Tom Eastep
2016-11-04 00:00:10 UTC
The Shorewall Team is pleased to announce the availability of
Shorewall 5.0.14.
Problems Corrected:
1) This release includes defect repair up through Shorewall 5.0.13.4.
2) When the address variable for an optional interface was used, and
the interface did not have an IP address when the firewall was
started, then enabling the interface did not previously
create/alter the rules that use the address variable. Also, if the
IP address of a disabled interface changed, enabling the interface
did not update/add rules using the interface's gateway address
variable.
Now, if the IP address of a disabled optional interface
changes from its value (if any) when the netfilter ruleset was
instantiated, then after a successful 'enable', the ruleset is
automatically reloaded if the interface's address variable was
used.
Similarly, if 'detect' is specified as the GATEWAY for an optional
provider, then if the gateway at the time that the provider is
successfully enabled is different from that (if any) when the
netfilter ruleset was instantiated, then the ruleset is
automatically reloaded if the provider interface's run-time gateway
variable was used.
As part of this change, if an IP address is specified as the
GATEWAY for a provider, then the run-time gateway variable for the
provider's interface is expanded at compile time rather than at
runtime.
Example:
#PROVIDER NUMBER MARK DUPLICATE INTRFACE GATEWAY OPTIONS COPY
foo 1 1 - eth0 1.2.3.4 primary -
Then %eth0 will be expanded at compile time to '1.2.3.4'.
3) Previously, the ADDRESS column in /etc/shorewall[6]/masq was
documented as allowing a list of addresses and/or address ranges.
That feature depended on iptables support which is no longer
present in current distributions. The code now disallows more than
one address[-range] and the documentation has been changed
accordingly.
New Features:
1) /etc/shorewall[6]/masq has been superseded by
/etc/shorewall[6]/snat. The new 'snat' file is similar to most of
the other configuration files in that the first column specifies
the ACTION to be performed, the second contains the SOURCE and so
on.
The 'shorewall[6] update' command will convert an existing masq
file into the equivalent 'snat' file and will rename masq to
masq.bak.
See shorewall[6]-snat(5) for details.
2) Actions (both inline and regular) are now supported out of the new
snat file. Like other actions, these 'SNAT actions' must be
declared in the /etc/shorewall[6]/actions file where the new 'nat'
option must be specified.
Like other actions, the action rules are placed in a file named
action.<action>. Those rules have the same format as those in the
snat file with two restrictions:
1. The '+' is not allowed in the ACTION column to specify that the
rules should be applied before one-to-one NAT. It must rather be
specified when the action is invoked.
2. Interface names are not permitted in the DEST column, so all of
the rules apply to the interface(s) specified when the action was
invoked.
Thank you for using Shorewall,
- -The Shorewall Team
- --
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
Shorewall 5.0.14.
Problems Corrected:
1) This release includes defect repair up through Shorewall 5.0.13.4.
2) When the address variable for an optional interface was used, and
the interface did not have an IP address when the firewall was
started, then enabling the interface did not previously
create/alter the rules that use the address variable. Also, if the
IP address of a disabled interface changed, enabling the interface
did not update/add rules using the interface's gateway address
variable.
Now, if the IP address of a disabled optional interface
changes from its value (if any) when the netfilter ruleset was
instantiated, then after a successful 'enable', the ruleset is
automatically reloaded if the interface's address variable was
used.
Similarly, if 'detect' is specified as the GATEWAY for an optional
provider, then if the gateway at the time that the provider is
successfully enabled is different from that (if any) when the
netfilter ruleset was instantiated, then the ruleset is
automatically reloaded if the provider interface's run-time gateway
variable was used.
As part of this change, if an IP address is specified as the
GATEWAY for a provider, then the run-time gateway variable for the
provider's interface is expanded at compile time rather than at
runtime.
Example:
#PROVIDER NUMBER MARK DUPLICATE INTRFACE GATEWAY OPTIONS COPY
foo 1 1 - eth0 1.2.3.4 primary -
Then %eth0 will be expanded at compile time to '1.2.3.4'.
3) Previously, the ADDRESS column in /etc/shorewall[6]/masq was
documented as allowing a list of addresses and/or address ranges.
That feature depended on iptables support which is no longer
present in current distributions. The code now disallows more than
one address[-range] and the documentation has been changed
accordingly.
New Features:
1) /etc/shorewall[6]/masq has been superseded by
/etc/shorewall[6]/snat. The new 'snat' file is similar to most of
the other configuration files in that the first column specifies
the ACTION to be performed, the second contains the SOURCE and so
on.
The 'shorewall[6] update' command will convert an existing masq
file into the equivalent 'snat' file and will rename masq to
masq.bak.
See shorewall[6]-snat(5) for details.
2) Actions (both inline and regular) are now supported out of the new
snat file. Like other actions, these 'SNAT actions' must be
declared in the /etc/shorewall[6]/actions file where the new 'nat'
option must be specified.
Like other actions, the action rules are placed in a file named
action.<action>. Those rules have the same format as those in the
snat file with two restrictions:
1. The '+' is not allowed in the ACTION column to specify that the
rules should be applied before one-to-one NAT. It must rather be
specified when the action is invoked.
2. Interface names are not permitted in the DEST column, so all of
the rules apply to the interface(s) specified when the action was
invoked.
Thank you for using Shorewall,
- -The Shorewall Team
- --
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________