Shoreline Firewall (Shorewall)

--- Tom Eastep <teastep@...> wrote:
> > Shorewall 3.3.5
> 
>  Note to users upgrading from Shorewall 3.0 or 3.3

3.0 or 3.2, I suppose (not really worth reporting
anyway).



 
____________________________________________________________________________________
Sponsored Link

Don't quit your job - take classes online
 http://www.Classesusa.com

Vieri Di Paola wrote:
> --- Tom Eastep <teastep@...> wrote:
>>> Shorewall 3.3.5
>>  Note to users upgrading from Shorewall 3.0 or 3.3
>=20
> 3.0 or 3.2, I suppose (not really worth reporting
> anyway).

Thanks -- I saw that also but hadn't yet fixed it.

-Tom
--=20
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@...
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key

--- Tom Eastep <teastep@...> wrote:

> Shorewall 3.3.5 is now available for testing. This
> version includes
> manpages and I would appreciate it if folks would
> help be proofread them.

shorewall-actions.5:

If you intend to log from the action
then the name must be no longer than 11 character in
length. 
->
(11 characters)

***

blacklist.5:
Host address, network address, MAC address, IP address
range
(if your kernel and iptables contain iprange match
support) or ipset
name prefaced by "+" (i your kernel supports ipset
match).
->
(if your kernel supports ipset match).

Example 2:
To block some of the nuisance applicataion:
->
To block some of the nuisance applications:

***

hosts.5:
This port must not be defined in
shorewall-interfaces(5) and may optionally followed by
a colon
->
This port must not be defined in
shorewall-interfaces(5) and may optionally be followed
by a colon




 
____________________________________________________________________________________
Sponsored Link

Mortgage rates near 39yr lows. 
$420k for $1,399/mo. Calculate new payment! 
 http://www.LowerMyBills.com/lre

--- Tom Eastep <teastep@...> wrote:

> Shorewall 3.3.5 is now available for testing. This
> version includes
> manpages and I would appreciate it if folks would
> help be proofread them.

interfaces.5:

Do NOT use this option if you are employing Proxy ARP
through
entries in shorewall-proxyarp(5). This option is
intended
soley for use with
->
solely for use with

[...]

Only set this option if you know what you are you
doing. 
->
Only set this option if you know what you are doing. 

masq.5:

In order to exclude a addrress of the specified
SOURCE, 
->
In order to exclude an address of the specified
SOURCE, 

Example 4:
[...}
address of eth0. You want 206.124.146.176 added to be
added to eth0
with name eth0:0.
->
Example 4:
[...]
address of eth0. You want 206.124.146.176 to be added
to eth0
with name eth0:0.

policy.5:

For $FW and for all of the zoned defined in
/etc/shorewall/zones,
->
For $FW and for all of the zones defined in
/etc/shorewall/zones,

NONE
[...]Shorewall will not create any
infrastructure to handle such packets and you may not
have any
rules with this SOURCE and DEST in the
/etc/shorewall/rules
file such a packet _is_ received, the result is
undefined.
-> ?
. If such a packet _is_ received

You may also specify ULOG (must be in upper case).
This will
log to the ULOG target and sent to a separate log
through use of
->
You may also specify ULOG (must be in upper case).
This will
log to the ULOG target and will send to a separate log
through use of




 
____________________________________________________________________________________
Sponsored Link

$420k for $1,399/mo. 
Think You Pay Too Much For Your Mortgage? 
Find Out! http://www.LowerMyBills.com/lre

--- Tom Eastep <teastep@...> wrote:

> Shorewall 3.3.5 is now available for testing. This
> version includes
> manpages and I would appreciate it if folks would
> help be proofread them.

providers.5:

COPY
A comma-separated lists of other interfaces on your
firewall.
->
COPY
A comma-separated list of other interfaces on your
firewall.

route_rules.5:

Example 2:
[...]
 10.8.0.0/24
is the subnet choosen in your OpenVPN configuration 
->
Example 2:
[...]
 10.8.0.0/24
is the subnet chosen in your OpenVPN configuration 

rules.5:

the rest of the line will be attached as a comment to
the Netfilter rule(s) generated by the following
entres.
->
the rest of the line will be attached as a comment to
the Netfilter rule(s) generated by the following
entries.

If you kernel and iptables have ipset match support 
->
If your kernel and iptables have ipset match support 




 
____________________________________________________________________________________
Sponsored Link

Mortgage rates near 39yr lows. 
$420k for $1,399/mo. Calculate new payment! 
 http://www.LowerMyBills.com/lre

Thanks, Vieri!

I've corrected the manpages in SVN.

-Tom
--=20
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@...
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key

--- Tom Eastep <teastep@...> wrote:

> Shorewall 3.3.5 is now available for testing. This
> version includes
> manpages and I would appreciate it if folks would
> help be proofread them.

tcclasses.5

The mark value which is an integer in the range 1-255.
You
define this marks in the tcrules file, marking the
traffic you want
to fit in the classes defined in here.
->
The mark value which is an integer in the range 1-255.
You
define this mark in the tcrules file, marking the
traffic you want
to fit in the classes defined in here.


 If the sum of the rates in this column exceed the
INTERFACE's OUT-BANDWIDTH
->
 If the sum of the rates in this column exceeds the
INTERFACE's OUT-BANDWIDTH


Please note note classifiers override all
mark settings
->
Please note classifiers override all
mark settings


Each of this options is only valid for ONE class per
interface.
->
Each of these options is only valid for ONE class per
interface.


If defined causes an tc filter to be created that puts
all tcp ack packets on that interface that have an
size of
<=64 Bytes to go in this class. 
->
If defined causes a tc filter to be created that puts
all tcp ack packets on that interface that have a size
of
<=64 Bytes to go in this class.


