Provided by: shorewall6_4.5.21.6-1_all bug

NAME

       interfaces - shorewall6 interfaces file

SYNOPSIS

       /etc/shorewall6/interfaces

DESCRIPTION

       The interfaces file serves to define the firewall's network interfaces to shorewall6. The
       order of entries in this file is not significant in determining zone composition.

       Beginning with Shorewall 4.5.3, the interfaces file supports two different formats:

       FORMAT 1 (default - deprecated)
           There is a ANYCAST column which provides compatibility with older versions of
           Shorewall..

       FORMAT 2
           The BROADCAST column is omitted.

       The format is specified by a line as follows:

       [?]FORMAT {1|2}

       The optional '?' was introduced in Shorewall 4.5.11 and ?FORMAT is the preferred form; the
       form without the '?' is deprecated.

       The columns in the file are as follows.

       ZONE - zone-name
           Zone for this interface. Must match the name of a zone declared in
           /etc/shorewall6/zones. You may not list the firewall zone in this column.

           If the interface serves multiple zones that will be defined in the
           shorewall6-hosts[1](5) file, you should place "-" in this column.

           If there are multiple interfaces to the same zone, you must list them in separate
           entries.

           Example:

               #ZONE   INTERFACE       BROADCAST
               loc     eth1            -
               loc     eth2            -
           Beginning with Shorewall 4.5.17, if you specify a zone for the 'lo' interface, then
           that zone must be defined as type local in shorewall6-zones[2](5).

       INTERFACE - interface[:port]
           Logical name of interface. Each interface may be listed only once in this file. You
           may NOT specify the name of a "virtual" interface (e.g., eth0:0) here; see
           http://www.shorewall.net/FAQ.htm#faq18. If the physical option is not specified, then
           the logical name is also the name of the actual interface.

           You may use wildcards here by specifying a prefix followed by the plus sign ("+"). For
           example, if you want to make an entry that applies to all PPP interfaces, use 'ppp+';
           that would match ppp0, ppp1, ppp2, ...Please note that the '+' means 'one or more
           additional characters' so 'ppp' does not match 'ppp+'.

           Care must be exercised when using wildcards where there is another zone that uses a
           matching specific interface. See shorewall6-nesting[3](5) for a discussion of this
           problem.

           Shorewall6 allows '+' as an interface name.

           There is no need to define the loopback interface (lo) in this file.

           If a port is given, then the interface must have been defined previously with the
           bridge option. The OPTIONS column must be empty when a port is given.

       ANYCAST - -
           Enter '-' in this column. It is here for compatibility between Shorewall6 and
           Shorewall and is omitted if FORMAT is 2.

       OPTIONS (Optional) - [option[,option]...]
           A comma-separated list of options from the following list. The order in which you list
           the options is not significant but the list should have no embedded white-space.

           accept_ra[={0|1|2}]
               Added in Shorewall 4.5.16. Values are:

               0
                   Do not accept Router Advertisements.

               1
                   Accept Route Advertisements if forwarding is disabled.

               2
                   Overrule forwarding behavior. Accept Route Advertisements even if forwarding
                   is enabled.

               If the option is specified without a value, then the value 1 is assumed.

           blacklist
               Check packets arriving on this interface against the shorewall6-blacklist[4](5)
               file.

               Beginning with Shorewall 4.4.13:

               ·   If a zone is given in the ZONES column, then the behavior is as if blacklist
                   had been specified in the IN_OPTIONS column of shorewall6-zones[2](5).

               ·   Otherwise, the option is ignored with a warning: WARNING: The 'blacklist'
                   option is ignored on multi-zone interfaces

           bridge
               Designates the interface as a bridge. Beginning with Shorewall 4.4.7, setting this
               option also sets routeback.

           destonly
               Added in Shorewall 4.5.17. Causes the compiler to omit rules to handle traffic
               from this interface.

           dhcp
               Specify this option when any of the following are true:

                1. the interface gets its IP address via DHCP

                2. the interface is used by a DHCP server running on the firewall

                3. the interface has a static IP but is on a LAN segment with lots of DHCP
                   clients.

                4. the interface is a simple bridge[5] with a DHCP server on one port and DHCP
                   clients on another port.

                       Note
                       If you use Shorewall-perl for firewall/bridging[6], then you need to
                       include DHCP-specific rules in shorewall-rules[7](8). DHCP uses UDP ports
                       546 and 547.

               This option allows DHCP datagrams to enter and leave the interface.

           forward[={0|1}]
               Sets the /proc/sys/net/ipv6/conf/interface/forwarding option to the specified
               value. If no value is supplied, then 1 is assumed.

           ignore[=1]
               When specified, causes the generated script to ignore up/down events from
               Shorewall-init for this device. Additionally, the option exempts the interface
               from hairpin filtering. When '=1' is omitted, the ZONE column must contain '-' and
               ignore must be the only OPTION.

               Beginning with Shorewall 4.5.5, may be specified as 'ignore=1' which only causes
               the generated script to ignore up/down events from Shorewall-init; hairpin
               filtering is still applied. In this case, the above restrictions on the ZONE and
               OPTIONS columns are lifted.

           mss=number
               Causes forwarded TCP SYN packets entering or leaving on this interface to have
               their MSS field set to the specified number.

           nets=(net[,...])
               Limit the zone named in the ZONE column to only the listed networks. If you
               specify this option, be sure to include the link-local network (ff80::/10).

           nets=dynamic
               Added in Shorewall 4.4.21. Defines the zone as dynamic. Requires ipset match
               support in your iptables and kernel. See http://www.shorewall.net/Dynamic.html for
               further information.

           optional
               When optional is specified for an interface, shorewall6 will be silent when:

               ·   a /proc/sys/net/ipv6/conf/ entry for the interface cannot be modified.

