xenial (5) shorewall6-interfaces.5.gz
NAME
interfaces - shorewall6 interfaces file
SYNOPSIS
/etc/shorewall6/interfaces
DESCRIPTION
The interfaces file serves to define the firewall's network interfaces to shorewall6. The order of
entries in this file is not significant in determining zone composition.
Beginning with Shorewall 4.5.3, the interfaces file supports two different formats:
FORMAT 1 (default - deprecated)
There is a ANYCAST column which provides compatibility with older versions of Shorewall..
FORMAT 2
The BROADCAST column is omitted.
The format is specified by a line as follows:
?FORMAT {1|2}
The columns in the file are as follows.
ZONE - zone-name
Zone for this interface. Must match the name of a zone declared in /etc/shorewall6/zones. You may not
list the firewall zone in this column.
If the interface serves multiple zones that will be defined in the shorewall6-hosts[1](5) file, you
should place "-" in this column.
If there are multiple interfaces to the same zone, you must list them in separate entries.
Example:
#ZONE INTERFACE BROADCAST
loc eth1 -
loc eth2 -
Beginning with Shorewall 4.5.17, if you specify a zone for the 'lo' interface, then that zone must be
defined as type local in shorewall6-zones[2](5).
INTERFACE - interface[:port]
Logical name of interface. Each interface may be listed only once in this file. You may NOT specify
the name of a "virtual" interface (e.g., eth0:0) here; see http://www.shorewall.net/FAQ.htm#faq18[3].
If the physical option is not specified, then the logical name is also the name of the actual
interface.
You may use wildcards here by specifying a prefix followed by the plus sign ("+"). For example, if
you want to make an entry that applies to all PPP interfaces, use 'ppp+'; that would match ppp0,
ppp1, ppp2, ...Please note that the '+' means 'one or more additional characters' so 'ppp' does not
match 'ppp+'.
Care must be exercised when using wildcards where there is another zone that uses a matching specific
interface. See shorewall6-nesting[4](5) for a discussion of this problem.
Shorewall6 allows '+' as an interface name.
There is no need to define the loopback interface (lo) in this file.
If a port is given, then the interface must have been defined previously with the bridge option. The
OPTIONS column must be empty when a port is given.
ANYCAST - -
Enter '-' in this column. It is here for compatibility between Shorewall6 and Shorewall and is
omitted if FORMAT is 2.
OPTIONS (Optional) - [option[,option]...]
A comma-separated list of options from the following list. The order in which you list the options is
not significant but the list should have no embedded white-space.
accept_ra[={0|1|2}]
Added in Shorewall 4.5.16. Values are:
0
Do not accept Router Advertisements.
1
Accept Route Advertisements if forwarding is disabled.
2
Overrule forwarding behavior. Accept Route Advertisements even if forwarding is enabled.
If the option is specified without a value, then the value 1 is assumed.
blacklist
Check packets arriving on this interface against the shorewall6-blacklist[5](5) file.
Beginning with Shorewall 4.4.13:
• If a zone is given in the ZONES column, then the behavior is as if blacklist had been
specified in the IN_OPTIONS column of shorewall6-zones[2](5).
• Otherwise, the option is ignored with a warning: WARNING: The 'blacklist' option is ignored
on multi-zone interfaces
bridge
Designates the interface as a bridge. Beginning with Shorewall 4.4.7, setting this option also
sets routeback.
destonly
Added in Shorewall 4.5.17. Causes the compiler to omit rules to handle traffic from this
interface.
dhcp
Specify this option when any of the following are true:
1. the interface gets its IP address via DHCP
2. the interface is used by a DHCP server running on the firewall
3. the interface has a static IP but is on a LAN segment with lots of DHCP clients.
4. the interface is a simple bridge[6] with a DHCP server on one port and DHCP clients on
another port.
Note
If you use Shorewall-perl for firewall/bridging[7], then you need to include
DHCP-specific rules in shorewall-rules[8](8). DHCP uses UDP ports 546 and 547.
This option allows DHCP datagrams to enter and leave the interface.
forward[={0|1}]
Sets the /proc/sys/net/ipv6/conf/interface/forwarding option to the specified value. If no value
is supplied, then 1 is assumed.
ignore[=1]
When specified, causes the generated script to ignore up/down events from Shorewall-init for this
device. Additionally, the option exempts the interface from hairpin filtering. When '=1' is
omitted, the ZONE column must contain '-' and ignore must be the only OPTION.
Beginning with Shorewall 4.5.5, may be specified as 'ignore=1' which only causes the generated
script to ignore up/down events from Shorewall-init; hairpin filtering is still applied. In this
case, the above restrictions on the ZONE and OPTIONS columns are lifted.
loopback
Added in Shorewall 4.6.6. Designates the interface as the loopback interface. This option is
assumed if the interface's physical name is 'lo'. Only one interface man have the loopback option
specified.
mss=number
Causes forwarded TCP SYN packets entering or leaving on this interface to have their MSS field
set to the specified number.
nets=(net[,...])
Limit the zone named in the ZONE column to only the listed networks. If you specify this option,
be sure to include the link-local network (ff80::/10).
nets=dynamic
Added in Shorewall 4.4.21. Defines the zone as dynamic. Requires ipset match support in your
iptables and kernel. See http://www.shorewall.net/Dynamic.html[9] for further information.
optional
When optional is specified for an interface, shorewall6 will be silent when:
• a /proc/sys/net/ipv6/conf/ entry for the interface cannot be modified.
• The first global IPv6 address of the interface cannot be obtained.
