Provided by: shorewall6_4.4.26.1-1_all bug


       interfaces - shorewall6 interfaces file




       The interfaces file serves to define the firewall's network interfaces
       to shorewall6. The order of entries in this file is not significant in
       determining zone composition.

       The columns in the file are as follows.

       ZONE - zone-name
           Zone for this interface. Must match the name of a zone declared in
           /etc/shorewall6/zones. You may not list the firewall zone in this

           If the interface serves multiple zones that will be defined in the
           shorewall6-hosts[1](5) file, you should place "-" in this column.

           If there are multiple interfaces to the same zone, you must list
           them in separate entries.


               #ZONE   INTERFACE       BROADCAST
               loc     eth1            -
               loc     eth2            -

       INTERFACE - interface[:port]
           Logical name of interface. Each interface may be listed only once
           in this file. You may NOT specify the name of a "virtual" interface
           (e.g., eth0:0) here; see If
           the physical option is not specified, then the logical name is also
           the name of the actual interface.

           You may use wildcards here by specifying a prefix followed by the
           plus sign ("+"). For example, if you want to make an entry that
           applies to all PPP interfaces, use 'ppp+'; that would match ppp0,
           ppp1, ppp2, ...Please note that the '+' means 'one or more
           additional characters' so 'ppp' does not match 'ppp+'.

           Care must be exercised when using wildcards where there is another
           zone that uses a matching specific interface. See
           shorewall6-nesting[2](5) for a discussion of this problem.

           Shorewall6 allows '+' as an interface name.

           There is no need to define the loopback interface (lo) in this

           If a port is given, then the interface must have been defined
           previously with the bridge option. The OPTIONS column must be empty
           when a port is given.

       ANYCAST - -
           Enter '-' in this column. It is here for compatibility between
           Shorewall6 and Shorewall.

       OPTIONS (Optional) - [option[,option]...]
           A comma-separated list of options from the following list. The
           order in which you list the options is not significant but the list
           should have no embedded white space.

               Deprecated in Shorewall 4.4.25 and later in favor of rules in
               the BLACKLIST section of shorewall6-rules[3] (5) or
               inshorewall6-blrules[4](5). Check packets arriving on this
               interface against the shorewall6-blacklist[5](5) file.

               Beginning with Shorewall 4.4.13:

               ·   If a zone is given in the ZONES column, then the behavior
                   is as if blacklist had been specified in the IN_OPTIONS
                   column of shorewall6-zones[6](5).

               ·   Otherwise, the option is ignored with a warning: WARNING:
                   The 'blacklist' option is ignored on mult-zone interfaces

               Designates the interface as a bridge. Beginning with Shorewall
               4.4.7, setting this option also sets routeback.

               Specify this option when any of the following are true:

                1. the interface gets its IP address via DHCP

                2. the interface is used by a DHCP server running on the

                3. the interface has a static IP but is on a LAN segment with
                   lots of DHCP clients.

                4. the interface is a simple bridge[7] with a DHCP server on
                   one port and DHCP clients on another port.

                       If you use Shorewall-perl for firewall/bridging[8],
                       then you need to include DHCP-specific rules in
                       shorewall-rules[9](8). DHCP uses UDP ports 546 and 547.

               This option allows DHCP datagrams to enter and leave the

               Sets the /proc/sys/net/ipv6/conf/interface/forwarding option to
               the specified value. If no value is supplied, then 1 is

               When specified, causes the generated script to ignore up/down
               events from Shorewall-init for this device. Additionally, the
               option exempts the interface from hairpin filtering.

               Causes forwarded TCP SYN packets entering or leaving on this
               interface to have their MSS field set to the specified number.

               Limit the zone named in the ZONE column to only the listed
               networks. If you specify this option, be sure to include the
               link-local network (ff80::/10).

               Added in Shorewall 4.4.21. Defines the zone as dynamic.
               Requires ipset match support in your iptables and kernel. See
      for further information.

               When optional is specified for an interface, shorewall6 will be
               silent when:

               ·   a /proc/sys/net/ipv6/conf/ entry for the interface cannot
                   be modified.

