1SHOREWALL-HOSTS(5)            Configuration Files           SHOREWALL-HOSTS(5)
2
3
4

NAME

6       hosts - Shorewall file
7

SYNOPSIS

9       /etc/shorewall[6]/hosts
10

DESCRIPTION

12       This file is used to define zones in terms of subnets and/or individual
13       IP addresses. Most simple setups don't need to (should not) place
14       anything in this file.
15
16       The order of entries in this file is not significant in determining
17       zone composition. Rather, the order that the zones are declared in
18       shorewall-zones[1](5) determines the order in which the records in this
19       file are interpreted.
20
21           Warning
22           The only time that you need this file is when you have more than
23           one zone connected through a single interface.
24
25           Warning
26           If you have an entry for a zone and interface in
27           shorewall-interfaces[2](5) then do not include any entries in this
28           file for that same (zone, interface) pair.
29
30       The columns in the file are as follows.
31
32       ZONE - zone-name
33           The name of a zone declared in shorewall-zones[1](5). You may not
34           list the firewall zone in this column.
35
36       HOST(S) -
37       interface:{[{address-or-range[,address-or-range]...|+ipset|dynamic}[exclusion]
38           The name of an interface defined in the shorewall-interfaces[2](5)
39           file followed by a colon (":") and a comma-separated list whose
40           elements are either:
41
42            1. The IP address of a host.
43
44            2. A network in CIDR format.
45
46            3. An IP address range of the form low.address-high.address. Your
47               kernel and iptables must have iprange match support.
48
49            4. The name of an ipset.
50
51            5. The word dynamic which makes the zone dynamic in that you can
52               use the shorewall add and shorewall delete commands to change
53               to composition of the zone.
54
55           You may also exclude certain hosts through use of an exclusion (see
56           shorewall-exclusion[3](5).
57
58       OPTIONS (Optional) - [option[,option]...]
59           A comma-separated list of options from the following list. The
60           order in which you list the options is not significant but the list
61           must have no embedded white-space.
62
63           blacklist
64               Check packets arriving on this port against the
65               shorewall-blacklist[4](5) file.
66
67           broadcast
68               Used when you want to include limited broadcasts (destination
69               IP address 255.255.255.255) from the firewall to this zone.
70               Only necessary when:
71
72                1. The network specified in the HOST(S) column does not
73                   include 255.255.255.255.
74
75                2. The zone does not have an entry for this interface in
76                   shorewall-interfaces[2](5).
77
78           destonly
79               Normally used with the Multi-cast IP address range
80               (224.0.0.0/4). Specifies that traffic will be sent to the
81               specified net(s) but that no traffic will be received from the
82               net(s).
83
84           ipsec
85               The zone is accessed via a kernel 2.6 ipsec SA. Note that if
86               the zone named in the ZONE column is specified as an IPSEC zone
87               in the shorewall-zones[1](5) file then you do NOT need to
88               specify the 'ipsec' option here.
89
90           maclist
91               Connection requests from these hosts are compared against the
92               contents of shorewall-maclist[5](5). If this option is
93               specified, the interface must be an Ethernet NIC or equivalent
94               and must be up before Shorewall is started.
95
96           mss=mss
97               Added in Shorewall 4.5.2. When present, causes the TCP mss for
98               new connections to/from the hosts given in the HOST(S) column
99               to be clamped at the specified mss.
100
101           nosmurfs
102               This option only makes sense for ports on a bridge.
103
104               Filter packets for smurfs (packets with a broadcast address as
105               the source).
106
107               Smurfs will be optionally logged based on the setting of
108               SMURF_LOG_LEVEL in shorewall.conf[6](5). After logging, the
109               packets are dropped.
110
111           routeback
112               Shorewall should set up the infrastructure to pass packets from
113               this/these address(es) back to themselves. This is necessary if
114               hosts in this group use the services of a transparent proxy
115               that is a member of the group or if DNAT is used to send
116               requests originating from this group to a server in the group.
117
118           tcpflags
119               Packets arriving from these hosts are checked for certain
120               illegal combinations of TCP flags. Packets found to have such a
121               combination of flags are handled according to the setting of
122               TCP_FLAGS_DISPOSITION after having been logged according to the
123               setting of TCP_FLAGS_LOG_LEVEL.
124

EXAMPLES

126       Example 1
127           The firewall runs a PPTP server which creates a ppp interface for
128           each remote client. The clients are assigned IP addresses in the
129           network 192.168.3.0/24 and in a zone named 'vpn'.
130
131               #ZONE       HOST(S)               OPTIONS
132               vpn         ppp+:192.168.3.0/24
133

FILES

135       /etc/shorewall/hosts
136
137       /etc/shorewall6/hosts
138

SEE ALSO

140       http://www.shorewall.net/configuration_file_basics.htm#Pairs[7]
141
142       shorewall(8)
143

NOTES

145        1. shorewall-zones
146           http://www.shorewall.net/manpages/shorewall-zones.html
147
148        2. shorewall-interfaces
149           http://www.shorewall.net/manpages/shorewall-interfaces.html
150
151        3. shorewall-exclusion
152           http://www.shorewall.net/manpages/shorewall-exclusion.html
153
154        4. shorewall-blacklist
155           http://www.shorewall.net/manpages/shorewall-blacklist.html
156
157        5. shorewall-maclist
158           http://www.shorewall.net/manpages/shorewall-maclist.html
159
160        6. shorewall.conf
161           http://www.shorewall.net/manpages/shorewall.conf.html
162
163        7. http://www.shorewall.net/configuration_file_basics.htm#Pairs
164           http://www.shorewall.net/configuration_file_basics.htm#Pairs
165
166
167
168Configuration Files               01/17/2019                SHOREWALL-HOSTS(5)
Impressum