1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
|
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
<article>
<!--$Id$-->
<articleinfo>
<title>Shorewall Version 4</title>
<authorgroup>
<author>
<firstname>Tom</firstname>
<surname>Eastep</surname>
</author>
</authorgroup>
<pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
<copyright>
<year>2007</year>
<year>2009</year>
<year>2015</year>
<holder>Thomas M. Eastep</holder>
</copyright>
<legalnotice>
<para>Permission is granted to copy, distribute and/or modify this
document under the terms of the GNU Free Documentation License, Version
1.2 or any later version published by the Free Software Foundation; with
no Invariant Sections, with no Front-Cover, and with no Back-Cover
Texts. A copy of the license is included in the section entitled
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation
License</ulink></quote>.</para>
</legalnotice>
</articleinfo>
<section id="Intro">
<title>Introduction</title>
<para>Shorewall version 4.0 represented a substantial shift in direction
for Shorewall. Up until then</para>
<itemizedlist>
<listitem>
<para>Shorewall had been written entirely in Bourne Shell.</para>
</listitem>
<listitem>
<para>Shorewall had run the <command>iptables</command> utility to add
each Netfilter rule.</para>
</listitem>
</itemizedlist>
<para>Shorewall version 4.0 offered you a choice. You could continue to
use the existing shell-based implementation or you could use a new
implementation of the Shorewall compiler written in the Perl programming
language. The new compiler:</para>
<itemizedlist>
<listitem>
<para>had a small disk footprint</para>
</listitem>
<listitem>
<para>was very fast.</para>
</listitem>
<listitem>
<para>generateed a firewall script that uses
<command>iptables-restore</command>; so the script was very
fast.</para>
</listitem>
<listitem>
<para>generated better and more consistent error messages.</para>
</listitem>
<listitem>
<para>did a much more thorough job of checking the configuration to
avoid run-time errors.</para>
</listitem>
<listitem>
<para>supported creating either Ipv4 or Ipv6 firewalls (Shorewall
4.2.4 and later).</para>
</listitem>
</itemizedlist>
<para><ulink url="Shorewall-perl.html#Install">Both compilers could be
installed on your system</ulink> and you could <ulink
url="Shorewall-perl.html#CompilerSelection">use whichever one suited you
in a particular case</ulink>.</para>
</section>
<section id="Install">
<title>Shorewall 4.4</title>
<para>Shorewall 4.4 discontinued the availability of the legacy
shell-based compiler. All users must migrate to the perl-based compiler
before or during an upgrade to Shorewall version 4.4 or later. We highly
recommend that current users of the shell-based compiler migrate before
upgrading to 4.4 or later so that both compilers are available during the
migration.</para>
<para>Shorewall 4.4 contains five packages:</para>
<itemizedlist>
<listitem>
<para><emphasis role="bold">Shorewall</emphasis> - Everything needed
to create an IPv4 firewall.</para>
</listitem>
<listitem>
<para><emphasis role="bold">Shorewall-lite</emphasis>- Can run scripts
generated by Shorewall on another system.</para>
</listitem>
<listitem>
<para><emphasis role="bold">Shorewall6</emphasis> - The utilities for
creating and operating an Ipv6 firewall. Requires Shorewall.</para>
</listitem>
<listitem>
<para><emphasis role="bold">Shorewall6-lite</emphasis> - Ipv6
equivalent of Shorewall Lite. Can run scripts generated by Shoreall on
another system.</para>
</listitem>
<listitem>
<para><emphasis role="bold">Shorewall-init</emphasis> - An add-on
package for any of the other packages which can:</para>
<orderedlist>
<listitem>
<para>Secure the firewall(s) prior to bringing up the interfaces
(does not work with systems running Upstart)</para>
</listitem>
<listitem>
<para>React to ifup/ifdown events and restart the firewall(s) if
needed</para>
</listitem>
</orderedlist>
</listitem>
</itemizedlist>
</section>
<section>
<title>Shorewall 4.5/4.6</title>
<para>Shorewall 4.5 added an additional <emphasis
role="bold">Shorewall-core</emphasis> package. This package contains the
core Shorewall shell libraries that are required by the other
packages.</para>
</section>
<section id="Prereqs">
<title>Prerequisites for using the Shorewall Version 4.2/4.4/4.5/4.6
Perl-based Compiler</title>
<itemizedlist>
<listitem>
<para>Perl (I use Perl 5.14.2 but other 5.8 or later versions should
work fine). <note>
<para>If you want to be able to use DNS names in your Shorewall6
configuration files, then Perl 5.10 or later is required together
with the Perl <emphasis role="bold">Socket6</emphasis>
module.</para>
</note></para>
</listitem>
<listitem>
<para>Perl <emphasis role="bold">Cwd</emphasis> Module</para>
</listitem>
<listitem>
<para>Perl <emphasis role="bold">File::Basename</emphasis>
Module</para>
</listitem>
<listitem>
<para>Perl <emphasis role="bold">File::Temp</emphasis> Module</para>
</listitem>
<listitem>
<para>Perl <emphasis role="bold">Getopt::Long</emphasis> Module</para>
</listitem>
<listitem>
<para>Perl <emphasis role="bold">Carp</emphasis> Module</para>
</listitem>
<listitem>
<para>Perl <emphasis role="bold">FindBin</emphasis> Module</para>
</listitem>
<listitem>
<para>Perl <emphasis role="bold">Scalar::Util </emphasis>Module</para>
</listitem>
<listitem>
<para>Perl <emphasis role="bold">Digest::SHA1</emphasis> Module
(Shorewall 4.5 only)</para>
</listitem>
</itemizedlist>
<para>Please note that there are <ulink url="IPv6Support.html">additional
requirements</ulink> if you plan to install and use Shorewall6.</para>
</section>
<section id="Incompatibilities">
<title>Incompatibilities Introduced in the Shorewall Version 4 Perl-based
Compiler</title>
<para>The Shorewall Perl-based compiler is not 100% compatible with the
Shorewall shell-based version. See <ulink url="Shorewall-perl.html">this
document</ulink> for details.</para>
</section>
</article>
|
