1SHOREWALL-BLACKLIST(5)          [FIXME: manual]         SHOREWALL-BLACKLIST(5)
2
3
4

NAME

6       blacklist - Shorewall Blacklist file
7

SYNOPSIS

9       /etc/shorewall/blacklist
10

DESCRIPTION

12       The blacklist file is used to perform static blacklisting. You can
13       blacklist by source address (IP or MAC), or by application.
14
15       The columns in the file are as follows.
16
17       ADDRESS/SUBNET - {-|~mac-address|ip-address|address-range|+ipset}
18           Host address, network address, MAC address, IP address range (if
19           your kernel and iptables contain iprange match support) or ipset
20           name prefaced by "+" (if your kernel supports ipset match).
21           Exclusion (shorewall-exclusion[1](5)) is supported.
22
23           MAC addresses must be prefixed with "~" and use "-" as a separator.
24
25           Example: ~00-A0-C9-15-39-78
26
27           A dash ("-") in this column means that any source address will
28           match. This is useful if you want to blacklist a particular
29           application using entries in the PROTOCOL and PORTS columns.
30
31       PROTOCOL (Optional) - {-|[!]protocol-number|[!]protocol-name}
32           If specified, must be a protocol number or a protocol name from
33           protocols(5).
34
35       PORTS (Optional) - {-|[!]port-name-or-number[,port-name-or-number]...}
36           May only be specified if the protocol is TCP (6) or UDP (17). A
37           comma-separated list of destination port numbers or service names
38           from services(5).
39
40       OPTIONS (Optional - Added in 4.4.12) -
41       {-|{dst|src|whitelist|audit}[,...]}
42           If specified, indicates whether traffic from ADDRESS/SUBNET (src)
43           or traffic to ADDRESS/SUBNET (dst) should be blacklisted. The
44           default is src. If the ADDRESS/SUBNET column is empty, then this
45           column has no effect on the generated rule.
46
47               Note
48               In Shorewall 4.4.12, the keywords from and to were used in
49               place of src and dst respectively. Blacklisting was still
50               restricted to traffic arriving on an interface that has the
51               'blacklist' option set. So to block traffic from your local
52               network to an internet host, you had to specify blacklist on
53               your internal interface in shorewall-interfaces[2] (5).
54
55               Note
56               Beginning with Shorewall 4.4.13, entries are applied based on
57               the blacklist setting in shorewall-zones[3](5):
58
59                1. 'blacklist' in the OPTIONS or IN_OPTIONS column. Traffic
60                   from this zone is passed against the entries in this file
61                   that have the src option (specified or defaulted).
62
63                2. 'blacklist' in the OPTIONS or OUT_OPTIONS column. Traffic
64                   to this zone is passed against the entries in this file
65                   that have the dst option.
66           In Shorewall 4.4.20, the whitelist option was added. When whitelist
67           is specified, packets/connections that match the entry are not
68           matched against the remaining entries in the file.
69
70           The audit option was also added in 4.4.20 and causes packets
71           matching the entry to be audited. The audit option may not be
72           specified in whitelist entries and require AUDIT_TARGET support in
73           the kernel and iptables.
74

EXAMPLE

76       Example 1:
77           To block DNS queries from address 192.0.2.126:
78
79                       #ADDRESS/SUBNET         PROTOCOL        PORT
80                       192.0.2.126             udp             53
81
82       Example 2:
83           To block some of the nuisance applications:
84
85                       #ADDRESS/SUBNET         PROTOCOL        PORT
86                       -                       udp             1024:1033,1434
87                       -                       tcp             57,1433,1434,2401,2745,3127,3306,3410,4899,5554,6101,8081,9898
88

FILES

90       /etc/shorewall/blacklist
91

SEE ALSO

93       http://shorewall.net/blacklisting_support.htm
94
95       shorewall(8), shorewall-accounting(5), shorewall-actions(5),
96       shorewall-hosts(5), shorewall_interfaces(5), shorewall-ipsets(5),
97       shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5),
98       shorewall-netmap(5), shorewall-params(5), shorewall-policy(5),
99       shorewall-providers(5), shorewall-proxyarp(5),
100       shorewall-route_rules(5), shorewall-routestopped(5),
101       shorewall-rules(5), shorewall.conf(5), shorewall-secmarks(5),
102       shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5),
103       shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)
104

NOTES

106        1. shorewall-exclusion
107           http://www.shorewall.net/manpages/shorewall-exclusion.html
108
109        2. shorewall-interfaces
110           http://www.shorewall.net/manpages/shorewall-interfaces.html
111
112        3. shorewall-zones
113           http://www.shorewall.net/manpages/shorewall-zones.html
114
115
116
117[FIXME: source]                   09/16/2011            SHOREWALL-BLACKLIST(5)
Impressum