specifies a loose form of reverse path
filtering.
Note
This option does not work with a wild-card interface name (e.g., eth0.+)
in the INTERFACE column.
This option can also be enabled globally in the shorewall.conf[9](5)
file.
Note
There are certain cases where routefilter cannot be used on an interface:
sfilter=( net[,...])
•If USE_DEFAULT_RT=Yes in
shorewall.conf[9](5) and the interface is listed in
shorewall-providers[13](5).
•If there is an entry for the interface
in shorewall-providers[13](5) that doesn't specify the balance
option.
•If IPSEC is used to allow a
road-warrior to have a local address, then any interface through which the
road-warrior might connect cannot specify routefilter.
Added in Shorewall 4.4.20. This option
provides an anti-spoofing alternative to routefilter on interfaces
where that option cannot be used, but where the routeback option is
required (on a bridge, for example). On these interfaces, sfilter
should list those local networks that are connected to the firewall through
other interfaces.
sourceroute[={0|1}]
If this option is not specified for an
interface, then source-routed packets will not be accepted from that interface
(sets /proc/sys/net/ipv4/conf/ interface/accept_source_route to 1).
Only set this option if you know what you are doing. This might represent a
security risk and is usually unneeded.
Only those interfaces with the sourceroute option will have their setting
changed; the value assigned to the setting will be the value specified (if
any) or 1 if no value is given.
Note
This option does not work with a wild-card interface name (e.g., eth0.+)
in the INTERFACE column.
tcpflags
Packets arriving on this interface are checked
for certain illegal combinations of TCP flags. Packets found to have such a
combination of flags are handled according to the setting of
TCP_FLAGS_DISPOSITION after having been logged according to the setting of
TCP_FLAGS_LOG_LEVEL.
upnp
Incoming requests from this interface may be
remapped via UPNP (upnpd). See
http://www.shorewall.net/UPnP.html[14].
upnpclient
This option is intended for laptop users who
always run Shorewall on their system yet need to run UPnP-enabled client apps
such as Transmission (BitTorrent client). The option causes Shorewall to
detect the default gateway through the interface and to accept UDP packets
from that gateway. Note that, like all aspects of UPnP, this is a security
hole so use this option at your own risk.
wait=seconds
Added in Shorewall 4.4.10. Causes the
generated script to wait up to seconds seconds for the interface to
become usable before applying the required or optional
options.
EXAMPLE¶
Example 1:Suppose you have eth0 connected to a DSL modem
and eth1 connected to your local network and that your local subnet is
192.168.1.0/24. The interface gets its IP address via DHCP from subnet
206.191.149.192/27. You have a DMZ with subnet 192.168.2.0/24 using eth2. Your
iptables and/or kernel do not support "Address Type Match" and you
prefer to specify broadcast addresses explicitly rather than having Shorewall
detect them.
Your entries for this setup would look like:
Example 2:
FORMAT 1 #ZONE INTERFACE BROADCAST OPTIONS net eth0 206.191.149.223 dhcp loc eth1 192.168.1.255 dmz eth2 192.168.2.255
The same configuration without specifying
broadcast addresses is:
Example 3:
FORMAT 2 #ZONE INTERFACE OPTIONS net eth0 dhcp loc eth1 dmz eth2
You have a simple dial-in system with no
ethernet connections.
Example 4 (Shorewall 4.4.9 and later):
FORMAT 2 #ZONE INTERFACE OPTIONS net ppp0 -
You have a bridge with no IP address and you
want to allow traffic through the bridge.
FORMAT 2 #ZONE INTERFACE OPTIONS - br0 routeback
FILES¶
/etc/shorewall/interfacesSEE ALSO¶
http://shorewall.net/configuration_file_basics.htm#Pairs shorewall(8), shorewall-accounting(5), shorewall-actions(5), shorewall-blacklist(5), shorewall-hosts(5), shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5), shorewall-netmap(5), shorewall-params(5), shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5), shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5), shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)NOTES¶
- 1.
- shorewall-hosts
- 2.
- shorewall-nesting
- 3.
- Proxy ARP
- 4.
- shorewall-blacklist
- 5.
- shorewall-zones
- 6.
- simple bridge
- 7.
- Shorewall-perl for firewall/bridging
- 8.
- shorewall-rules
- 9.
- shorewall.conf
- 10.
- shorewall-maclist
- 11.
- shorewall-proxyarp
- 13.
- shorewall-providers
06/28/2012 | [FIXME: source] |