<\/a> <\/h2>\nThe interfaces file serves to define the firewall’s network interfaces to Shorewall. The order of entries in this file is not significant in determining zone composition.<\/p>\n
Beginning with Shorewall 4.5.3, the interfaces file supports two different formats:<\/p>\n
FORMAT 1 (default \u2212 deprecated)<\/p>\n
There is a BROADCAST column which can be used to specify the broadcast address associated with the interface.<\/p>\n
FORMAT 2<\/p>\n
The BROADCAST column is omitted.<\/p>\n
The format is specified by a line as follows:<\/p>\n
?FORMAT {1|2}<\/b><\/p>\n
The columns in the file are as follows.<\/p>\n
ZONE<\/b> \u2212 zone\u2212name<\/i><\/p>\n
Zone for this interface. Must match the name of a zone declared in \/etc\/shorewall\/zones. You may not list the firewall zone in this column.<\/p>\n
If the interface serves multiple zones that will be defined in the shorewall\u2212hosts<\/font><\/b> [1]<\/font><\/small> (5) file, you should place “\u2212” in this column.<\/font><\/p>\nIf there are multiple interfaces to the same zone, you must list them in separate entries.<\/font><\/p>\nExample:<\/font><\/p>\n#ZONE INTERFACE BROADCAST
loc eth1 \u2212
loc eth2 \u2212<\/font><\/p>\nINTERFACE<\/b> \u2212 interface<\/i>[:<\/b>port<\/i>]<\/b><\/font><\/p>\nLogical name of interface. Each interface may be listed only once in this file. You may NOT specify the name of a “virtual” interface (e.g., eth0:0) here; see<\/font> https:\/\/shorewall.org\/FAQ.htm#faq18<\/font><\/b> [2]<\/font><\/small> . If the physical<\/b> option is not specified, then the logical name is also the name of the actual interface.<\/font><\/p>\nYou may use wildcards here by specifying a prefix followed by the plus sign (“+”). For example, if you want to make an entry that applies to all PPP interfaces, use ‘ppp+’; that would match ppp0, ppp1, ppp2, …<\/font><\/p>\nWhen using Shorewall versions before 4.1.4, care must be exercised when using wildcards where there is another zone that uses a matching specific interface. See<\/font> shorewall\u2212nesting<\/font><\/b> [3]<\/font><\/small> (5) for a discussion of this problem.<\/font><\/p>\nShorewall allows ‘+’ as an interface name, but that usage is deprecated. A better approach is to specify ‘physical<\/b>=+’ in the OPTIONS column (see below).<\/font><\/p>\nThere is no need to define the loopback interface (lo) in this file.<\/font><\/p>\nIf a port<\/i> is given, then the interface<\/i> must have been defined previously with the bridge<\/b> option. The OPTIONS column may not contain the following options when a port<\/i> is given.<\/font><\/p>\narp_filter
arp_ignore
bridge
log_martians
mss
optional
proxyarp
required
routefilter
sourceroute
upnp
wait<\/font><\/p>\nBeginning with Shorewall 4.5.17, if you specify a zone for the ‘lo’ interface, then that zone must be defined as type local<\/b> in<\/font> shorewall6\u2212zones<\/font><\/b> [4]<\/font><\/small> (5).<\/font><\/p>\nBROADCAST<\/b> (Optional) \u2212 {\u2212<\/b>|detect<\/b>|address<\/i>[,address<\/i>]…}<\/font><\/p>\nOnly available if FORMAT 1.<\/font><\/p>\nIf you use the special value detect<\/b>, Shorewall will detect the broadcast address(es) for you if your iptables and kernel include Address Type Match support.<\/font><\/p>\nIf your iptables and\/or kernel lack Address Type Match support then you may list the broadcast address(es) for the network(s) to which the interface belongs. For P\u2212T\u2212P interfaces, this column is left blank. If the interface has multiple addresses on multiple subnets then list the broadcast addresses as a comma\u2212separated list.<\/font><\/p>\nIf you don’t want to give a value for this column but you want to enter a value in the OPTIONS column, enter \u2212<\/b> in this column.<\/font><\/p>\nOPTIONS<\/b> (Optional) \u2212 [option<\/i>[,<\/b>option<\/i>]…]<\/font><\/p>\nA comma\u2212separated list of options from the following list. The order in which you list the options is not significant but the list should have no embedded white\u2212space.<\/font><\/p>\naccept_ra<\/b>[={0|1|2}]<\/font><\/p>\nIPv6 only; added in Shorewall 4.5.16. Values are:<\/font><\/p>\n0<\/font><\/p>\nDo not accept Router Advertisements.<\/font><\/p>\n1<\/font><\/p>\nAccept Route Advertisements if forwarding is disabled.<\/font><\/p>\n2<\/font><\/p>\nOverrule forwarding behavior. Accept Route Advertisements even if forwarding is enabled.<\/font><\/p>\nIf the option is specified without a value, then the value 1 is assumed.<\/font><\/p>\nNote<\/big><\/b>
This option does not work with a wild\u2212card physical<\/b> name (e.g., eth0.+). Beginning with Shorewall 5.1.10, If this option is specified, a warning is issued and the option is ignored.<\/font><\/p>\narp_filter[={0|1}]<\/big><\/b><\/font><\/p>\nIPv4 only. If specified, this interface will only respond to ARP who\u2212has requests for IP addresses configured on the interface. If not specified, the interface can respond to ARP who\u2212has requests for IP addresses on any of the firewall’s interface. The interface must be up when Shorewall is started.<\/big><\/font><\/p>\nOnly those interfaces with the arp_filter<\/b> option will have their setting changed; the value assigned to the setting will be the value specified (if any) or 1 if no value is given.<\/big><\/font><\/p>\nNote<\/big><\/b>
