SHOREWALL-ZONES(5) | [FIXME: manual] | SHOREWALL-ZONES(5) |
NAME¶
zones - Shorewall zone declaration fileSYNOPSIS¶
/etc/shorewall/zones
DESCRIPTION¶
The /etc/shorewall/zones file declares your network zones. You specify the hosts in each zone through entries in /etc/shorewall/interfaces or /etc/shorewall/hosts. The columns in the file are as follows (where the column name is followed by a different name in parentheses, the different name is used in the alternate specification syntax). ZONE - zone[:parent-zone[,parent-zone]...]Name of the zone. Must start with a
letter and consist of letters, digits or '_'. The names "all",
"none", "any", "SOURCE" and "DEST" are
reserved and may not be used as zone names. The maximum length of a zone name
is determined by the setting of the LOGFORMAT option in
shorewall.conf[1](5). With the default LOGFORMAT, zone names can be at
most 5 characters long. The maximum length of an iptables log prefix is 29
bytes. As explained in shorewall.conf[1] (5), the default LOGPREFIX
formatting string is “Shorewall:%s:%s:” where the first %s is
replaced by the chain name and the second is replaced by the disposition.
Example:
Currently, Shorewall uses this information to reorder the zone list so that
parent zones appear after their subzones in the list. The IMPLICIT_CONTINUE
option in shorewall.conf[1](5) can also create implicit CONTINUE
policies to/from the subzone.
Where an ipsec zone is explicitly included as a child of an ipv4
zone, the ruleset allows CONTINUE policies (explicit or implicit) to work as
expected.
In the future, Shorewall may make additional use of nesting information.
TYPE
•The default formatting string has 12
fixed characters ("Shorewall" and three colons).
•The longest of the standard
dispositions are ACCEPT and REJECT which have 6 characters each.
•The canonical name for the chain
containing the rules for traffic going from zone 1 to zone 2 is "<zone
1>2<zone 2>" or "<zone 1>-<zone 2>".
•So if M is the maximum zone name
length, such chains can have length 2*M + 1.
The order in which Shorewall matches addresses from packets to zones is
determined by the order of zone declarations. Where a zone is nested in one or
more other zones, you may either ensure that the nested zone precedes its
parents in this file, or you may follow the (sub)zone name by ":"
and a comma-separated list of the parent zones. The parent zones must have
been declared in earlier records in this file. See
shorewall-nesting[2](5) for additional information.
12 + 6 + 2*M + 1 = 29 which reduces to
2*M = 29 - 12 - 6 - 1 = 10 or
M = 5
#ZONE TYPE OPTIONS IN OPTIONS OUT OPTIONS a ipv4 b ipv4 c:a,b ipv4
ipv4
OPTIONS, IN OPTIONS and OUT OPTIONS (options, in_options, out_options) -
[ option[,option]...]
This is the standard Shorewall zone type and
is the default if you leave this column empty or if you enter "-" in
the column. Communication with some zone hosts may be encrypted. Encrypted
hosts are designated using the 'ipsec'option in
shorewall-hosts[3](5).
ipsec (or ipsec4)
Communication with all zone hosts is
encrypted. Your kernel and iptables must include policy match support.
firewall
Designates the firewall itself. You must have
exactly one 'firewall' zone. No options are permitted with a 'firewall' zone.
The name that you enter in the ZONE column will be stored in the shell
variable $FW which you may use in other configuration files to designate the
firewall zone.
bport (or bport4)
The zone is associated with one or more ports
on a single bridge.
vserver
Added in Shorewall 4.4.11 Beta 2 - A zone
composed of Linux-vserver guests. The zone contents must be defined in
shorewall-hosts[3] (5).
Vserver zones are implicitly handled as subzones of the firewall zone.
A comma-separated list of options. With the
exception of the mss and blacklist options, these only apply to
TYPE ipsec zones.
blacklist
The options in the OPTIONS column are applied to both incoming and outgoing
traffic. The IN OPTIONS are applied to incoming traffic (in addition to
OPTIONS) and the OUT OPTIONS are applied to outgoing traffic.
If you wish to leave a column empty but need to make an entry in a following
column, use "-".
Added in Shorewall 4.4.13. May not be
specified for firewall or vserver zones.
When specified in the IN_OPTIONS column, causes all traffic from this zone to be
passed against the src entries in s horewall-blacklist[4](5).
When specified in the OUT_OPTIONS column, causes all traffic to this zone to be
passed against the dst entries in s horewall-blacklist[4](5).
Specifying this option in the OPTIONS column is equivalent to entering it in
both of the IN_OPTIONS and OUT_OPTIONS column.
reqid=number
where number is specified using
setkey(8) using the 'unique: number option for the SPD level.
spi=<number>
where number is the SPI of the SA used
to encrypt/decrypt packets.
proto=ah|esp|ipcomp
IPSEC Encapsulation Protocol
mss=number
sets the MSS field in TCP packets. If you
supply this option, you should also set FASTACCEPT=No in
shorewall.conf[1](5) to insure that both the SYN and SYN,ACK packets
have their MSS field adjusted.
mode=transport|tunnel
IPSEC mode
tunnel-src=address[/mask]
only available with mode=tunnel
tunnel-dst=address[/mask]
only available with mode=tunnel
strict
Means that packets must match all rules.
next
Separates rules; can only be used with
strict
FILES¶
/etc/shorewall/zonesSEE ALSO¶
http://www.shorewall.net/Multiple_Zones.html. http://shorewall.net/configuration_file_basics.htm#Pairs shorewall(8), shorewall-accounting(5), shorewall-actions(5), shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5), shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5), shorewall-nesting(8), shorewall-netmap(5), shorewall-params(5), shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5), shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5), shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5)NOTES¶
- 1.
- shorewall.conf
- 2.
- shorewall-nesting
- 3.
- shorewall-hosts
- 4.
- horewall-blacklist
06/28/2012 | [FIXME: source] |