Anatomy of Shorewall 5.0/5.1

Tom Eastep

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of the license is included in the section entitled GNU Free Documentation License.

2017/01/02


Products

Shorewall 5.0 consists of six packages.

  1. Shorewall Core. This package contains the core Shorewall shell libraries and is required to install any of the other packages. Beginning with Shorewall 5.1.0, it also includes the Command Line Interface (CLI) program common to all of the packages.

  2. Shorewall. This package must be installed on at least one system in your network. It contains everything needed to create an IPv4 firewall.

  3. Shorewall6. This package requires the Shorewall package and adds those components needed to create an IPv6 firewall.

  4. Shorewall-lite. Shorewall allows for central administration of multiple IPv4 firewalls through use of Shorewall lite. The full Shorewall product is installed on a central administrative system where compiled Shorewall scripts are generated. These scripts are copied to the firewall systems where they run under the control of Shorewall-lite.

  5. Shorewall6-lite. Shorewall allows for central administration of multiple IPv4 firewalls through use of Shorewall lite. The full Shorewall product is installed on a central administrative system where compiled Shorewall scripts are generated. These scripts are copied to the firewall systems where they run under the control of Shorewall-lite.

  6. Shorewall-init. An add-on to any of the above packages that allows the firewall state to be altered in reaction to interfaces coming up and going down. Where Upstart is not being used, this package can also be configured to place the firewall in a safe state prior to bringing up the network interfaces.

Shorewall

The Shorewall package includes a large number of files which were traditionally installed in /sbin, /usr/share/shorewall, /etc/shorewall, /etc/init.d and /var/lib/shorewall/. These are described in the sub-sections that follow.

Important

Since Shorewall 4.5.2, each of these directories is now relocatable using the configure scripts included with Shorewall Core. These scripts set shell variables in the shorewallrc file which is normally installed in /usr/share/shorewall/. The name of the variable is included in parentheses in the section headings below.

/sbin ($SBINDIR)

The /sbin/shorewall shell program is used to interact with Shorewall. See shorewall(8).

/usr/share/shorewall (${SHAREDIR}/shorewall)

The bulk of Shorewall is installed here.

  • action.template - template file for creating actions.

  • action.* - standard Shorewall actions.

  • actions.std - file listing the standard actions.

  • compiler.pl - The configuration compiler perl program.

  • configfiles - A directory containing configuration files to copy to create a Shorewall-lite export directory.

  • configpath - A file containing distribution-specific path assignments.

  • firewall - A shell program that handles the add and delete commands (see shorewall(8)). It also handles the stop and clear commands when there is no current compiled firewall script on the system.

  • functions - A symbolic link to lib.base that provides for compatibility with older versions of Shorewall.

  • init - A symbolic link to the init script (usually /etc/init.d/shorewall).

  • lib.* - Shell function libraries used by the other shell programs. Most of these are actually provided by Shorewall-core.

  • macro.* - The standard Shorewall macros.

  • modules.* - File that drives the loading of Netfilter kernel modules. May be overridden by /etc/shorewall/modules.

  • prog.* - Shell program fragments used as input to the compiler.

  • Shorewall - Directory containing the Shorewall Perl modules used by the compiler.

  • shorewallrc - A file that specifies where all of the other installed components (from all packages) are installed.

  • version - A file containing the currently install version of Shorewall.

  • wait4ifup - A shell program that extension scripts can use to delay until a network interface is available.

/etc/shorewall (${CONFDIR}/shorewall)

This is where the modifiable IPv4 configuration files are installed.

/etc/init.d or /etc/rc.d (depends on distribution) ($INITDIR) or /lib/systemd/system ($SERVICEDIR)

An init script is installed here. Depending on the distribution, it is named shorewall or rc.firewall. Only installed on systems where systemd is not installed.

When systemd is installed, the Shorewall .service files are installed in the directory specified by the SERVICEDIR variable in /usr/share/shorewall/shorewallrc.

/var/lib/shorewall (${VARLIB}/shorewall)

Shorewall doesn't install any files in this directory but rather uses the directory for storing state information. This directory may be relocated using shorewall-vardir(5).

  • .iptables-restore-input - The file passed as input to the iptables-restore program to initialize the firewall during the last start or restart command (see shorewall(8)).

