Provided by: shorewall_4.4.21-1_all bug

NAME

       interfaces - Shorewall interfaces file

SYNOPSIS

       /etc/shorewall/interfaces

DESCRIPTION

       The interfaces file serves to define the firewall's network interfaces
       to Shorewall. The order of entries in this file is not significant in
       determining zone composition.

       The columns in the file are as follows.

       ZONE - zone-name
           Zone for this interface. Must match the name of a zone declared in
           /etc/shorewall/zones. You may not list the firewall zone in this
           column.

           If the interface serves multiple zones that will be defined in the
           shorewall-hosts[1](5) file, you should place "-" in this column.

           If there are multiple interfaces to the same zone, you must list
           them in separate entries.

           Example:

               #ZONE   INTERFACE       BROADCAST
               loc     eth1            -
               loc     eth2            -

       INTERFACE - interface[:port]
           Logical name of interface. Each interface may be listed only once
           in this file. You may NOT specify the name of a "virtual" interface
           (e.g., eth0:0) here; see http://www.shorewall.net/FAQ.htm#faq18. If
           the physical option is not specified, then the logical name is also
           the name of the actual interface.

           You may use wildcards here by specifying a prefix followed by the
           plus sign ("+"). For example, if you want to make an entry that
           applies to all PPP interfaces, use 'ppp+'; that would match ppp0,
           ppp1, ppp2, ... Please note that the '+' means 'one or more
           additional characters' so 'ppp' does not match 'ppp+'.

           When using Shorewall versions before 4.1.4, care must be exercised
           when using wildcards where there is another zone that uses a
           matching specific interface. See shorewall-nesting[2](5) for a
           discussion of this problem.

           Shorewall allows '+' as an interface name.

           There is no need to define the loopback interface (lo) in this
           file.

           If a port is given, then the interface must have been defined
           previously with the bridge option. The OPTIONS column may not
           contain the following options when a port is given.
               arp_filter
               arp_ignore
               bridge
               log_martians
               mss
               optional
               proxyarp
               required
               routefilter
               sourceroute
               upnp
               wait

       BROADCAST (Optional) - {-|detect|address[,address]...}
           If you use the special value detect, Shorewall will detect the
           broadcast address(es) for you if your iptables and kernel include
           Address Type Match support.

           If your iptables and/or kernel lack Address Type Match support then
           you may list the broadcast address(es) for the network(s) to which
           the interface belongs. For P-T-P interfaces, this column is left
           blank. If the interface has multiple addresses on multiple subnets
           then list the broadcast addresses as a comma-separated list.

           If you don't want to give a value for this column but you want to
           enter a value in the OPTIONS column, enter - in this column.

       OPTIONS (Optional) - [option[,option]...]
           A comma-separated list of options from the following list. The
           order in which you list the options is not significant but the list
           should have no embedded white space.

           arp_filter[={0|1}]
               If specified, this interface will only respond to ARP who-has
               requests for IP addresses configured on the interface. If not
               specified, the interface can respond to ARP who-has requests
               for IP addresses on any of the firewall's interface. The
               interface must be up when Shorewall is started.

               Only those interfaces with the arp_filter option will have
               their setting changed; the value assigned to the setting will
               be the value specified (if any) or 1 if no value is given.

                   Note
                   This option does not work with a wild-card interface name
                   (e.g., eth0.+) in the INTERFACE column.

           arp_ignore[=number]
               If specified, this interface will respond to arp requests based
               on the value of number (defaults to 1).

               1 - reply only if the target IP address is local address
               configured on the incoming interface

               2 - reply only if the target IP address is local address
               configured on the incoming interface and the sender's IP
               address is part from same subnet on this interface's address

               3 - do not reply for local addresses configured with scope
               host, only resolutions for global and link

               4-7 - reserved

               8 - do not reply for all local addresses

                   Note
                   This option does not work with a wild-card interface name
                   (e.g., eth0.+) in the INTERFACE column.

                   Warning
                   Do not specify arp_ignore for any interface involved in
                   Proxy ARP[3].

           blacklist
               Check packets arriving on this interface against the
               shorewall6-blacklist[4](5) file.

               Beginning with Shorewall 4.4.13:

               ·   If a zone is given in the ZONES column, then the behavior
                   is as if blacklist had been specified in the IN_OPTIONS
                   column of shorewall-zones[5](5).

               ·   Otherwise, the option is ignored with a warning: WARNING:
                   The 'blacklist' option is ignored on mult-zone interfaces

           bridge
               Designates the interface as a bridge. Beginning with Shorewall
               4.4.7, setting this option also sets routeback.

           dhcp
               Specify this option when any of the following are true:

                1. the interface gets its IP address via DHCP

                2. the interface is used by a DHCP server running on the
                   firewall

                3. the interface has a static IP but is on a LAN segment with
                   lots of DHCP clients.

                4. the interface is a simple bridge[6] with a DHCP server on
                   one port and DHCP clients on another port.

                       Note
                       If you use Shorewall-perl for firewall/bridging[7],
                       then you need to include DHCP-specific rules in
                       shorewall-rules[8](8). DHCP uses UDP ports 67 and 68.

