interfaces — shorewall6 interfaces file
/etc/shorewall6/interfaces
The interfaces file serves to define the firewall's network interfaces to shorewall6. The order of entries in this file is not significant in determining zone composition.
The columns in the file are as follows.
Zone for this interface. Must match the name of a zone declared in /etc/shorewall6/zones. You may not list the firewall zone in this column.
If the interface serves multiple zones that will be defined in the shorewall6-hosts(5) file, you should place "-" in this column.
If there are multiple interfaces to the same zone, you must list them in separate entries.
Example:
#ZONE INTERFACE BROADCAST loc eth1 - loc eth2 -
Logical name of interface. Each interface may be listed only
once in this file. You may NOT specify the name of a "virtual"
interface (e.g., eth0:0) here; see http://www.shorewall.net/FAQ.htm#faq18.
If the physical
option is not specified, then the
logical name is also the name of the actual interface.
You may use wildcards here by specifying a prefix followed by the plus sign ("+"). For example, if you want to make an entry that applies to all PPP interfaces, use 'ppp+'; that would match ppp0, ppp1, ppp2, …
Care must be exercised when using wildcards where there is another zone that uses a matching specific interface. See shorewall6-nesting(5) for a discussion of this problem.
Shorewall6 allows '+' as an interface name.
There is no need to define the loopback interface (lo) in this file.
If a port
is given, then the
interface
must have been defined
previously with the bridge
option. The OPTIONS
column must be empty when a port
is
given.
Enter '-' in this column. It is here for compatibility between Shorewall6 and Shorewall.
A comma-separated list of options from the following list. The order in which you list the options is not significant but the list should have no embedded white space.
Check packets arriving on this interface against the shorewall6-blacklist(5) file.
Designates the interface as a bridge. Beginning with
Shorewall 4.4.7, setting this option also sets
routeback
.
Sets the /proc/sys/net/ipv6/conf/interface/forwarding option to the specified value. If no value is supplied, then 1 is assumed.
Causes forwarded TCP SYN packets entering or leaving on
this interface to have their MSS field set to the specified
number
.
Limit the zone named in the ZONE column to only the
listed networks. The parentheses may be omitted if only a
single net
is given.
When optional
is specified for an
interface, shorewall6 will be silent when:
a /proc/sys/net/ipv6/conf/
entry for the interface cannot be modified.
The first global IPv6 address of the interface cannot be obtained.
This option may not be specified together with required.
Added in Shorewall 4.4.4. When specified, the interface or port name in the INTERFACE column is a logical name that refers to the name given in this option. It is useful when you want to specify the same wildcard port name on two or more bridges. See http://www.shorewall.net/bridge-Shorewall-perl.html#Multiple.
If the interface name is a wildcard name (ends with '+'), then the physical name must also end in '+'.
If physical
is not specified, then it's
value defaults to the interface
name.
Added in Shorewall 4.4.10. When specified, the firewall will fail to start if the interface named in the INTERFACE column is not usable. May not be specified together with optional.
If specified, indicates that shorewall6 should include rules that allow traffic arriving on this interface to be routed back out that same interface. This option is also required when you have used a wildcard in the INTERFACE column if you want to allow traffic between the interfaces that match the wildcard.
If this option is not specified for an interface, then source-routed packets will not be accepted from that interface (sets /proc/sys/net/ipv6/conf/interface/accept_source_route to 1). Only set this option if you know what you are doing. This might represent a security risk and is not usually needed.
Only those interfaces with the
sourceroute
option will have their setting
changes; the value assigned to the setting will be the value
specified (if any) or 1 if no value is given.
This option does not work with a wild-card
interface
name (e.g., eth0.+) in
the INTERFACE column.
Packets arriving on this interface are checked for certain illegal combinations of TCP flags. Packets found to have such a combination of flags are handled according to the setting of TCP_FLAGS_DISPOSITION after having been logged according to the setting of TCP_FLAGS_LOG_LEVEL.
Sets /proc/sys/net/ipv6/conf/interface/proxy_ndp.
Note: This option does
not work with a wild-card interface
name (e.g., eth0.+) in the INTERFACE column.
Only those interfaces with the proxyndp
option will have their setting changed; the value assigned to
the setting will be the value specified (if any) or 1 if no
value is given.
Suppose you have eth0 connected to a DSL modem and eth1 connected to your local network You have a DMZ using eth2.
Your entries for this setup would look like:
#ZONE INTERFACE UNICAST OPTIONS net eth0 - loc eth1 - dmz eth2 -
You have a bridge with no IP address and you want to allow traffic through the bridge.
#ZONE INTERFACE BROADCAST OPTIONS - br0 - routeback
shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5), shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-maclist(5), shorewall6-params(5), shorewall6-policy(5), shorewall6-providers(5), shorewall6-route_rules(5), shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5), shorewall6-tcrules(5), shorewall6-tos(5), shorewall6-tunnels(5), shorewall6-zones(5)