  • .modules - The contents of the modules file used during the last start or restart command (see shorewall(8) for command information).

  • .modulesdir - The MODULESDIR setting (shorewall.conf(5)) at the last start or restart.

  • nat - This unfortunately-named file records the IP addresses added by ADD_SNAT_ALIASES=Yes and ADD_IP_ALIASES=Yes in shorewall.conf(5).

  • proxyarp - Records the arp entries added by entries in shorewall-proxyarp(5).

  • .refresh - The shell program that performed the last successful refresh command.

  • .restart - The shell program that performed the last successful restart command.

  • restore - The default shell program used to execute restore commands.

  • .restore - The shell program that performed the last successful refresh, restart or start command.

  • save - File created by the save command and used to restore the dynamic blacklist during start/restart.

  • .start - The shell program that performed the last successful start command.

  • state - Records the current firewall state.

  • zones - Records the current zone contents.

Shorewall6

Shorewall6 installs its files in a number of directories:

/sbin ($SBINDIR)

Prior to Shorewall 5.1.0, the /sbin/shorewall6 shell program is used to interact with Shorewall6. See shorewall6(8). Beginning with Shorewall 5.1.0, /sbin/shorewall6 is a symbolic link to /sbin/shorewall. See shorewall(8).

/usr/share/shorewall6 (${SHAREDIR}/shorewall6)

The bulk of Shorewall6 is installed here.

  • action.template - template file for creating actions.

  • action.* - standard Shorewall actions.

  • actions.std - file listing the standard actions.

  • configfiles - A directory containing configuration files to copy to create a Shorewall6-lite export directory.

  • configpath - A file containing distribution-specific path assignments.

  • firewall - A shell program that handles the add and delete commands (see shorewall(8)). It also handles the stop and clear commands when there is no current compiled firewall script on the system.

  • functions - A symbolic link to lib.base that provides for compatibility with older versions of Shorewall.

  • lib.* - Shell function libraries used by the other shell programs.

  • Macros/* - The standard Shorewall6 macros.

  • modules - File that drives the loading of Netfilter kernel modules. May be overridden by /etc/shorewall/modules.

  • version - A file containing the currently install version of Shorewall.

  • wait4ifup - A shell program that extension scripts can use to delay until a network interface is available.

/etc/shorewall6 (${CONFDIR}/shorewall6)

This is where the modifiable IPv6 configuration files are installed.

/etc/init.d or /etc/rc.d (depends on distribution) ($INITDIR) or /lib/systemd/system ($SERVICEDIR)

An init script is installed here. Depending on the distribution, it is named shorewall6 or rc.firewall. Only installed on systems where systemd is not installed.

When systemd is installed, the Shorewall .service files are installed in the directory specified by the SERVICEDIR variable in /usr/share/shorewall/shorewallrc.

/var/lib/shorewall6 (${VARLIB}/shorewall6)

Shorewall6 doesn't install any files in this directory but rather uses the directory for storing state information. This directory may be relocated using shorewall-vardir(5).

  • .ip6tables-restore-input - The file passed as input to the ip6tables-restore program to initialize the firewall during the last start or restart command (see shorewall6(8)).

  • .modules - The contents of the modules file used during the last start or restart command (see shorewall(8) for command information).

  • .modulesdir - The MODULESDIR setting (shorewall.conf(5)) at the last start or restart.

  • .refresh - The shell program that performed the last successful refresh command.

  • .restart - The shell program that performed the last successful restart command.

  • restore - The default shell program used to execute restore commands.

  • .restore - The shell program that performed the last successful refresh, restart or start command.

  • save - File created by the save command and used to restore the dynamic blacklist during start/restart.

  • .start - The shell program that performed the last successful start command.

  • state - Records the current firewall state.

  • zones - Records the current zone contents.

Shorewall-lite

The Shorewall-lite product includes files installed in /sbin, /usr/share/shorewall-lite, /etc/shorewall-lite, /etc/init.d and /var/lib/shorewall-lite/. These are described in the sub-sections that follow.

/sbin ($SBINDIR)

The /sbin/shorewall-lite shell program is used to interact with Shorewall lite. See shorewall-lite(8). Beginning with Shorewall 5.1.0, /sbin/shorewall-lite is a symbolic link to /sbin/shorewall. See shorewall(8).

