NAME
interfaces - shorewall6 interfaces file
SYNOPSIS
/etc/shorewall6/interfaces
DESCRIPTION
The interfaces file serves to define the firewall's network interfaces
to shorewall6. The order of entries in this file is not significant in
determining zone composition.
The columns in the file are as follows.
ZONE - zone-name
Zone for this interface. Must match the name of a zone declared in
/etc/shorewall6/zones. You may not list the firewall zone in this
column.
If the interface serves multiple zones that will be defined in the
shorewall6-hosts[1](5) file, you should place "-" in this column.
If there are multiple interfaces to the same zone, you must list
them in separate entries.
Example:
#ZONE INTERFACE BROADCAST
loc eth1 -
loc eth2 -
INTERFACE - interface[:port]
Logical name of interface. Each interface may be listed only once
in this file. You may NOT specify the name of a "virtual" interface
(e.g., eth0:0) here; see http://www.shorewall.net/FAQ.htm#faq18. If
the physical option is not specified, then the logical name is also
the name of the actual interface.
You may use wildcards here by specifying a prefix followed by the
plus sign ("+"). For example, if you want to make an entry that
applies to all PPP interfaces, use 'ppp+'; that would match ppp0,
ppp1, ppp2, ...
Care must be exercised when using wildcards where there is another
zone that uses a matching specific interface. See
shorewall6-nesting[2](5) for a discussion of this problem.
Shorewall6 allows '+' as an interface name.
There is no need to define the loopback interface (lo) in this
file.
If a port is given, then the interface must have been defined
previously with the bridge option. The OPTIONS column must be empty
when a port is given.
UNICAST - -
Enter '-' in this column. It is here for compatibility between
Shorewall6 and Shorewall.
OPTIONS (Optional) - [option[,option]...]
A comma-separated list of options from the following list. The
order in which you list the options is not significant but the list
should have no embedded white space.
blacklist
Check packets arriving on this interface against the
shorewall6-blacklist[3](5) file.
bridge
Designates the interface as a bridge. Beginning with Shorewall
4.4.7, setting this option also sets routeback.
forward[={0|1}]
Sets the /proc/sys/net/ipv6/conf/interface/forwarding option to
the specified value. If no value is supplied, then 1 is
assumed.
mss=number
Causes forwarded TCP SYN packets entering or leaving on this
interface to have their MSS field set to the specified number.
nets=(net[,...])
Limit the zone named in the ZONE column to only the listed
networks. The parentheses may be omitted if only a single net
is given.
optional
When optional is specified for an interface, shorewall6 will be
silent when:
· a /proc/sys/net/ipv6/conf/ entry for the interface cannot
be modified.
· The first global IPv6 address of the interface cannot be
obtained.
This option may not be specified together with required.
physical=name
Added in Shorewall 4.4.4. When specified, the interface or port
name in the INTERFACE column is a logical name that refers to
the name given in this option. It is useful when you want to
specify the same wildcard port name on two or more bridges. See
http://www.shorewall.net/bridge-Shorewall-perl.html#Multiple.
If the interface name is a wildcard name (ends with '+'), then
the physical name must also end in '+'.
If physical is not specified, then it's value defaults to the
interface name.
required
Added in Shorewall 4.4.10. When specified, the firewall will
fail to start if the interface named in the INTERFACE column is
not usable. May not be specified together with optional.
routeback
If specified, indicates that shorewall6 should include rules
that allow traffic arriving on this interface to be routed back
out that same interface. This option is also required when you
have used a wildcard in the INTERFACE column if you want to
allow traffic between the interfaces that match the wildcard.
sourceroute[={0|1}]
If this option is not specified for an interface, then
source-routed packets will not be accepted from that interface
(sets /proc/sys/net/ipv6/conf/interface/accept_source_route to
1). Only set this option if you know what you are doing. This
might represent a security risk and is not usually needed.
Only those interfaces with the sourceroute option will have
their setting changes; the value assigned to the setting will
be the value specified (if any) or 1 if no value is given.
Note
This option does not work with a wild-card interface name
(e.g., eth0.+) in the INTERFACE column.
tcpflags
Packets arriving on this interface are checked for certain
illegal combinations of TCP flags. Packets found to have such a
combination of flags are handled according to the setting of
TCP_FLAGS_DISPOSITION after having been logged according to the
setting of TCP_FLAGS_LOG_LEVEL.
proxyndp[={0|1}]
Sets /proc/sys/net/ipv6/conf/interface/proxy_ndp.
Note: This option does not work with a wild-card interface name
(e.g., eth0.+) in the INTERFACE column.
Only those interfaces with the proxyndp option will have their
setting changed; the value assigned to the setting will be the
value specified (if any) or 1 if no value is given.
wait=seconds
Added in Shorewall 4.4.10. Causes the generated script to wait
up to seconds seconds for the interface to become usable before
applying the required or optional options.
EXAMPLE
Example 1:
Suppose you have eth0 connected to a DSL modem and eth1 connected
to your local network You have a DMZ using eth2.
Your entries for this setup would look like:
#ZONE INTERFACE UNICAST OPTIONS
net eth0 -
loc eth1 -
dmz eth2 -
Example 4 (Shorewall 4.4.9 and later):
You have a bridge with no IP address and you want to allow traffic
through the bridge.
#ZONE INTERFACE BROADCAST OPTIONS
- br0 - routeback
FILES
/etc/shorewall6/interfaces
SEE ALSO
shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5),
shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-maclist(5),
shorewall6-params(5), shorewall6-policy(5), shorewall6-providers(5),
shorewall6-route_rules(5), shorewall6-routestopped(5),
shorewall6-rules(5), shorewall6.conf(5), shorewall6-tcclasses(5),
shorewall6-tcdevices(5), shorewall6-tcrules(5), shorewall6-tos(5),
shorewall6-tunnels(5), shorewall6-zones(5)
NOTES
1. shorewall6-hosts
http://www.shorewall.net/manpages6/shorewall6-hosts.html
2. shorewall6-nesting
http://www.shorewall.net/manpages6/shorewall6-nesting.html
3. shorewall6-blacklist
http://www.shorewall.net/manpages6/shorewall6-blacklist.html
[FIXME: source] 06/17/2010 SHOREWALL6-INTERFAC(5)