NAME<\/a> names \u2212 Shorewall object names<\/p>\n When you define an object in Shorewall (Zone<\/font><\/b> [1]<\/font><\/small> , Logical Interface,<\/font> ipsets<\/font><\/b> [2]<\/font><\/small> ,<\/font> Actions<\/font><\/b> [3]<\/font><\/small> , etc., you give it a name. Shorewall names start with a letter and consist of letters, digits or underscores (“_”). Except for Zone names, Shorewall does not impose a limit on name length.<\/font><\/p>\n When an ipset is referenced, the name must be preceded by a plus sign (“+”).<\/font><\/p>\n The last character of an interface may also be a plus sign to indicate a wildcard name.<\/font><\/p>\n Physical interface names match names shown by ‘ip link ls’; if the name includes an at sign (“@”), do not include that character or any character that follows. For example, “sit1@NONE” is referred to as simply ‘sit1″.<\/font><\/p>\n For a pair of zones, Shorewall creates two Netfilter chains; one for connections in each direction. The names of these chains are formed by separating the names of the two zones by either “2” or “\u2212”.<\/font><\/p>\n Example: Traffic from zone A to zone B would go through chain A2B (think “A to B”) or “A\u2212B”.<\/font><\/p>\n In Shorewall 4.6, the default separator is “\u2212” but you can override that by setting ZONE_SEPARATOR=”2″ in<\/font> shorewall.conf<\/font><\/b> [4]<\/font><\/small> (5).<\/font><\/p>\n Note<\/big><\/b> Zones themselves have names that begin with a letter and are composed of letters, numerals, and “_”. The maximum length of a name is dependent on the setting of LOGFORMAT in<\/font> shorewall.conf<\/font><\/b> [4]<\/font><\/small> (5). See<\/font> shorewall\u2212zones<\/font><\/b> [1]<\/font><\/small> (5) for details.<\/font><\/p>\n Caution<\/big><\/b> Host addresses in Shorewall configuration files may be specified as either IP addresses or DNS Names.<\/font><\/p>\n DNS names in iptables rules aren’t nearly as useful as they first appear. When a DNS name appears in a rule, the iptables utility resolves the name to one or more IP addresses and inserts those addresses into the rule. So changes in the DNS\u2212>IP address relationship that occur after the firewall has started have absolutely no effect on the firewall’s rule set.<\/font><\/p>\n For some sites, using DNS names is very risky. Here’s an example:<\/font><\/p>\n teastep@ursa:~$ dig pop.gmail.com<\/font><\/p>\n ; <<>> DiG 9.4.2\u2212P1 <<>> pop.gmail.com ;; QUESTION SECTION: ;; ANSWER SECTION: Note that the TTL is 300 \u2212\u2212 300 seconds is only 5 minutes. So five minutes later, the answer may change!<\/font><\/p>\n So this rule may work for five minutes then suddently stop working:<\/font><\/p>\n #ACTION SOURCE DEST PROTO DPORT There are two options in<\/font> shorewall[6].conf(5)<\/font><\/b> [4]<\/font><\/small> that affect the use of DNS names in Shorewall[6] config files:<\/font><\/p>\n \u2022 DEFER_DNS_RESOLUTION \u2212 When set to No, DNS names are resolved at compile time; when set to Yes, DNS Names are resolved at runtime.<\/font><\/p>\n \u2022 AUTOMAKE \u2212 When set to Yes, start<\/b>, restart<\/b> and reload<\/b> only result in compilation if one of the files on the CONFIG_PATH has changed since the the last compilation.<\/font><\/p>\n So by setting AUTOMAKE=Yes, and DEFER_DNS_RESOLUTION=No, compilation will only take place at boot time if a change had been make to the config but no restart<\/b> or reload<\/b> had taken place. This is clearly spelled out in the shorewall.conf manpage. So with these settings, so long as a ‘reload’ or ‘restart’ takes place after the Shorewall configuration is changes, there should be no DNS\u2212related problems at boot time.