Shoreline Firewall (Shorewall)

The Shorewall team is pleased to announce the availability of Shorewall
4.4.7 RC1.

The release is available at:

http://www.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.7-RC1

ftp://ftp.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.7-RC1

This release features a number of enhancements:

1)  The OPTIMIZE option value is now a bit-map with each bit
    controlling a separate set of optimizations.

    - The low-order bit (value 1) controls optimizations available in
      earlier releases. We refer to this optimization as "optimization
      1".

    - The next bit (value 2) suppresses superfluous ACCEPT rules in a
      policy chain that implements an ACCEPT policy. Any ACCEPT rules
      that immediately preceed the final blanket ACCEPT rule in the
      chain are now omitted. We refer to this optimization as
      "optimization 2".

    - The next bit (value 4 or "optimization 4") enables the following
      additional optimizations:

      a) Empty chains are optimized away.
      b) Chains with one rule are optimized away.
      c) If a built-in chain has a single rule that branches to a
         second chain, then the rules from the second chain are moved
         to the built-in chain and the target chain is omitted.
      d) Chains with no references are deleted.
      e) Accounting chains are subject to optimization if the new
         OPTIMIZE_ACCOUNTING option is set to 'Yes' (default is 'No').
      f) If a chain ends with an unconditional branch to a second chain
         (other than to 'reject'), then the branch is deleted from the
         first chain and the rules from the second chain are appended
         to it. 

      The following chains are exempted from optimization 4:

          action chains (user-created).
          accounting chains (unless OPTIMIZE_ACCOUNTING=Yes)
          dynamic
          forwardUPnP
          logdrop
          logreject
          rules chains (those of the form zonea2zoneb or zonea-zoneb).
          UPnP (nat table).

    To enable all possible optimizations, set OPTIMIZE to 7 (1 + 2 +
    4).

2)  Shorewall now combines identical logging chains. Previously, a
    separate chain was created for each logging rule.

3)  Beginning with Shorewall 4.4.7, accounting can be disabled by
    setting ACCOUNTING=No in shorewall.conf. This allows you to keep a
    set of accounting rules configured in /etc/shorewall/accounting and
    to then enable and disable them by simply toggling the setting of
    ACCOUNTING.

    Similarly, dynamic blacklisting can be disabled by setting
    DYNAMIC_BLACKLIST=No. This saves a jump rule in the INPUT
    and FORWARD filter chains..

4)  Shorewall can now automatically assign mark values to providers in
    cases where 'track' is specified (or TRACK_PROVIDERS=Yes) but
    packet marking is otherwise not used for directing connections to a
    particular provider. Simply specify '-' in the MARK column and
    Shorewall will automatically assign a mark value.

5)  Support for TPROXY has been added. See
    http://www.shorewall.net/Shorewall_Squid_Usage.html#TPROXY.

6)  Traditionally, Shorewall has loaded all modules that could possibly
    be needed twice; once in the compiler, and once when the generated
    script is initialized. The latter can be a time-consuming process
    on slow hardware.

    Beginning with 4.4.7, there is a LOAD_HELPERS_ONLY option in
    shorewall.conf. For existing users, LOAD_HELPERS_ONLY=No is the
    default.

    For new users that employ the sample configurations,
    LOAD_HELPERS_ONLY=Yes will be the default. That setting causes only
    a small subset of modules to be loaded; it is assumed that the
    remaining modules will be autoloaded. Additionally, capability
    detection in the compiler is deferred until each capability is
    actually used. As a consequence, no modules are autoloaded
    unnecessarily.

    Modules loaded when LOAD_HELPERS_ONLY=Yes are the protocol helpers. 
    These cannot be autoloaded.
     
    In addition, the nf_conntrack_sip module is loaded with
    sip_direct_media=0. This setting is slightly less secure than
    sip_direct_media=1, but it solves many VOIP problems that users
    routinely encounter.

-Tom

-- 
Tom Eastep        \ When I die, I want to go like my Grandfather who
Shoreline,         \ died peacefully in his sleep. Not screaming like
Washington, USA     \ all of the passengers in his car
http://shorewall.net \________________________________________________