/etc/init.d or /etc/rc.d (depends on distribution) ($INITDIR) or /lib/systemd/system ($SERVICEDIR)

An init script is installed here. Depending on the distribution, it is named shorewall-lite or rc.firewall. Only installed on systems where systemd is not installed.

When systemd is installed, the Shorewall .service files are installed in the directory specified by the SERVICEDIR variable in /usr/share/shorewall/shorewallrc.

/etc/shorewall-lite (${CONFDIR}/shorewall-lite)

This is where the modifiable configuration files are installed.

/usr/share/shorewall-lite (${SHAREDIR}/shorewall-lite)

The bulk of Shorewall-lite is installed here.

  • configpath - A file containing distribution-specific path assignments.

  • functions - A symbolic link to lib.base that provides for compatibility with older versions of Shorewall.

  • lib.base - Shell function librarie used by the other shell programs. This is a thin wrapper around /usr/share/shorewall/lib.base.

  • modules* - Files that drive the loading of Netfilter kernel modules. May be overridden by /etc/shorewall-lite/modules.

  • shorecap - A shell program used for generating capabilities files. See the Shorewall-lite documentation.

  • version - A file containing the currently install version of Shorewall.

  • wait4ifup - A shell program that extension scripts can use to delay until a network interface is available.

/var/lib/shorewall-lite (${VARLIB}/shorewall-lite)

Shorewall-lite doesn't install any files in this directory but rather uses the directory for storing state information. This directory may be relocated using shorewall-lite-vardir(5).

  • firewall - Compiled shell script installed by running the load or reload command on the administrative system (see shorewall(8)).

  • firewall.conf - Digest of the shorewall.conf file used to compile the firewall script on the administrative system.

  • .iptables-restore-input - The file passed as input to the iptables-restore program to initialize the firewall during the last start or restart command (see shorewall-lite(8)).

  • .modules - The contents of the modules file used during the last start or restart command (see shorewall-lite(8) for command information).

  • .modulesdir - The MODULESDIR setting (shorewall.conf(5)) at the last start or restart.

  • nat - This unfortunately-named file records the IP addresses added by ADD_SNAT_ALIASES=Yes and ADD_IP_ALIASES=Yes in shorewall.conf(5).

  • proxyarp - Records the arp entries added by entries in shorewall-proxyarp(5).

  • .refresh - The shell program that performed the last successful refresh command.

  • .restart - The shell program that performed the last successful restart command.

  • restore - The default shell program used to execute restore commands.

  • .restore - The shell program that performed the last successful refresh, restart or start command.

  • save - File created by the save command and used to restore the dynamic blacklist during start/restart.

  • .start - The shell program that performed the last successful start command.

  • state - Records the current firewall state.

  • zones - Records the current zone contents.

Shorewall6-lite

The Shorewall6-lite product includes files installed in /sbin, /usr/share/shorewall6-lite, /etc/shorewall6-lite, /etc/init.d and /var/lib/shorewall6-lite/. These are described in the sub-sections that follow.

/sbin

The /sbin/shorewall6-lite shell program is use to interact with Shorewall lite. See shorewall6-lite(8). Beginning with Shorewall 5.1.0, /sbin/shorewall6-lite is a symbolic link to /sbin/shorewall. See shorewall(8).

/etc/init.d or /etc/rc.d (depends on distribution) ($INITDIR) or /lib/systemd/system ($SERVICEDIR)

An init script is installed here. Depending on the distribution, it is named shorewall6-lite or rc.firewall. Only installed on systems where systemd is not installed.

When systemd is installed, the Shorewall .service files are installed in the directory specified by the SERVICEDIR variable in /usr/share/shorewall/shorewallrc.

/etc/shorewall6-lite (${CONFDIR}/shorewall6-lite)

This is where the modifiable configuration files are installed.

/usr/share/shorewall6-lite (${SHAREDIR}/shorewall6-lite)

The bulk of Shorewall-lite is installed here.

  • configpath - A file containing distribution-specific path assignments.

  • functions - A symbolic link to lib.base that provides for compatibility with older versions of Shorewall.

  • lib.base - Shell function librarie used by the other shell programs. This is a thin wrapper around /usr/share/shorewall/lib.base.

  • modules* - Files that drive the loading of Netfilter kernel modules. May be overridden by /etc/shorewall-lite/modules.