<\/font><\/p>\n Important<\/big><\/b> If your firewall rules include DNS names then, even if DEFER_DNS_RESOLUTION=No and AUTOMAKE=Yes:<\/font><\/p>\n \u2022 If your \/etc\/resolv.confis wrong then your firewall may not start.<\/font><\/p>\n \u2022 If your \/etc\/nsswitch.conf is wrong then your firewall may not start.<\/font><\/p>\n \u2022 If your Name Server(s) is(are) down then your firewall may not start.<\/font><\/p>\n \u2022 If your startup scripts try to start your firewall before starting your DNS server then your firewall may not start.<\/font><\/p>\n \u2022 Factors totally outside your control (your ISP’s router is down for example), can prevent your firewall from starting.<\/font><\/p>\n \u2022 You must bring up your network interfaces prior to starting your firewall, or the firewall may not start.<\/font><\/p>\n Each DNS name must be fully qualified and include a minimum of two periods (although one may be trailing). This restriction is imposed by Shorewall to insure backward compatibility with existing configuration files.<\/font><\/p>\n Example\u00a01.\u00a0Valid DNS Names<\/b><\/font><\/p>\n \u2022 mail.shorewall.net<\/font><\/p>\n \u2022 shorewall.net. (note the trailing period).<\/font><\/p>\n Example\u00a02.\u00a0Invalid DNS Names<\/b><\/font><\/p>\n \u2022 mail (not fully qualified)<\/font><\/p>\n \u2022 shorewall.net (only one period)<\/font><\/p>\n DNS names may not be used as:<\/font><\/p>\n \u2022 The server address in a DNAT rule (\/etc\/shorewall\/rules file)<\/font><\/p>\n \u2022 In the ADDRESS column of an entry in \/etc\/shorewall\/masq.<\/font><\/p>\n \u2022<\/font><\/p>\n \u2022 In the \/etc\/shorewall\/nat file.<\/font><\/p>\n These restrictions are imposed by Netfilter and not by Shorewall.<\/font><\/p>\n When dealing with a complex configuration, it is often awkward to use physical interface names in the Shorewall configuration.<\/font><\/p>\n \u2022 You need to remember which interface is which.<\/font><\/p>\n \u2022 If you move the configuration to another firewall, the interface names might not be the same.<\/font><\/p>\n Beginning with Shorewall 4.4.4, you can use logical interface names which are mapped to the actual interface using the physical<\/b> option in<\/font> shorewall\u2212interfaces<\/font><\/b> [5]<\/font><\/small> (5).<\/font><\/p>\n Here is an example:<\/font><\/p>\n #ZONE INTERFACE OPTIONS In this example, COM_IF is a logical interface name that refers to Ethernet interface eth0, EXT_IF is a logical interface name that refers to Ethernet interface eth2, and so on.<\/font><\/p>\n Here are a couple of more files from the same configuration:<\/font><\/p>\n shorewall\u2212masq<\/font><\/b> [6]<\/font><\/small> (5):<\/font><\/p>\n #INTERFACE SOURCE ADDRESS<\/font><\/p>\n COMMENT Masquerade Local Network shorewall\u2212providers<\/font><\/b> [7]<\/font><\/small> (5)<\/font><\/p>\n #NAME NUMBER MARK DUPLICATE INTERFACE GATEWAY OPTIONS COPY Note in particular that Shorewall translates TUN_IF to tun* in the COPY column.<\/font><\/p>\n 1.<\/font><\/p>\n<\/td>\n Zone<\/font><\/p>\n<\/td>\n https:\/\/shorewall.org\/manpages\/shorewall-zones.html<\/font><\/p>\n 2.<\/font><\/p>\n<\/td>\n ipsets<\/font><\/p>\n<\/td>\n https:\/\/shorewall.org\/manpages\/ipsets.html<\/font><\/p>\n 3.<\/font><\/p>\n<\/td>\n Actions<\/font><\/p>\n<\/td>\n https:\/\/shorewall.org\/manpages\/Actions.html<\/font><\/p>\n 4.<\/font><\/p>\n<\/td>\n shorewall.conf<\/font><\/p>\n<\/td>\n https:\/\/shorewall.org\/manpages\/shorewall.conf.html<\/font><\/p>\n 5.<\/font><\/p>\n<\/td>\n shorewall-interfaces<\/font><\/p>\n<\/td>\n https:\/\/shorewall.org\/manpages\/shorewall-interfaces.html<\/font><\/p>\n 6.