This option may not be specified together with required.
physical=name
Added in Shorewall 4.4.4. When specified, the interface or port name in the INTERFACE column is a
logical name that refers to the name given in this option. It is useful when you want to specify
the same wildcard port name on two or more bridges. See
http://www.shorewall.net/bridge-Shorewall-perl.html#Multiple[10].
If the interface name is a wildcard name (ends with '+'), then the physical name must also end in
'+'.
If physical is not specified, then it's value defaults to the interface name.
required
Added in Shorewall 4.4.10. When specified, the firewall will fail to start if the interface named
in the INTERFACE column is not usable. May not be specified together with optional.
routeback[={0|1}]
If specified, indicates that shorewall6 should include rules that allow traffic arriving on this
interface to be routed back out that same interface. This option is also required when you have
used a wildcard in the INTERFACE column if you want to allow traffic between the interfaces that
match the wildcard.
If you specify this option, then you should also specify rpfilter (see below) if you are running
Shorewall 4.5.7 or later; otherwise, you should specify sfilter (see below).
Beginning with Shorewall 4.5.18, you may specify this option to explicitly reset (e.g.,
routeback=0). This can be used to override Shorewall's default setting for bridge devices which
is routeback=1.
rpfilter
Added in Shorewall 4.5.7. This is an anti-spoofing measure that requires the 'RPFilter Match'
capability in your iptables and kernel. It provides a more efficient alternative to the sfilter
option below.
sourceroute[={0|1}]
If this option is not specified for an interface, then source-routed packets will not be accepted
from that interface unless explicitly enabled via sysconf. Only set this option to 1 (enable
source routing) if you know what you are doing. This might represent a security risk and is not
usually needed.
Only those interfaces with the sourceroute option will have their setting changed; the value
assigned to the setting will be the value specified (if any) or 1 if no value is given.
Note
This option does not work with a wild-card interface name (e.g., eth0.+) in the INTERFACE
column.
sfilter=(net[,...])
Added in Shorewall 4.4.20. At this writing (spring 2011), Linux does not support reverse path
filtering (RFC3704) for IPv6. In its absence, sfilter may be used as an anti-spoofing measure.
This option should be used on bridges or other interfaces with the routeback option. On these
interfaces, sfilter should list those local networks that are connected to the firewall through
other interfaces.
tcpflags[={0|1}]
Packets arriving on this interface are checked for certain illegal combinations of TCP flags.
Packets found to have such a combination of flags are handled according to the setting of
TCP_FLAGS_DISPOSITION after having been logged according to the setting of TCP_FLAGS_LOG_LEVEL.
Beginning with Shorewall 4.6.0, tcpflags=1 is the default. To disable this option, specify
tcpflags=0.
proxyndp[={0|1}]
Sets /proc/sys/net/ipv6/conf/interface/proxy_ndp.
Note: This option does not work with a wild-card interface name (e.g., eth0.+) in the INTERFACE
column.
Only those interfaces with the proxyndp option will have their setting changed; the value
assigned to the setting will be the value specified (if any) or 1 if no value is given.
unmanaged
Added in Shorewall 4.5.18. Causes all traffic between the firewall and hosts on the interface to
be accepted. When this option is given:
• The ZONE column must contain '-'.
• Only the following other options are allowed with unmanaged:
accept_ra
forward
ignore
optional
physical
sourceroute
proxyndp
wait=seconds
Added in Shorewall 4.4.10. Causes the generated script to wait up to seconds seconds for the
interface to become usable before applying the required or optional options.
EXAMPLE
Example 1:
Suppose you have eth0 connected to a DSL modem and eth1 connected to your local network You have a
DMZ using eth2.
Your entries for this setup would look like:
FORMAT 2
#ZONE INTERFACE OPTIONS
net eth0 -
loc eth1 -
dmz eth2 -
Example 4 (Shorewall 4.4.9 and later):
You have a bridge with no IP address and you want to allow traffic through the bridge.
FORMAT 2
#ZONE INTERFACE OPTIONS
- br0 bridge
FILES
/etc/shorewall6/interfaces
SEE ALSO
http://www.shorewall.net/configuration_file_basics.htm#Pairs[11] shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5), shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-maclist(5), shorewall6-netmap(5),shorewall6-params(5), shorewall6-policy(5), shorewall6-providers(5), shorewall6-rtrules(5), shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5), shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5), shorewall6-mangle(5), shorewall6-tos(5), shorewall6-tunnels(5), shorewall6-zones(5)
NOTES
1. shorewall6-hosts
http://www.shorewall.net/manpages6/shorewall6-hosts.html
2. shorewall6-zones
http://www.shorewall.net/manpages6/shorewall6-zones.html
3. http://www.shorewall.net/FAQ.htm#faq18
http://www.shorewall.net/FAQ.htm#faq18
4. shorewall6-nesting
http://www.shorewall.net/manpages6/shorewall6-nesting.html
5. shorewall6-blacklist
http://www.shorewall.net/manpages6/shorewall6-blacklist.html
6. simple bridge
http://www.shorewall.net/SimpleBridge.html
7. Shorewall-perl for firewall/bridging
http://www.shorewall.net/bridge-Shorewall-perl.html
8. shorewall-rules
http://www.shorewall.net/manpages/shorewall-rules.html
9. http://www.shorewall.net/Dynamic.html
http://www.shorewall.net/Dynamic.html
10. http://www.shorewall.net/bridge-Shorewall-perl.html#Multiple
http://www.shorewall.net/bridge-Shorewall-perl.html#Multiple
11. http://www.shorewall.net/configuration_file_basics.htm#Pairs
http://www.shorewall.net/configuration_file_basics.htm#Pairs