               ·   The first global IPv6 address of the interface cannot be

               This option may not be specified together with required.

               Added in Shorewall 4.4.4. When specified, the interface or port
               name in the INTERFACE column is a logical name that refers to
               the name given in this option. It is useful when you want to
               specify the same wildcard port name on two or more bridges. See

               If the interface name is a wildcard name (ends with '+'), then
               the physical name must also end in '+'.

               If physical is not specified, then it's value defaults to the
               interface name.

               Added in Shorewall 4.4.10. When specified, the firewall will
               fail to start if the interface named in the INTERFACE column is
               not usable. May not be specified together with optional.

               If specified, indicates that shorewall6 should include rules
               that allow traffic arriving on this interface to be routed back
               out that same interface. This option is also required when you
               have used a wildcard in the INTERFACE column if you want to
               allow traffic between the interfaces that match the wildcard.

               Beginning with Shorewall 4.4.20, if you specify this option,
               then you should also specify sfilter (see below).

               If this option is not specified for an interface, then
               source-routed packets will not be accepted from that interface
               (sets /proc/sys/net/ipv6/conf/interface/accept_source_route to
               1). Only set this option if you know what you are doing. This
               might represent a security risk and is not usually needed.

               Only those interfaces with the sourceroute option will have
               their setting changes; the value assigned to the setting will
               be the value specified (if any) or 1 if no value is given.

                   This option does not work with a wild-card interface name
                   (e.g., eth0.+) in the INTERFACE column.

               Added in Shorewall 4.4.20. At this writing (spring 2011), Linux
               does not support reverse path filtering (RFC3704) for IPv6. In
               its absence, sfilter may be used as an anti-spoofing measure.

               This option should be used on bridges or other interfaces with
               the routeback option. On these interfaces, sfilter should list
               those local networks that are connected to the firewall through
               other interfaces.

               Deprecated in Shorewall 4.4.25 and later in favor of invoking
               the TCPFlags standard action in shorewall6-rules[3] (5).
               Packets arriving on this interface are checked for certain
               illegal combinations of TCP flags. Packets found to have such a
               combination of flags are handled according to the setting of
               TCP_FLAGS_DISPOSITION after having been logged according to the
               setting of TCP_FLAGS_LOG_LEVEL.

               Sets /proc/sys/net/ipv6/conf/interface/proxy_ndp.

               Note: This option does not work with a wild-card interface name
               (e.g., eth0.+) in the INTERFACE column.

               Only those interfaces with the proxyndp option will have their
               setting changed; the value assigned to the setting will be the
               value specified (if any) or 1 if no value is given.

               Added in Shorewall 4.4.10. Causes the generated script to wait
               up to seconds seconds for the interface to become usable before
               applying the required or optional options.


       Example 1:
           Suppose you have eth0 connected to a DSL modem and eth1 connected
           to your local network You have a DMZ using eth2.

           Your entries for this setup would look like:

               #ZONE   INTERFACE UNICAST        OPTIONS
               net     eth0      -
               loc     eth1      -
               dmz     eth2      -

       Example 4 (Shorewall 4.4.9 and later):
           You have a bridge with no IP address and you want to allow traffic
           through the bridge.

               -       br0       -                routeback




       shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5),
       shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-maclist(5),
       shoewall6-netmap(5),shorewall6-params(5), shorewall6-policy(5),
       shorewall6-providers(5), shorewall6-route_rules(5),
       shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5),
       shorewall6-secmarks(5), shorewall6-tcclasses(5),
       shorewall6-tcdevices(5), shorewall6-tcrules(5), shorewall6-tos(5),
       shorewall6-tunnels(5), shorewall6-zones(5)


        1. shorewall6-hosts

        2. shorewall6-nesting

        3. shorewall6-rules

        4. shorewall6-blrules

        5. shorewall6-blacklist

        6. shorewall6-zones

        7. simple bridge

        8. Shorewall-perl for firewall/bridging

        9. shorewall-rules

[FIXME: source]                   12/13/2011            SHOREWALL6-INTERFAC(5)