This option does not work with a wild\u2212card physical<\/b> name (e.g., eth0.+). Beginning with Shorewall 5.1.10, If this option is specified, a warning is issued and the option is ignored.<\/big><\/font><\/p>\narp_ignore<\/big><\/b>[=number<\/i>]<\/big><\/big><\/font><\/p>\nIPv4 only. If specified, this interface will respond to arp requests based on the value of number<\/i> (defaults to 1).<\/big><\/big><\/font><\/p>\n1 \u2212 reply only if the target IP address is local address configured on the incoming interface<\/big><\/big><\/font><\/p>\n2 \u2212 reply only if the target IP address is local address configured on the incoming interface and the sender’s IP address is part from same subnet on this interface’s address<\/big><\/big><\/font><\/p>\n3 \u2212 do not reply for local addresses configured with scope host, only resolutions for global and link<\/big><\/big><\/font><\/p>\n4\u22127 \u2212 reserved<\/big><\/big><\/font><\/p>\n8 \u2212 do not reply for all local addresses<\/big><\/big><\/font><\/p>\nNote<\/big><\/b>
This option does not work with a wild\u2212card physical<\/b> name (e.g., eth0.+). Beginning with Shorewall 5.1.10, If this option is specified, a warning is issued and the option is ignored.<\/big><\/big><\/font><\/p>\nWarning<\/big><\/b>
Do not specify arp_ignore<\/b> for any interface involved in<\/big><\/big><\/font> Proxy ARP<\/font><\/b><\/big> [5] .<\/big><\/font><\/big><\/p>\nblacklist<\/big><\/b><\/big><\/font><\/big><\/p>\nChecks packets arriving on this interface against the<\/big><\/big><\/font> shorewall\u2212blacklist<\/font><\/b><\/big> [6] (5) file.<\/big><\/font><\/big><\/big><\/p>\nBeginning with Shorewall 4.4.13:<\/big><\/font><\/big><\/big><\/p>\n\u2022 If a zone<\/i> is given in the ZONES column, then the behavior is as if blacklist<\/b> had been specified in the IN_OPTIONS column of<\/big><\/font> shorewall\u2212zones<\/font><\/b><\/big> [4] (5).<\/big><\/font><\/big><\/big><\/p>\n\u2022 Otherwise, the option is ignored with a warning: WARNING: The ‘blacklist’ option is ignored on multi\u2212zone interfaces<\/b><\/big><\/font><\/big><\/big><\/p>\nbridge<\/b><\/big><\/font><\/big><\/big><\/p>\nDesignates the interface as a bridge. Beginning with Shorewall 4.4.7, setting this option also sets routeback<\/b>.<\/big><\/font><\/big><\/big><\/p>\nNote<\/big><\/b>
If you have a bridge that you don’t intend to define bport zones on, then it is best to omit this option and simply specify routeback<\/b>.<\/big><\/font><\/big><\/big><\/p>\ndbl={none|src|dst|src\u2212dst}<\/big><\/b><\/big><\/font><\/big><\/big><\/p>\nAdded in Shorewall 5.0.10. This option defined whether or not dynamic blacklisting is applied to packets entering the firewall through this interface and whether the source address and\/or destination address is to be compared against the ipset\u2212based dynamic blacklist (DYNAMIC_BLACKLIST=ipset… in<\/big><\/big><\/font> shorewall.conf(5)<\/font><\/b><\/big> [7] ). The default is determine by the setting of DYNAMIC_BLACKLIST:<\/big><\/font><\/big><\/big><\/big><\/p>\nDYNAMIC_BLACKLIST=No<\/big><\/font><\/big><\/big><\/big><\/p>\nDefault is none<\/b> (e.g., no dynamic blacklist checking).<\/big><\/font><\/big><\/big><\/big><\/p>\nDYNAMIC_BLACKLIST=Yes<\/big><\/font><\/big><\/big><\/big><\/p>\nDefault is src<\/b> (e.g., the source IP address is checked).<\/big><\/font><\/big><\/big><\/big><\/p>\nDYNAMIC_BLACKLIST=ipset[\u2212only]<\/big><\/font><\/big><\/big><\/big><\/p>\nDefault is src<\/b>.<\/big><\/font><\/big><\/big><\/big><\/p>\nDYNAMIC_BLACKLIST=ipset[\u2212only],src\u2212dst…<\/big><\/font><\/big><\/big><\/big><\/p>\nDefault is src\u2212dst<\/b> (e.g., the source IP addresses in checked against the ipset on input and the destination IP address is checked against the ipset on packets originating from the firewall and leaving through this interface).<\/big><\/font><\/big><\/big><\/big><\/p>\nThe normal setting for this option will be dst<\/b> or none<\/b> for internal interfaces and src<\/b> or src\u2212dst<\/b> for Internet\u2212facing interfaces.<\/big><\/font><\/big><\/big><\/big><\/p>\ndestonly<\/b><\/big><\/font><\/big><\/big><\/big><\/p>\nAdded in Shorewall 4.5.17. Causes the compiler to omit rules to handle traffic from this interface.<\/big><\/font><\/big><\/big><\/big><\/p>\ndhcp<\/b><\/big><\/font><\/big><\/big><\/big><\/p>\nSpecify this option when any of the following are true:<\/big><\/font><\/big><\/big><\/big><\/p>\n1. the interface gets its IP address via DHCP<\/big><\/font><\/big><\/big><\/big><\/p>\n