shorewall6-interfaces(5)
NAME
interfaces - shorewall6 interfaces file
SYNOPSIS
/etc/shorewall6/interfaces
DESCRIPTION
The interfaces file serves to define the firewall's network interfaces
to shorewall6. The order of entries in this file is not significant in
determining zone composition.
Beginning with Shorewall 4.5.3, the interfaces file supports two
different formats:
FORMAT 1 (default - deprecated)
There is a ANYCAST column which provides compatibility with older
versions of Shorewall..
FORMAT 2
The BROADCAST column is omitted.
The format is specified by a line as follows:
?FORMAT {1|2}
The columns in the file are as follows.
ZONE - zone-name
Zone for this interface. Must match the name of a zone declared in
/etc/shorewall6/zones. You may not list the firewall zone in this
column.
If the interface serves multiple zones that will be defined in the
shorewall6-hosts[1](5) file, you should place "-" in this column.
If there are multiple interfaces to the same zone, you must list
them in separate entries.
Example:
#ZONE INTERFACE BROADCAST
loc eth1 -
loc eth2 -
Beginning with Shorewall 4.5.17, if you specify a zone for the 'lo'
interface, then that zone must be defined as type local in
shorewall6-zones[2](5).
INTERFACE - interface[:port]
Logical name of interface. Each interface may be listed only once
in this file. You may NOT specify the name of a "virtual" interface
(e.g., eth0:0) here; see http://www.shorewall.net/FAQ.htm#faq18[3].
If the physical option is not specified, then the logical name is
also the name of the actual interface.
You may use wildcards here by specifying a prefix followed by the
plus sign ("+"). For example, if you want to make an entry that
applies to all PPP interfaces, use 'ppp+'; that would match ppp0,
ppp1, ppp2, ...Please note that the '+' means 'one or more
additional characters' so 'ppp' does not match 'ppp+'.
Care must be exercised when using wildcards where there is another
zone that uses a matching specific interface. See
shorewall6-nesting[4](5) for a discussion of this problem.
Shorewall6 allows '+' as an interface name.
There is no need to define the loopback interface (lo) in this
file.
If a port is given, then the interface must have been defined
previously with the bridge option. The OPTIONS column must be empty
when a port is given.
ANYCAST - -
Enter '-' in this column. It is here for compatibility between
Shorewall6 and Shorewall and is omitted if FORMAT is 2.
OPTIONS (Optional) - [option[,option]...]
A comma-separated list of options from the following list. The
order in which you list the options is not significant but the list
should have no embedded white-space.
accept_ra[={0|1|2}]
Added in Shorewall 4.5.16. Values are:
0
Do not accept Router Advertisements.
1
Accept Route Advertisements if forwarding is disabled.
2
Overrule forwarding behavior. Accept Route Advertisements
even if forwarding is enabled.
If the option is specified without a value, then the value 1 is
assumed.
blacklist
Check packets arriving on this interface against the
shorewall6-blacklist[5](5) file.
Beginning with Shorewall 4.4.13:
* If a zone is given in the ZONES column, then the behavior
is as if blacklist had been specified in the IN_OPTIONS
column of shorewall6-zones[2](5).
* Otherwise, the option is ignored with a warning: WARNING:
The 'blacklist' option is ignored on multi-zone interfaces
bridge
Designates the interface as a bridge. Beginning with Shorewall
4.4.7, setting this option also sets routeback.
dbl={none|src|dst|src-dst}
Added in Shorewall 5.0.10. This option defined whether or not
dynamic blacklisting is applied to packets entering the
firewall through this interface and whether the source address
and/or destination address is to be compared against the
ipset-based dynamic blacklist (DYNAMIC_BLACKLIST=ipset... in
shorewall6.conf(5)[6]). The default is determine by the setting
of DYNAMIC_BLACKLIST:
DYNAMIC_BLACKLIST=No
Default is none (e.g., no dynamic blacklist checking).
DYNAMIC_BLACKLIST=Yes
Default is src (e.g., the source IP address is checked
against the ipset).
DYNAMIC_BLACKLIST=ipset[-only]
Default is src.
DYNAMIC_BLACKLIST=ipset[-only],src-dst...
Default is src-dst (e.g., the source IP addresses in
checked against the ipset on input and the destination IP
address is checked against the ipset on packets originating
from the firewall and leaving through this interface).
destonly
Added in Shorewall 4.5.17. Causes the compiler to omit rules to
handle traffic from this interface.
dhcp
Specify this option when any of the following are true:
1. the interface gets its IP address via DHCP
2. the interface is used by a DHCP server running on the
firewall
3. the interface has a static IP but is on a LAN segment with
lots of DHCP clients.
4. the interface is a simple bridge[7] with a DHCP server on
one port and DHCP clients on another port.