Please note that the size of the ack packets is
limited to 64 bytes as some applications (p2p for
example) use
to make every packet an ack packet which would cause
them all
into here.
->
(the end of the sentence might need rephrasing because
it's not clear - to me)




 
____________________________________________________________________________________
Sponsored Link

$200,000 mortgage for $660/ mo - 
30/15 yr fixed, reduce debt - 
http://yahoo.ratemarketplace.com

Thanks, again.

-Tom
--=20
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@...
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key

--- Tom Eastep <teastep@...> wrote:

> Thanks, again.

Actually, I'm thanking you for setting up man pages.

tcdevices.5

You man NOT specify wildcards here, e.g. if you have
multiple
ppp interfaces, you need to put them all in here!
->
You must NOT specify wildcards here, e.g. if you have
multiple
ppp interfaces, you need to put them all in here!


The outgoing Bandwidth of that interface. This is the
maximum
speed you connection can handle.
->
The outgoing Bandwidth of that interface. This is the
maximum
speed your connection can handle.


tcrules.5

We assume packet/connection mark 0 to means
unclassified.
->
We assume packet/connection mark 0 means
unclassified.


zones.5

Communication with all zone hosts is encrypted. Your
kernel and iptables must include polic match support.
->
Communication with all zone hosts is encrypted. Your
kernel and iptables must include policy match support.


No options ar permitted with a 'firewall'
zone. 
->
No options are permitted with a 'firewall'
zone. 


shorewall.8

The use of -e requires the presense
of a configuration file named capabilities
->
The use of -e requires the presence
of a configuration file named capabilities


Monitors the log file specified by theLOGFILE option
in
shorewall.conf
->
Monitors the log file specified by the LOGFILE option
in
shorewall.conf


The rules involving the the black list, ECN control
rules, and
->
The rules involving the black list, ECN control rules,
and





 
____________________________________________________________________________________
Sponsored Link

Online degrees - find the right program to advance your career. 
 http://www.nextag.com

Vieri Di Paola wrote:
>=20
> --- Tom Eastep <teastep@...> wrote:
>=20
>> Thanks, again.
>=20
> Actually, I'm thanking you for setting up man pages.
>=20

You are welcome.

-Tom
--=20
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@...
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key

On Sun, 2006-11-19 at 15:26, Tom Eastep wrote:
> Shorewall 3.3.5 is now available for testing. This version includes
> manpages and I would appreciate it if folks would help be proofread them.

Tom,
Are you using DocBook XML for the man page source, or something else?

-- 
Mike Noyes <mhnoyes at users.sourceforge.net>
http://sourceforge.net/users/mhnoyes/
SF.net Projects: leaf, phpwebsite, phpwebsite-comm, sitedocs

Mike Noyes wrote:
> On Sun, 2006-11-19 at 15:26, Tom Eastep wrote:
>> Shorewall 3.3.5 is now available for testing. This version includes
>> manpages and I would appreciate it if folks would help be proofread th=
em.
>=20
> Tom,
> Are you using DocBook XML for the man page source, or something else?
>=20
Mike,

I'm using DocBook XML

-Tom
--=20
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@...
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key

On Thu, 2006-11-23 at 07:37, Tom Eastep wrote:
> Mike Noyes wrote:
> > On Sun, 2006-11-19 at 15:26, Tom Eastep wrote:
> >> Shorewall 3.3.5 is now available for testing. This version includes
> >> manpages and I would appreciate it if folks would help be proofread them.
> > 
> > Tom,
> > Are you using DocBook XML for the man page source, or something else?
> > 
> Mike,
> I'm using DocBook XML

Tom,
Excellent! :-)

Is the xml source available via uri? I'd like to try xincluding it into
the leaf-doc-set. I think remote file inclusion is possible during xslt,
but I may be incorrect.

        <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
        href="http://shorewall.net/???" />

-- 
Mike Noyes <mhnoyes at users.sourceforge.net>
http://sourceforge.net/users/mhnoyes/
SF.net Projects: leaf, phpwebsite, phpwebsite-comm, sitedocs

Mike Noyes wrote:
>
> Is the xml source available via uri?

No. The man pages are part of Shorewall 3.4 which will be released some
time next year.

-Tom
--=20
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@...
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key

On Thu, 2006-11-23 at 09:23, Tom Eastep wrote:
> Mike Noyes wrote:
> >
> > Is the xml source available via uri?
> 
> No. The man pages are part of Shorewall 3.4 which will be released some
> time next year.

Tom,
Understood. Thanks for answering my query. :-)

-- 
Mike Noyes <mhnoyes at users.sourceforge.net>
http://sourceforge.net/users/mhnoyes/
SF.net Projects: leaf, phpwebsite, phpwebsite-comm, sitedocs

Paul Gear wrote:
> Mike Noyes wrote:
>> On Thu, 2006-11-23 at 09:23, Tom Eastep wrote:
>>> Mike Noyes wrote:
>>>> Is the xml source available via uri?
>>> No. The man pages are part of Shorewall 3.4 which will be released so=
me
>>> time next year.
>> Tom,
>> Understood. Thanks for answering my query. :-)
>=20
> What about this URL?
>=20
> http://svn.sourceforge.net/viewvc/shorewall/trunk/manpages/
>=20
> Or this URL?
>=20
> https://svn.sourceforge.net/svnroot/shorewall/trunk/manpages/

Either of those will do fine when the time comes. But I don't want Mike
publishing Shorewall 3.4 man pages now on the Leaf Web site (which was
why he was asking).

-Tom
--=20
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@...
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key