               This option allows DHCP datagrams to enter and leave the
               interface.

           logmartians[={0|1}]
               Turn on kernel martian logging (logging of packets with
               impossible source addresses. It is strongly suggested that if
               you set routefilter on an interface that you also set
               logmartians. Even if you do not specify the routefilter option,
               it is a good idea to specify logmartians because your
               distribution may have enabled route filtering without you
               knowing it.

               Only those interfaces with the logmartians option will have
               their setting changed; the value assigned to the setting will
               be the value specified (if any) or 1 if no value is given.

               To find out if route filtering is set on a given interface,
               check the contents of
               /proc/sys/net/ipv4/conf/interface/rp_filter - a non-zero value
               indicates that route filtering is enabled.

               Example:

                           teastep@lists:~$ cat /proc/sys/net/ipv4/conf/eth0/rp_filter
                           1
                           teastep@lists:~$

                   Note
                   This option does not work with a wild-card interface name
                   (e.g., eth0.+) in the INTERFACE column.
               This option may also be enabled globally in the
               shorewall.conf[9](5) file.

           maclist
               Connection requests from this interface are compared against
               the contents of shorewall-maclist[10](5). If this option is
               specified, the interface must be an ethernet NIC and must be up
               before Shorewall is started.

           mss=number
               Added in Shorewall 4.0.3. Causes forwarded TCP SYN packets
               entering or leaving on this interface to have their MSS field
               set to the specified number.

           nets=(net[,...])
               Limit the zone named in the ZONE column to only the listed
               networks. The parentheses may be omitted if only a single net
               is given (e.g., nets=192.168.1.0/24). Limited broadcast to the
               zone is supported. Beginning with Shorewall 4.4.1, multicast
               traffic to the zone is also supported.

           nets=dynamic
               Defines the zone as dynamic. Requires ipset match support in
               your iptables and kernel. See
               http://www.shorewall.net/Dynamic.html for further information.

           nosmurfs
               Filter packets for smurfs (packets with a broadcast address as
               the source).

               Smurfs will be optionally logged based on the setting of
               SMURF_LOG_LEVEL in shorewall.conf[9](5). After logging, the
               packets are dropped.

           optional
               When optional is specified for an interface, Shorewall will be
               silent when:

               ·   a /proc/sys/net/ipv4/conf/ entry for the interface cannot
                   be modified (including for proxy ARP).

               ·   The first address of the interface cannot be obtained.

               May not be specified with required.

           physical=name
               Added in Shorewall 4.4.4. When specified, the interface or port
               name in the INTERFACE column is a logical name that refers to
               the name given in this option. It is useful when you want to
               specify the same wildcard port name on two or more bridges. See
               http://www.shorewall.net/bridge-Shorewall-perl.html#Multiple.

               If the interface name is a wildcard name (ends with '+'), then
               the physical name must also end in '+'.

               If physical is not specified, then it's value defaults to the
               interface name.

           proxyarp[={0|1}]
               Sets /proc/sys/net/ipv4/conf/interface/proxy_arp. Do NOT use
               this option if you are employing Proxy ARP through entries in
               shorewall-proxyarp[11](5). This option is intended solely for
               use with Proxy ARP sub-networking as described at:
               http://tldp.org/HOWTO/Proxy-ARP-Subnet/index.html.[12]

               Note: This option does not work with a wild-card interface name
               (e.g., eth0.+) in the INTERFACE column.

               Only those interfaces with the proxyarp option will have their
               setting changed; the value assigned to the setting will be the
               value specified (if any) or 1 if no value is given.

           required
               Added in Shorewall 4.4.10. If this option is set, the firewall
               will fail to start if the interface is not usable. May not be
               specified together with optional.

           routeback
               If specified, indicates that Shorewall should include rules
               that allow traffic arriving on this interface to be routed back
               out that same interface. This option is also required when you
               have used a wildcard in the INTERFACE column if you want to
               allow traffic between the interfaces that match the wildcard.

               Beginning with Shorewall 4.4.20, if you specify this option,
               then you should also specify filter; see above.

           routefilter[={0|1|2}]
               Turn on kernel route filtering for this interface
               (anti-spoofing measure).

               Only those interfaces with the routefilter option will have
               their setting changes; the value assigned to the setting will
               be the value specified (if any) or 1 if no value is given.

               The value 2 is only available with Shorewall 4.4.5.1 and later
               when the kernel version is 2.6.31 or later. It specifies a
               loose form of reverse path filtering.

                   Note
                   This option does not work with a wild-card interface name
                   (e.g., eth0.+) in the INTERFACE column.
               This option can also be enabled globally in the
               shorewall.conf[9](5) file.

                   Note
                   There are certain cases where routefilter cannot be used on
                   an interface:

                   ·   If USE_DEFAULT_RT=Yes in shorewall.conf[9](5) and the
                       interface is listed in shorewall-providers[13](5).

                   ·   If there is an entry for the interface in
                       shorewall-providers[13](5) that doesn't specify the
                       balance option.

