1SHOREWALL6-INTERFAC(5) [FIXME: manual] SHOREWALL6-INTERFAC(5)
2
6 interfaces - shorewall6 interfaces file
7
9 /etc/shorewall6/interfaces
10
12 The interfaces file serves to define the firewall's network interfaces
13 to shorewall6. The order of entries in this file is not significant in
14 determining zone composition.
15 The columns in the file are as follows.
17 ZONE - zone-name
19 Zone for this interface. Must match the name of a zone declared in
20 /etc/shorewall6/zones. You may not list the firewall zone in this
21 column.
22 If the interface serves multiple zones that will be defined in the
24 shorewall6-hosts[1](5) file, you should place "-" in this column.
25 If there are multiple interfaces to the same zone, you must list
27 them in separate entries.
28 Example:
30 #ZONE INTERFACE BROADCAST
32 loc eth1 -
33 loc eth2 -
34 INTERFACE - interface[:port]
36 Logical name of interface. Each interface may be listed only once
37 in this file. You may NOT specify the name of a "virtual" interface
38 (e.g., eth0:0) here; see http://www.shorewall.net/FAQ.htm#faq18. If
39 the physical option is not specified, then the logical name is also
40 the name of the actual interface.
41 You may use wildcards here by specifying a prefix followed by the
43 plus sign ("+"). For example, if you want to make an entry that
44 applies to all PPP interfaces, use 'ppp+'; that would match ppp0,
45 ppp1, ppp2, ...Please note that the '+' means 'one or more
46 additional characters' so 'ppp' does not match 'ppp+'.
47 Care must be exercised when using wildcards where there is another
49 zone that uses a matching specific interface. See
50 shorewall6-nesting[2](5) for a discussion of this problem.
51 Shorewall6 allows '+' as an interface name.
53 There is no need to define the loopback interface (lo) in this
55 file.
56 If a port is given, then the interface must have been defined
58 previously with the bridge option. The OPTIONS column must be empty
59 when a port is given.
60 ANYCAST - -
62 Enter '-' in this column. It is here for compatibility between
63 Shorewall6 and Shorewall.
64 OPTIONS (Optional) - [option[,option]...]
66 A comma-separated list of options from the following list. The
67 order in which you list the options is not significant but the list
68 should have no embedded white space.
69 blacklist
71 Check packets arriving on this interface against the
72 shorewall6-blacklist[3](5) file.
73 Beginning with Shorewall 4.4.13:
75 · If a zone is given in the ZONES column, then the behavior
77 is as if blacklist had been specified in the IN_OPTIONS
78 column of shorewall6-zones[4](5).
79 · Otherwise, the option is ignored with a warning: WARNING:
81 The 'blacklist' option is ignored on mult-zone interfaces
82 bridge
84 Designates the interface as a bridge. Beginning with Shorewall
85 4.4.7, setting this option also sets routeback.
86 dhcp
88 Specify this option when any of the following are true:
89 1. the interface gets its IP address via DHCP
91 2. the interface is used by a DHCP server running on the
93 firewall
94 3. the interface has a static IP but is on a LAN segment with
96 lots of DHCP clients.
97 4. the interface is a simple bridge[5] with a DHCP server on
99 one port and DHCP clients on another port.
100 Note
102 If you use Shorewall-perl for firewall/bridging[6],
103 then you need to include DHCP-specific rules in
104 shorewall-rules[7](8). DHCP uses UDP ports 546 and 547.
105 This option allows DHCP datagrams to enter and leave the
107 interface.
108 forward[={0|1}]
110 Sets the /proc/sys/net/ipv6/conf/interface/forwarding option to
111 the specified value. If no value is supplied, then 1 is
112 assumed.
113 mss=number
115 Causes forwarded TCP SYN packets entering or leaving on this
116 interface to have their MSS field set to the specified number.
117 nets=(net[,...])
119 Limit the zone named in the ZONE column to only the listed
120 networks. If you specify this option, be sure to include the
121 link-local network (ff80::/10).
122 nets=dynamic
124 Added in Shorewall 4.4.21. Defines the zone as dynamic.
125 Requires ipset match support in your iptables and kernel. See
126 http://www.shorewall.net/Dynamic.html for further information.
127 optional
129 When optional is specified for an interface, shorewall6 will be
130 silent when:
131 · a /proc/sys/net/ipv6/conf/ entry for the interface cannot
133 be modified.
134 · The first global IPv6 address of the interface cannot be
136 obtained.
137 This option may not be specified together with required.
139 physical=name
141 Added in Shorewall 4.4.4. When specified, the interface or port
142 name in the INTERFACE column is a logical name that refers to
143 the name given in this option. It is useful when you want to
144 specify the same wildcard port name on two or more bridges. See
145 http://www.shorewall.net/bridge-Shorewall-perl.html#Multiple.