<\/font><\/p>\n<\/td>\n shorewall-masq<\/font><\/p>\n<\/td>\n https:\/\/shorewall.org\/manpages\/shorewall-masq.html<\/font><\/p>\n 7.<\/font><\/p>\n<\/td>\n shorewall-providers<\/font><\/p>\n<\/td>\n https:\/\/shorewall.org\/manpages\/shorewall-providers.html<\/font><\/p>\n names \u2212 Shorewall object names <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[959],"tags":[961,1291,1566],"class_list":["post-4625","post","type-post","status-publish","format-standard","hentry","category-5-formatos-de-ficheros","tag-961","tag-man5","tag-shorewall-names"],"gutentor_comment":0,"_links":{"self":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts\/4625","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/comments?post=4625"}],"version-history":[{"count":0,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts\/4625\/revisions"}],"wp:attachment":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/media?parent=4625"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/categories?post=4625"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/tags?post=4625"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
DESCRIPTION<\/a>
ZONE AND CHAIN NAMES<\/a>
USING DNS NAMES<\/a>
LOGICAL INTERFACE NAMES<\/a>
NOTES<\/a> <\/p>\n
\nNAME <\/a> <\/h2>\n
DESCRIPTION <\/a> <\/h2>\n
ZONE AND CHAIN NAMES <\/a> <\/h2>\n
Prior to Shorewall 4.6, the default separator was “2”.<\/font><\/p>\nUSING DNS NAMES <\/a> <\/h2>\n
I personally recommend strongly against using DNS names in Shorewall configuration files. If you use DNS names and you are called out of bed at 2:00AM because Shorewall won’t start as a result of DNS problems then don’t say that you were not forewarned.<\/font><\/p>\n
;; global options: printcmd
;; Got answer:
;; \u2212>>HEADER<<\u2212 opcode: QUERY, status: NOERROR, id: 1774
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 7, ADDITIONAL: 0<\/font><\/p>\n
;pop.gmail.com. IN A<\/font><\/p>\n
pop.gmail.com. 300<\/b> IN CNAME gmail\u2212pop.l.google.com.
gmail\u2212pop.l.google.com. 300<\/b> IN A 209.85.201.109
gmail\u2212pop.l.google.com. 300<\/b> IN A 209.85.201.111<\/font><\/p>\n
POP(ACCEPT) loc net:pop.gmail.com<\/font><\/p>\n
When DEFER_DNS_RESOLUTION=No and AUTOMAKE=Yes and a DNS change makes it necessary to recompile an existing firewall script, the \u2212c<\/b> option must be used with the reload<\/b> or restart<\/b> command to force recompilation.<\/font><\/p>\nLOGICAL INTERFACE NAMES <\/a> <\/h2>\n
net COM_IF<\/b> dhcp,blacklist,tcpflags,optional,upnp,routefilter=0,nosmurfs,logmartians=0,physical=eth0<\/b>
net EXT_IF<\/b> dhcp,blacklist,tcpflags,optional,routefilter=0,nosmurfs,logmartians=0,proxyarp=1,physical=eth2<\/b>
loc INT_IF<\/b> dhcp,logmartians=1,routefilter=1,tcpflags,nets=172.20.1.0\/24,physical=eth1<\/b>
dmz VPS_IF<\/b> logmartians=1,routefilter=0,routeback,physical=venet0<\/b>
loc TUN_IF physical=tun+<\/b><\/font><\/p>\n
COM_IF<\/b> 0.0.0.0\/0
EXT_IF<\/b> !206.124.146.0\/24 206.124.146.179:persistent<\/font><\/p>\n
Avvanta 1 0x10000 main EXT_IF<\/b> 206.124.146.254 loose,fallback INT_IF,VPS_IF,TUN_IF<\/b>
Comcast 2 0x20000 main COM_IF<\/b> detect balance INT_IF,VPS_IF,TUN_IF<\/b><\/font><\/p>\nNOTES <\/a> <\/h2>\n
\n
\n <\/td>\n \n <\/td>\n \n <\/td>\n<\/tr>\n<\/table>\n \n
\n <\/td>\n \n <\/td>\n \n <\/td>\n<\/tr>\n<\/table>\n \n
\n <\/td>\n \n <\/td>\n \n <\/td>\n<\/tr>\n<\/table>\n \n
\n <\/td>\n \n <\/td>\n \n <\/td>\n<\/tr>\n<\/table>\n \n
\n <\/td>\n \n <\/td>\n \n <\/td>\n<\/tr>\n<\/table>\n \n
\n <\/td>\n \n <\/td>\n \n <\/td>\n<\/tr>\n<\/table>\n \n
\n <\/td>\n \n <\/td>\n \n <\/td>\n<\/tr>\n<\/table>\n
\n","protected":false},"excerpt":{"rendered":"