Note
If you use Shorewall-perl for firewall/bridging[8],
then you need to include DHCP-specific rules in
shorewall-rules[9](8). DHCP uses UDP ports 546 and 547.
This option allows DHCP datagrams to enter and leave the
interface.
forward[={0|1}]
Sets the /proc/sys/net/ipv6/conf/interface/forwarding option to
the specified value. If no value is supplied, then 1 is
assumed.
ignore[=1]
When specified, causes the generated script to ignore up/down
events from Shorewall-init for this device. Additionally, the
option exempts the interface from hairpin filtering. When '=1'
is omitted, the ZONE column must contain '-' and ignore must be
the only OPTION.
Beginning with Shorewall 4.5.5, may be specified as 'ignore=1'
which only causes the generated script to ignore up/down events
from Shorewall-init; hairpin filtering is still applied. In
this case, the above restrictions on the ZONE and OPTIONS
columns are lifted.
loopback
Added in Shorewall 4.6.6. Designates the interface as the
loopback interface. This option is assumed if the interface's
physical name is 'lo'. Only one interface man have the loopback
option specified.
mss=number
Causes forwarded TCP SYN packets entering or leaving on this
interface to have their MSS field set to the specified number.
nets=(net[,...])
Limit the zone named in the ZONE column to only the listed
networks. If you specify this option, be sure to include the
link-local network (ff80::/10).
nets=dynamic
Added in Shorewall 4.4.21. Defines the zone as dynamic.
Requires ipset match support in your iptables and kernel. See
http://www.shorewall.net/Dynamic.html[10] for further
information.
nodbl
Added in Shorewall 5.0.8. When specified, dynamic blacklisting
is disabled on the interface. Beginning with Shorewall 5.0.10,
nodbl is equivalent to dbl=none.
optional
When optional is specified for an interface, shorewall6 will be
silent when:
* a /proc/sys/net/ipv6/conf/ entry for the interface cannot
be modified.
* The first global IPv6 address of the interface cannot be
obtained.
This option may not be specified together with required.
physical=name
Added in Shorewall 4.4.4. When specified, the interface or port
name in the INTERFACE column is a logical name that refers to
the name given in this option. It is useful when you want to
specify the same wildcard port name on two or more bridges. See
http://www.shorewall.net/bridge-Shorewall-perl.html#Multiple[11].
If the interface name is a wildcard name (ends with '+'), then
the physical name must also end in '+'.
If physical is not specified, then it's value defaults to the
interface name.
required
Added in Shorewall 4.4.10. When specified, the firewall will
fail to start if the interface named in the INTERFACE column is
not usable. May not be specified together with optional.
routeback[={0|1}]
If specified, indicates that shorewall6 should include rules
that allow traffic arriving on this interface to be routed back
out that same interface. This option is also required when you
have used a wildcard in the INTERFACE column if you want to
allow traffic between the interfaces that match the wildcard.
If you specify this option, then you should also specify
rpfilter (see below) if you are running Shorewall 4.5.7 or
later; otherwise, you should specify sfilter (see below).
Beginning with Shorewall 4.5.18, you may specify this option to
explicitly reset (e.g., routeback=0). This can be used to
override Shorewall's default setting for bridge devices which
is routeback=1.
rpfilter
Added in Shorewall 4.5.7. This is an anti-spoofing measure that
requires the 'RPFilter Match' capability in your iptables and
kernel. It provides a more efficient alternative to the sfilter
option below.
sourceroute[={0|1}]
If this option is not specified for an interface, then
source-routed packets will not be accepted from that interface
unless explicitly enabled via sysconf. Only set this option to
1 (enable source routing) if you know what you are doing. This
might represent a security risk and is not usually needed.
Only those interfaces with the sourceroute option will have
their setting changed; the value assigned to the setting will
be the value specified (if any) or 1 if no value is given.
Note
This option does not work with a wild-card interface name
(e.g., eth0.+) in the INTERFACE column.
sfilter=(net[,...])
Added in Shorewall 4.4.20. At this writing (spring 2011), Linux
does not support reverse path filtering (RFC3704) for IPv6. In
its absence, sfilter may be used as an anti-spoofing measure.
This option should be used on bridges or other interfaces with
the routeback option. On these interfaces, sfilter should list
those local networks that are connected to the firewall through
other interfaces.
tcpflags[={0|1}]
Packets arriving on this interface are checked for certain
illegal combinations of TCP flags. Packets found to have such a
combination of flags are handled according to the setting of
TCP_FLAGS_DISPOSITION after having been logged according to the
setting of TCP_FLAGS_LOG_LEVEL.
Beginning with Shorewall 4.6.0, tcpflags=1 is the default. To
disable this option, specify tcpflags=0.
proxyndp[={0|1}]
Sets /proc/sys/net/ipv6/conf/interface/proxy_ndp.
Note: This option does not work with a wild-card interface name
(e.g., eth0.+) in the INTERFACE column.
