Copyright © 2001-2020 Thomas M. Eastep
Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of the license is included in the section entitled “GNU Free Documentation License”.
2023/02/18
Table of Contents
This article applies to Shorewall 5.0 and later. If you are running a version of Shorewall earlier than Shorewall 5.0.0 then please see the documentation for that release.
If you copy or edit your configuration files on a system running Microsoft Windows, you must run them through dos2unix before you use them with Shorewall.
This article offers hints about how to accomplish common tasks with Shorewall. The Introduction to Shorewall is required reading for being able to use this article effectively. For information about setting up your first Shorewall-based firewall, see the Quickstart Guides.
/etc/shorewall/shorewall.conf - used to
set global firewall parameters.
/etc/shorewall/params - use this file to
set shell variables that you will expand in other files. It is
always processed by /bin/sh or by the shell specified through
SHOREWALL_SHELL in
/etc/shorewall/shorewall.conf.
/etc/shorewall/zones - partition the
firewall's view of the world into zones.
/etc/shorewall/policy - establishes
firewall high-level policy.
/etc/shorewall/initdone - An optional
Perl script that will be invoked by the Shorewall rules compiler
when the compiler has finished it's initialization.
/etc/shorewall/interfaces - describes the
interfaces on the firewall system.
/etc/shorewall/hosts - allows defining
zones in terms of individual hosts and subnetworks.
/etc/shorewall/masq - directs the
firewall where to use many-to-one (dynamic) Network Address
Translation (a.k.a. Masquerading) and Source Network Address
Translation (SNAT).
/etc/shorewall/mangle - supersedes
/etc/shorewall/tcrules in Shorewall 4.6.0.
Contains rules for packet marking, TTL, TPROXY, etc.
/etc/shorewall/rules - defines rules that
are exceptions to the overall policies established in
/etc/shorewall/policy.
/etc/shorewall/nat - defines one-to-one
NAT rules.
/etc/shorewall/proxyarp - defines use of
Proxy ARP.
/etc/shorewall/routestopped - defines
hosts accessible when Shorewall is stopped. Superseded in Shorewall
4.6.8 by /etc/shorewall/stoppedrules. Not
supported in Shorewall 5.0.0 and later versions.
/etc/shorewall/tcrules - The file has a
rather unfortunate name because it is used to define marking of
packets for later use by both traffic control/shaping and policy
routing. This file is superseded by
/etc/shorewall/mangle in Shorewall 4.6.0. Not
supported in Shorewall 5.0.0 and later releases.
/etc/shorewall/tos - defines rules for
setting the TOS field in packet headers. Superseded in Shorewall
4.5.1 by the TOS targ