1SHOREWALL-HOSTS(5) Configuration Files SHOREWALL-HOSTS(5)
2
6 hosts - Shorewall file
7
9 /etc/shorewall[6]/hosts
10
12 This file is used to define zones in terms of subnets and/or individual
13 IP addresses. Most simple setups don't need to (should not) place
14 anything in this file.
15 The order of entries in this file is not significant in determining
17 zone composition. Rather, the order that the zones are declared in
18 shorewall-zones[1](5) determines the order in which the records in this
19 file are interpreted.
20 Warning
22 The only time that you need this file is when you have more than
23 one zone connected through a single interface.
24 Warning
26 If you have an entry for a zone and interface in
27 shorewall-interfaces[2](5) then do not include any entries in this
28 file for that same (zone, interface) pair.
29 The columns in the file are as follows.
31 ZONE - zone-name
33 The name of a zone declared in shorewall-zones[1](5). You may not
34 list the firewall zone in this column.
35 HOST(S) -
37 interface:{[{address-or-range[,address-or-range]...|+ipset|dynamic}[exclusion]
38 The name of an interface defined in the shorewall-interfaces[2](5)
39 file followed by a colon (":") and a comma-separated list whose
40 elements are either:
41 1. The IP address of a host.
43 2. A network in CIDR format.
45 3. An IP address range of the form low.address-high.address. Your
47 kernel and iptables must have iprange match support.
48 4. The name of an ipset.
50 5. The word dynamic which makes the zone dynamic in that you can
52 use the shorewall add and shorewall delete commands to change
53 to composition of the zone.
54 You may also exclude certain hosts through use of an exclusion (see
56 shorewall-exclusion[3](5).
57 OPTIONS (Optional) - [option[,option]...]
59 A comma-separated list of options from the following list. The
60 order in which you list the options is not significant but the list
61 must have no embedded white-space.
62 blacklist
64 Check packets arriving on this port against the
65 shorewall-blacklist[4](5) file.
66 broadcast
68 Used when you want to include limited broadcasts (destination
69 IP address 255.255.255.255) from the firewall to this zone.
70 Only necessary when:
71 1. The network specified in the HOST(S) column does not
73 include 255.255.255.255.
74 2. The zone does not have an entry for this interface in
76 shorewall-interfaces[2](5).
77 destonly
79 Normally used with the Multi-cast IP address range
80 (224.0.0.0/4). Specifies that traffic will be sent to the
81 specified net(s) but that no traffic will be received from the
82 net(s).
83 ipsec
85 The zone is accessed via a kernel 2.6 ipsec SA. Note that if
86 the zone named in the ZONE column is specified as an IPSEC zone
87 in the shorewall-zones[1](5) file then you do NOT need to
88 specify the 'ipsec' option here.
89 maclist
91 Connection requests from these hosts are compared against the
92 contents of shorewall-maclist[5](5). If this option is
93 specified, the interface must be an Ethernet NIC or equivalent
94 and must be up before Shorewall is started.
95 mss=mss
97 Added in Shorewall 4.5.2. When present, causes the TCP mss for
98 new connections to/from the hosts given in the HOST(S) column
99 to be clamped at the specified mss.
100 nosmurfs
102 This option only makes sense for ports on a bridge.
103 Filter packets for smurfs (packets with a broadcast address as
105 the source).
106 Smurfs will be optionally logged based on the setting of
108 SMURF_LOG_LEVEL in shorewall.conf[6](5). After logging, the
109 packets are dropped.
110 routeback
112 Shorewall should set up the infrastructure to pass packets from
113 this/these address(es) back to themselves. This is necessary if
114 hosts in this group use the services of a transparent proxy
115 that is a member of the group or if DNAT is used to send
116 requests originating from this group to a server in the group.
117 tcpflags
119 Packets arriving from these hosts are checked for certain
120 illegal combinations of TCP flags. Packets found to have such a
121 combination of flags are handled according to the setting of
122 TCP_FLAGS_DISPOSITION after having been logged according to the
123 setting of TCP_FLAGS_LOG_LEVEL.
124
126 Example 1
127 The firewall runs a PPTP server which creates a ppp interface for
128 each remote client. The clients are assigned IP addresses in the
129 network 192.168.3.0/24 and in a zone named 'vpn'.
130 #ZONE HOST(S) OPTIONS
132 vpn ppp+:192.168.3.0/24
133
135 /etc/shorewall/hosts
136 /etc/shorewall6/hosts
138
140 https://shorewall.org/configuration_file_basics.htm#Pairs[7]
141 shorewall(8)
143
145 1. shorewall-zones
146 https://shorewall.org/manpages/shorewall-zones.html
147 2. shorewall-interfaces
149 https://shorewall.org/manpages/shorewall-interfaces.html
150 3. shorewall-exclusion
152 https://shorewall.org/manpages/shorewall-exclusion.html
153 4. shorewall-blacklist
155 https://shorewall.org/manpages/shorewall-blacklist.html
156 5. shorewall-maclist
158 https://shorewall.org/manpages/shorewall-maclist.html
159 6. shorewall.conf
161 https://shorewall.org/manpages/shorewall.conf.html
162 7. https://shorewall.org/configuration_file_basics.htm#Pairs
164 https://shorewall.org/configuration_file_basics.htm#Pairs
165Configuration Files 07/29/2020 SHOREWALL-HOSTS(5)