Only those interfaces with the proxyndp option will have their
setting changed; the value assigned to the setting will be the
value specified (if any) or 1 if no value is given.
unmanaged
Added in Shorewall 4.5.18. Causes all traffic between the
firewall and hosts on the interface to be accepted. When this
option is given:
* The ZONE column must contain '-'.
* Only the following other options are allowed with
unmanaged:
accept_ra
forward
ignore
optional
physical
sourceroute
proxyndp
wait=seconds
Added in Shorewall 4.4.10. Causes the generated script to wait
up to seconds seconds for the interface to become usable before
applying the required or optional options.
EXAMPLE
Example 1:
Suppose you have eth0 connected to a DSL modem and eth1 connected
to your local network You have a DMZ using eth2.
Your entries for this setup would look like:
FORMAT 2
#ZONE INTERFACE OPTIONS
net eth0 -
loc eth1 -
dmz eth2 -
Example 4 (Shorewall 4.4.9 and later):
You have a bridge with no IP address and you want to allow traffic
through the bridge.
FORMAT 2
#ZONE INTERFACE OPTIONS
- br0 bridge
FILES
/etc/shorewall6/interfaces
SEE ALSO
http://www.shorewall.net/configuration_file_basics.htm#Pairs[12] shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5), shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-maclist(5), shorewall6-netmap(5),shorewall6-params(5), shorewall6-policy(5), shorewall6-providers(5), shorewall6-rtrules(5), shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5), shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5), shorewall6-mangle(5), shorewall6-tos(5), shorewall6-tunnels(5), shorewall6-zones(5)
NOTES
1. shorewall6-hosts
http://www.shorewall.net/manpages6/shorewall6-hosts.html
2. shorewall6-zones
http://www.shorewall.net/manpages6/shorewall6-zones.html
3. http://www.shorewall.net/FAQ.htm#faq18
http://www.shorewall.net/FAQ.htm#faq18
4. shorewall6-nesting
http://www.shorewall.net/manpages6/shorewall6-nesting.html
5. shorewall6-blacklist
http://www.shorewall.net/manpages6/shorewall6-blacklist.html
6. shorewall6.conf(5)
http://www.shorewall.netmanpages6/shorewall6.conf.html
7. simple bridge
http://www.shorewall.net/SimpleBridge.html
8. Shorewall-perl for firewall/bridging
http://www.shorewall.net/bridge-Shorewall-perl.html
9. shorewall-rules
http://www.shorewall.net/manpages/shorewall-rules.html
10. http://www.shorewall.net/Dynamic.html
http://www.shorewall.net/Dynamic.html
11. http://www.shorewall.net/bridge-Shorewall-perl.html#Multiple
http://www.shorewall.net/bridge-Shorewall-perl.html#Multiple
12. http://www.shorewall.net/configuration_file_basics.htm#Pairs
http://www.shorewall.net/configuration_file_basics.htm#Pairs
Opportunity
Personal Opportunity - Free software gives you access to billions of dollars of software at no cost. Use this software for your business, personal use or to develop a profitable skill. Access to source code provides access to a level of capabilities/information that companies protect though copyrights. Open source is a core component of the Internet and it is available to you. Leverage the billions of dollars in resources and capabilities to build a career, establish a business or change the world. The potential is endless for those who understand the opportunity.
Business Opportunity - Goldman Sachs, IBM and countless large corporations are leveraging open source to reduce costs, develop products and increase their bottom lines. Learn what these companies know about open source and how open source can give you the advantage.
Free Software
Free Software provides computer programs and capabilities at no cost but more importantly, it provides the freedom to run, edit, contribute to, and share the software. The importance of free software is a matter of access, not price. Software at no cost is a benefit but ownership rights to the software and source code is far more significant.
Free Office Software - The Libre Office suite provides top desktop productivity tools for free. This includes, a word processor, spreadsheet, presentation engine, drawing and flowcharting, database and math applications. Libre Office is available for Linux or Windows.
Free Books
The Free Books Library is a collection of thousands of the most popular public domain books in an online readable format. The collection includes great classical literature and more recent works where the U.S. copyright has expired. These books are yours to read and use without restrictions.
Source Code - Want to change a program or know how it works? Open Source provides the source code for its programs so that anyone can use, modify or learn how to write those programs themselves. Visit the GNU source code repositories to download the source.
Education
Study at Harvard, Stanford or MIT - Open edX provides free online courses from Harvard, MIT, Columbia, UC Berkeley and other top Universities. Hundreds of courses for almost all major subjects and course levels. Open edx also offers some paid courses and selected certifications.
Linux Manual Pages - A man or manual page is a form of software documentation found on Linux/Unix operating systems. Topics covered include computer programs (including library and system calls), formal standards and conventions, and even abstract concepts.