146 If the interface name is a wildcard name (ends with '+'), then
148 the physical name must also end in '+'.
149 If physical is not specified, then it's value defaults to the
151 interface name.
152 required
154 Added in Shorewall 4.4.10. When specified, the firewall will
155 fail to start if the interface named in the INTERFACE column is
156 not usable. May not be specified together with optional.
157 routeback
159 If specified, indicates that shorewall6 should include rules
160 that allow traffic arriving on this interface to be routed back
161 out that same interface. This option is also required when you
162 have used a wildcard in the INTERFACE column if you want to
163 allow traffic between the interfaces that match the wildcard.
164 Beginning with Shorewall 4.4.20, if you specify this option,
166 then you should also specify sfilter (see below).
167 sourceroute[={0|1}]
169 If this option is not specified for an interface, then
170 source-routed packets will not be accepted from that interface
171 (sets /proc/sys/net/ipv6/conf/interface/accept_source_route to
172 1). Only set this option if you know what you are doing. This
173 might represent a security risk and is not usually needed.
174 Only those interfaces with the sourceroute option will have
176 their setting changes; the value assigned to the setting will
177 be the value specified (if any) or 1 if no value is given.
178 Note
180 This option does not work with a wild-card interface name
181 (e.g., eth0.+) in the INTERFACE column.
182 sfilter=(net[,...])
184 Added in Shorewall 4.4.20. At this writing (spring 2011), Linux
185 does not support reverse path filtering (RFC3704) for IPv6. In
186 its absence, sfilter may be used as an anti-spoofing measure.
187 This option should be used on bridges or other interfaces with
189 the routeback option. On these interfaces, sfilter should list
190 those local networks that are connected to the firewall through
191 other interfaces.
192 tcpflags
194 Packets arriving on this interface are checked for certain
195 illegal combinations of TCP flags. Packets found to have such a
196 combination of flags are handled according to the setting of
197 TCP_FLAGS_DISPOSITION after having been logged according to the
198 setting of TCP_FLAGS_LOG_LEVEL.
199 proxyndp[={0|1}]
201 Sets /proc/sys/net/ipv6/conf/interface/proxy_ndp.
202 Note: This option does not work with a wild-card interface name
204 (e.g., eth0.+) in the INTERFACE column.
205 Only those interfaces with the proxyndp option will have their
207 setting changed; the value assigned to the setting will be the
208 value specified (if any) or 1 if no value is given.
209 wait=seconds
211 Added in Shorewall 4.4.10. Causes the generated script to wait
212 up to seconds seconds for the interface to become usable before
213 applying the required or optional options.
214
216 Example 1:
217 Suppose you have eth0 connected to a DSL modem and eth1 connected
218 to your local network You have a DMZ using eth2.
219 Your entries for this setup would look like:
221 #ZONE INTERFACE UNICAST OPTIONS
223 net eth0 -
224 loc eth1 -
225 dmz eth2 -
226 Example 4 (Shorewall 4.4.9 and later):
228 You have a bridge with no IP address and you want to allow traffic
229 through the bridge.
230 #ZONE INTERFACE BROADCAST OPTIONS
232 - br0 - routeback
233
235 /etc/shorewall6/interfaces
236
238 shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5),
239 shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-maclist(5),
240 shorewall6-params(5), shorewall6-policy(5), shorewall6-providers(5),
241 shorewall6-route_rules(5), shorewall6-routestopped(5),
242 shorewall6-rules(5), shorewall6.conf(5), shorewall6-secmarks(5),
243 shorewall6-tcclasses(5), shorewall6-tcdevices(5),
244 shorewall6-tcrules(5), shorewall6-tos(5), shorewall6-tunnels(5),
245 shorewall6-zones(5)
246
248 1. shorewall6-hosts
249 http://www.shorewall.net/manpages6/shorewall6-hosts.html
250 2. shorewall6-nesting
252 http://www.shorewall.net/manpages6/shorewall6-nesting.html
253 3. shorewall6-blacklist
255 http://www.shorewall.net/manpages6/shorewall6-blacklist.html
256 4. shorewall6-zones
258 http://www.shorewall.net/manpages6/shorewall6-zones.html
259 5. simple bridge
261 http://www.shorewall.net/manpages6/../SimpleBridge.html
262 6. Shorewall-perl for firewall/bridging
264 http://www.shorewall.net/manpages6/../bridge-Shorewall-perl.html
265 7. shorewall-rules
267 http://www.shorewall.net/manpages6/shorewall-rules.html
268[FIXME: source] 09/16/2011 SHOREWALL6-INTERFAC(5)