1SHOREWALL-ZONES(5) [FIXME: manual] SHOREWALL-ZONES(5)
2
6 zones - Shorewall zone declaration file
7
9 /etc/shorewall/zones
10
12 The /etc/shorewall/zones file declares your network zones. You specify
13 the hosts in each zone through entries in /etc/shorewall/interfaces or
14 /etc/shorewall/hosts.
15 The columns in the file are as follows.
17 ZONE - zone[:parent-zone[,parent-zone]...]
19 Name of the zone. Must start with a letter and consist of letters,
20 digits or '_'. The names "all", "none", "any", "SOURCE" and "DEST"
21 are reserved and may not be used as zone names. The maximum length
22 of a zone name is determined by the setting of the LOGFORMAT option
23 in shorewall.conf[1](5). With the default LOGFORMAT, zone names can
24 be at most 5 characters long. The maximum length of an iptables
25 log prefix is 29 bytes. As explained in shorewall.conf[1] (5), the
26 default LOGPREFIX formatting string is “Shorewall:%s:%s:” where the
27 first %s is replaced by the chain name and the second is replaced
28 by the disposition.
29 · The default formatting string has 12 fixed characters
31 ("Shorewall" and three colons).
32 · The longest of the standard dispositions are ACCEPT and REJECT
34 which have 6 characters each.
35 · The canonical name for the chain containing the rules for
37 traffic going from zone 1 to zone 2 is "<zone 1>2<zone 2>" or
38 "<zone 1>-<zone 2>".
39 · So if M is the maximum zone name length, such chains can have
41 length 2*M + 1.
42 12 + 6 + 2*M + 1 = 29 which reduces to
43 2*M = 29 - 12 - 6 - 1 = 10 or
44 M = 5
45 The order in which Shorewall matches addresses from packets to
46 zones is determined by the order of zone declarations. Where a zone
47 is nested in one or more other zones, you may either ensure that
48 the nested zone precedes its parents in this file, or you may
49 follow the (sub)zone name by ":" and a comma-separated list of the
50 parent zones. The parent zones must have been declared in earlier
51 records in this file. See shorewall-nesting[2](5) for additional
52 information.
53 Example:
55 #ZONE TYPE OPTIONS IN OPTIONS OUT OPTIONS
57 a ipv4
58 b ipv4
59 c:a,b ipv4
60 Currently, Shorewall uses this information to reorder the zone list
62 so that parent zones appear after their subzones in the list. The
63 IMPLICIT_CONTINUE option in shorewall.conf[1](5) can also create
64 implicit CONTINUE policies to/from the subzone.
65 Where an ipsec zone is explicitly included as a child of an ipv4
67 zone, the ruleset allows CONTINUE policies (explicit or implicit)
68 to work as expected.
69 In the future, Shorewall may make additional use of nesting
71 information.
72 TYPE
74 ipv4
76 This is the standard Shorewall zone type and is the default if
77 you leave this column empty or if you enter "-" in the column.
78 Communication with some zone hosts may be encrypted. Encrypted
79 hosts are designated using the 'ipsec'option in
80 shorewall-hosts[3](5).
81 ipsec (or ipsec4)
83 Communication with all zone hosts is encrypted. Your kernel and
84 iptables must include policy match support.
85 firewall
87 Designates the firewall itself. You must have exactly one
88 'firewall' zone. No options are permitted with a 'firewall'
89 zone. The name that you enter in the ZONE column will be stored
90 in the shell variable $FW which you may use in other
91 configuration files to designate the firewall zone.
92 bport (or bport4)
94 The zone is associated with one or more ports on a single
95 bridge.
96 vserver
98 Added in Shorewall 4.4.11 Beta 2 - A zone composed of
99 Linux-vserver guests. The zone contents must be defined in
100 shorewall-hosts[3] (5).
101 Vserver zones are implicitly handled as subzones of the
103 firewall zone.
104 OPTIONS, IN OPTIONS and OUT OPTIONS - [option[,option]...]
106 A comma-separated list of options. With the exception of the mss
107 and blacklist options, these only apply to TYPE ipsec zones.
108 blacklist
110 Added in Shorewall 4.4.13. May not be specified for firewall or
111 vserver zones.
112 When specified in the IN_OPTIONS column, causes all traffic
114 from this zone to be passed against the src entries in
115 shorewall-blacklist[4](5).
116 When specified in the OUT_OPTIONS column, causes all traffic to
118 this zone to be passed against the dst entries in
119 shorewall-blacklist[4](5).
120 Specifying this option in the OPTIONS column is equivalent to
122 entering it in both of the IN_OPTIONS and OUT_OPTIONS column.
123 reqid=number
125 where number is specified using setkey(8) using the
126 'unique:number option for the SPD level.
127 spi=<number>
129 where number is the SPI of the SA used to encrypt/decrypt
130 packets.
131 proto=ah|esp|ipcomp
133 IPSEC Encapsulation Protocol
134 mss=number
136 sets the MSS field in TCP packets. If you supply this option,
137 you should also set FASTACCEPT=No in shorewall.conf[1](5) to
138 insure that both the SYN and SYN,ACK packets have their MSS
139 field adjusted.
140 mode=transport|tunnel
142 IPSEC mode
143 tunnel-src=address[/mask]
145 only available with mode=tunnel
146 tunnel-dst=address[/mask]
148 only available with mode=tunnel
149 strict
151 Means that packets must match all rules.
152 next
154 Separates rules; can only be used with strict
155 The options in the OPTIONS column are applied to both incoming and
157 outgoing traffic. The IN OPTIONS are applied to incoming traffic
158 (in addition to OPTIONS) and the OUT OPTIONS are applied to
159 outgoing traffic.
160 If you wish to leave a column empty but need to make an entry in a
162 following column, use "-".
163
165 /etc/shorewall/zones
166
168 http://www.shorewall.net/Multiple_Zones.html.
169 shorewall(8), shorewall-accounting(5), shorewall-actions(5),
171 shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
172 shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
173 shorewall-nat(5), shorewall-nesting(8), shorewall-netmap(5),
174 shorewall-params(5), shorewall-policy(5), shorewall-providers(5),
175 shorewall-proxyarp(5), shorewall-route_rules(5),
176 shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
177 shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
178 shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5)
179
181 1. shorewall.conf
182 http://www.shorewall.net/manpages/shorewall.conf.html
183 2. shorewall-nesting
185 http://www.shorewall.net/manpages/shorewall-nesting.html
186 3. shorewall-hosts
188 http://www.shorewall.net/manpages/shorewall-hosts.html
189 4. horewall-blacklist
191 http://www.shorewall.net/manpages/shorewall-blacklist.html
192[FIXME: source] 09/16/2011 SHOREWALL-ZONES(5)