  • shorecap - A shell program used for generating capabilities files. See the Shorewall-lite documentation.

  • version - A file containing the currently install version of Shorewall.

  • wait4ifup - A shell program that extension scripts can use to delay until a network interface is available.

/var/lib/shorewall6-lite (${VARLIB}/shorewall6-lite)

Shorewall6-lite doesn't install any files in this directory but rather uses the directory for storing state information. This directory may be relocated using shorewall-lite-vardir(5).

  • firewall - Compiled shell script installed by running the load or reload command on the administrative system (see shorewall6(8)).

  • firewall.conf - Digest of the shorewall.conf file used to compile the firewall script on the administrative system.

  • .ip6tables-restore-input - The file passed as input to the ip6tables-restore program to initialize the firewall during the last start or restart command (see shorewall-lite(8)).

  • .modules - The contents of the modules file used during the last start or restart command (see shorewall-lite(8) for command information).

  • .modulesdir - The MODULESDIR setting (shorewall.conf(5)) at the last start or restart.

  • .refresh - The shell program that performed the last successful refresh command.

  • .restart - The shell program that performed the last successful restart command.

  • restore - The default shell program used to execute restore commands.

  • .restore - The shell program that performed the last successful refresh, restart or start command.

  • save - File created by the save command and used to restore the dynamic blacklist during start/restart.

  • .start - The shell program that performed the last successful start command.

  • state - Records the current firewall state.

  • zones - Records the current zone contents.

Documentation


Frequently Used Articles

- FAQs - IPv4 Manpages - IPv6 Manpages - Configuration File Basics - Beginner Documentation - Troubleshooting

Shorewall 4.4/4.5/4.6 Documentation

Shorewall 4.0/4.2 Documentation


Shorewall 5.0 HOWTOs and Other Articles

- 6to4 and 6in4 Tunnels - Accounting - Actions - Aliased (virtual) Interfaces (e.g., eth0:0) - Anatomy of Shorewall - Anti-Spoofing Measures - AUDIT Target support - Bandwidth Control - Blacklisting/Whitelisting - Bridge/Firewall - Building Shorewall from GIT - Commands - Compiled Programs - Configuration File Basics - DHCP - DNAT - Docker - Dynamic Zones - ECN Disabling by host or subnet - Events - Extension Scripts - Fallback/Uninstall - FAQs - Features - Fool's Firewall - Forwarding Traffic on the Same Interface - FTP and Shorewall - Helpers/Helper Modules - Installation/Upgrade - IPP2P - IPSEC - Ipsets - IPv6 Support - ISO 3661 Country Codes - Kazaa Filtering - Kernel Configuration - KVM (Kernel-mode Virtual Machine) - Limiting Connection Rates - Linux Containers (LXC) - Linux-vserver - Logging - Macros - MAC Verification - Manpages (IPv4) (IPv6) - Manual Chains - Masquerading - Multiple Internet Connections from a Single Firewall - Multiple Zones Through One Interface - My Shorewall Configuration - Netfilter Overview - Network Mapping - No firewalling of traffic between bridge port - One-to-one NAT - Operating Shorewall - OpenVPN - OpenVZ - Packet Marking - Packet Processing in a Shorewall-based Firewall - 'Ping' Management - Port Forwarding - Port Information - Port Knocking (deprecated) - Port Knocking, Auto Blacklisting and Other Uses of the 'Recent Match' - PPTP - Proxy ARP - QuickStart Guides - Release Model - Requirements - Routing and Shorewall - Routing on One Interface - Samba - Shorewall Events - Shorewall Init - Shorewall Lite - Shorewall on a Laptop - Shorewall Perl - Shorewall Setup Guide - SMB - SNAT - Split DNS the Easy Way - Squid with Shorewall - Starting/stopping the Firewall - Static (one-to-one) NAT - Support - Tips and Hints - Traffic Shaping/QOS - Simple - Traffic Shaping/QOS - Complex - Transparent Proxy - UPnP - Upgrade Issues - Upgrading to Shorewall 4.4 (Upgrading Debian Lenny to Squeeze) - VPN - VPN Passthrough - White List Creation - Xen - Shorewall in a Bridged Xen DomU - Xen - Shorewall in Routed Xen Dom0

Top of Page