               ·   The first global IPv6 address of the interface cannot be obtained.

               This option may not be specified together with required.

           physical=name
               Added in Shorewall 4.4.4. When specified, the interface or port name in the
               INTERFACE column is a logical name that refers to the name given in this option.
               It is useful when you want to specify the same wildcard port name on two or more
               bridges. See http://www.shorewall.net/bridge-Shorewall-perl.html#Multiple.

               If the interface name is a wildcard name (ends with '+'), then the physical name
               must also end in '+'.

               If physical is not specified, then it's value defaults to the interface name.

           required
               Added in Shorewall 4.4.10. When specified, the firewall will fail to start if the
               interface named in the INTERFACE column is not usable. May not be specified
               together with optional.

           routeback[={0|1}]
               If specified, indicates that shorewall6 should include rules that allow traffic
               arriving on this interface to be routed back out that same interface. This option
               is also required when you have used a wildcard in the INTERFACE column if you want
               to allow traffic between the interfaces that match the wildcard.

               If you specify this option, then you should also specify rpfilter (see below) if
               you are running Shorewall 4.5.7 or later; otherwise, you should specify sfilter
               (see below).

               Beginning with Shorewall 4.5.18, you may specify this option to explicitly reset
               (e.g., routeback=0). This can be used to override Shorewall's default setting for
               bridge devices which is routeback=1.

           rpfilter
               Added in Shorewall 4.5.7. This is an anti-spoofing measure that requires the
               'RPFilter Match' capability in your iptables and kernel. It provides a more
               efficient alternative to the sfilter option below.

           sourceroute[={0|1}]
               If this option is not specified for an interface, then source-routed packets will
               not be accepted from that interface unless explicitly enabled via sysconf. Only
               set this option to 1 (enable source routing) if you know what you are doing. This
               might represent a security risk and is not usually needed.

               Only those interfaces with the sourceroute option will have their setting changed;
               the value assigned to the setting will be the value specified (if any) or 1 if no
               value is given.

                   Note
                   This option does not work with a wild-card interface name (e.g., eth0.+) in
                   the INTERFACE column.

           sfilter=(net[,...])
               Added in Shorewall 4.4.20. At this writing (spring 2011), Linux does not support
               reverse path filtering (RFC3704) for IPv6. In its absence, sfilter may be used as
               an anti-spoofing measure.

               This option should be used on bridges or other interfaces with the routeback
               option. On these interfaces, sfilter should list those local networks that are
               connected to the firewall through other interfaces.

           tcpflags
               Packets arriving on this interface are checked for certain illegal combinations of
               TCP flags. Packets found to have such a combination of flags are handled according
               to the setting of TCP_FLAGS_DISPOSITION after having been logged according to the
               setting of TCP_FLAGS_LOG_LEVEL.

           proxyndp[={0|1}]
               Sets /proc/sys/net/ipv6/conf/interface/proxy_ndp.

               Note: This option does not work with a wild-card interface name (e.g., eth0.+) in
               the INTERFACE column.

               Only those interfaces with the proxyndp option will have their setting changed;
               the value assigned to the setting will be the value specified (if any) or 1 if no
               value is given.

           unmanaged
               Added in Shorewall 4.5.18. Causes all traffic between the firewall and hosts on
               the interface to be accepted. When this option is given:

               ·   The ZONE column must contain '-'.

               ·   Only the following other options are allowed with unmanaged:
                       accept_ra
                       forward
                       ignore
                       optional
                       physical
                       sourceroute
                       proxyndp

           wait=seconds
               Added in Shorewall 4.4.10. Causes the generated script to wait up to seconds
               seconds for the interface to become usable before applying the required or
               optional options.

EXAMPLE

       Example 1:
           Suppose you have eth0 connected to a DSL modem and eth1 connected to your local
           network You have a DMZ using eth2.

           Your entries for this setup would look like:

               FORMAT 2
               #ZONE   INTERFACE OPTIONS
               net     eth0      -
               loc     eth1      -
               dmz     eth2      -

       Example 4 (Shorewall 4.4.9 and later):
           You have a bridge with no IP address and you want to allow traffic through the bridge.

               FORMAT 2
               #ZONE   INTERFACE        OPTIONS
               -       br0              routeback

FILES

       /etc/shorewall6/interfaces

SEE ALSO

       http://shorewall.net/configuration_file_basics.htm#Pairs

       shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5), shorewall6-blacklist(5),
       shorewall6-hosts(5), shorewall6-maclist(5), shorewall6-netmap(5),shorewall6-params(5),
       shorewall6-policy(5), shorewall6-providers(5), shorewall6-rtrules(5),
       shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5),
       shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5),
       shorewall6-tcrules(5), shorewall6-tos(5), shorewall6-tunnels(5), shorewall6-zones(5)

NOTES

        1. shorewall6-hosts
           http://www.shorewall.netshorewall6-hosts.html

        2. shorewall6-zones
           http://www.shorewall.netshorewall6-zones.html

        3. shorewall6-nesting
           http://www.shorewall.netshorewall6-nesting.html

        4. shorewall6-blacklist
           http://www.shorewall.netshorewall6-blacklist.html

        5. simple bridge
           http://www.shorewall.net../SimpleBridge.html

        6. Shorewall-perl for firewall/bridging
           http://www.shorewall.net../bridge-Shorewall-perl.html

        7. shorewall-rules
           http://www.shorewall.netshorewall-rules.html

[FIXME: source]                             01/30/2014                     SHOREWALL6-INTERFAC(5)