                   ·   If IPSEC is used to allow a road-warrior to have a
                       local address, then any interface through which the
                       road-warrior might connect cannot specify routefilter.

           sfilter=(net[,...])
               Added in Shorewall 4.4.20. This option provides an
               anti-spoofing alternative to routefilter on interfaces where
               that option cannot be used, but where the routeback option is
               required (on a bridge, for example). On these interfaces,
               sfilter should list those local networks that are connected to
               the firewall through other interfaces.

           sourceroute[={0|1}]
               If this option is not specified for an interface, then
               source-routed packets will not be accepted from that interface
               (sets /proc/sys/net/ipv4/conf/interface/accept_source_route to
               1). Only set this option if you know what you are doing. This
               might represent a security risk and is usually unneeded.

               Only those interfaces with the sourceroute option will have
               their setting changed; the value assigned to the setting will
               be the value specified (if any) or 1 if no value is given.

                   Note
                   This option does not work with a wild-card interface name
                   (e.g., eth0.+) in the INTERFACE column.

           tcpflags
               Packets arriving on this interface are checked for certain
               illegal combinations of TCP flags. Packets found to have such a
               combination of flags are handled according to the setting of
               TCP_FLAGS_DISPOSITION after having been logged according to the
               setting of TCP_FLAGS_LOG_LEVEL.

           upnp
               Incoming requests from this interface may be remapped via UPNP
               (upnpd). See http://www.shorewall.net/UPnP.html[14].

           upnpclient
               This option is intended for laptop users who always run
               Shorewall on their system yet need to run UPnP-enabled client
               apps such as Transmission (BitTorrent client). The option
               causes Shorewall to detect the default gateway through the
               interface and to accept UDP packets from that gateway. Note
               that, like all aspects of UPnP, this is a security hole so use
               this option at your own risk.

           wait=seconds
               Added in Shorewall 4.4.10. Causes the generated script to wait
               up to seconds seconds for the interface to become usable before
               applying the required or optional options.

EXAMPLE

       Example 1:
           Suppose you have eth0 connected to a DSL modem and eth1 connected
           to your local network and that your local subnet is 192.168.1.0/24.
           The interface gets its IP address via DHCP from subnet
           206.191.149.192/27. You have a DMZ with subnet 192.168.2.0/24 using
           eth2.

           Your entries for this setup would look like:

               #ZONE   INTERFACE BROADCAST        OPTIONS
               net     eth0      206.191.149.223  dhcp
               loc     eth1      192.168.1.255
               dmz     eth2      192.168.2.255

       Example 2:
           The same configuration without specifying broadcast addresses is:

               #ZONE   INTERFACE BROADCAST        OPTIONS
               net     eth0      detect           dhcp
               loc     eth1      detect
               dmz     eth2      detect

       Example 3:
           You have a simple dial-in system with no ethernet connections.

               #ZONE   INTERFACE BROADCAST        OPTIONS
               net     ppp0      -

       Example 4 (Shorewall 4.4.9 and later):
           You have a bridge with no IP address and you want to allow traffic
           through the bridge.

               #ZONE   INTERFACE BROADCAST        OPTIONS
               -       br0       -                routeback

FILES

       /etc/shorewall/interfaces

SEE ALSO

       shorewall(8), shorewall-accounting(5), shorewall-actions(5),
       shorewall-blacklist(5), shorewall-hosts(5), shorewall-maclist(5),
       shorewall-masq(5), shorewall-nat(5), shorewall-netmap(5),
       shorewall-params(5), shorewall-policy(5), shorewall-providers(5),
       shorewall-proxyarp(5), shorewall-route_rules(5),
       shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
       shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
       shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5),
       shorewall-zones(5)

NOTES

        1. shorewall-hosts
           http://www.shorewall.net/manpages/shorewall-hosts.html

        2. shorewall-nesting
           http://www.shorewall.net/manpages/shorewall-nesting.html

        3. Proxy ARP
           http://www.shorewall.net/manpages/../ProxyARP.htm

        4. shorewall6-blacklist
           http://www.shorewall.net/manpages/shorewall6-blacklist.html

        5. shorewall-zones
           http://www.shorewall.net/manpages/shorewall-zones.html

        6. simple bridge
           http://www.shorewall.net/manpages/../SimpleBridge.html

        7. Shorewall-perl for firewall/bridging
           http://www.shorewall.net/manpages/../bridge-Shorewall-perl.html

        8. shorewall-rules
           http://www.shorewall.net/manpages/shorewall-rules.html

        9. shorewall.conf
           http://www.shorewall.net/manpages/shorewall.conf.html

       10. shorewall-maclist
           http://www.shorewall.net/manpages/shorewall-maclist.html

       11. shorewall-proxyarp
           http://www.shorewall.net/manpages/shorewall-proxyarp.html

       12. http://tldp.org/HOWTO/Proxy-ARP-Subnet/index.html.
           http://tldp.org/HOWTO/Proxy-ARP-Subnet/index.html

       13. shorewall-providers
           http://www.shorewall.net/manpages/shorewall-providers.html

       14. http://www.shorewall.net/UPnP.html
           http://www.shorewall.net/manpages/../UPnP.html

[FIXME: source]                   07/10/2011            SHOREWALL-INTERFACE(5)