3/11/2002 - Shorewall 1.2.9 Released
In this version:
![]() | Filtering by MAC address has been added.
MAC addresses may be used as the source address in:
| ||||||||
![]() | Several bugs have been fixed |
3/1/2002 - 1.2.8 Debian Package is Available
See http://security.dsi.unimi.it/~lorenzo/debian.html
2/25/2002 - New Two-interface Sample
I've enhanced the two interface sample to allow access from the firewall to servers in the local zone - http://www.shorewall.net/pub/shorewall/LATEST.samples/two-interfaces.tgz
2/23/2002 - Shorewall 1.2.8 Released
Do to a serious problem with 1.2.7, I am releasing 1.2.8. It corrects problems associated with the lock file used to prevent multiple state-changing operations from occuring simultaneously. My apologies for any inconvenience my carelessness may have caused.
2/22/2002 - Shorewall 1.2.7 Released
In this version:
![]() | UPnP probes (UDP destination port 1900) are now silently dropped in the common chain |
![]() | RFC 1918 checking in the mangle table has been streamlined to no longer require packet marking. RFC 1918 checking in the filter table has been changed to require half as many rules as previously. |
![]() | A 'shorewall check' command has been added that does a cursory validation of the zones, interfaces, hosts, rules and policy files. |
2/18/2002 - 1.2.6 Debian Package is Available
See http://security.dsi.unimi.it/~lorenzo/debian.html
2/8/2002 - Shorewall 1.2.6 Released
In this version:
![]() | $-variables may now be used anywhere in the configuration files except /etc/shorewall/zones. |
![]() | The interfaces and hosts files now have their contents validated before any changes are made to the existing Netfilter configuration. The appearance of a zone name that isn't defined in /etc/shorewall/zones causes "shorewall start" and "shorewall restart" to abort without changing the Shorewall state. Unknown options in either file cause a warning to be issued. |
![]() | A problem occurring when BLACKLIST_LOGLEVEL was not set has been corrected. |
2/4/2002 - Shorewall 1.2.5 Debian Package Available
see http://security.dsi.unimi.it/~lorenzo/debian.html
2/1/2002 - Shorewall 1.2.5 Released
Due to installation problems with Shorewall 1.2.4, I have released Shorewall 1.2.5. Sorry for the rapid-fire development.
In version 1.2.5:
![]() | The installation problems have been corrected. |
![]() | SNAT is now supported. |
![]() | A "shorewall version" command has been added |
![]() | The default value of the STATEDIR variable in /etc/shorewall/shorewall.conf has been changed to /var/lib/shorewall in order to conform to the Linux File Hierarchy Standard, Version 2.2. |
1/28/2002 - Shorewall 1.2.4 Released
![]() | The "fw" zone may now be given a different name. |
![]() | You may now place end-of-line comments (preceded by '#') in any of the configuration files |
![]() | There is now protection against against two state changing operations occuring concurrently. This is implemented using the 'lockfile' utility if it is available (lockfile is part of procmail); otherwise, a less robust technique is used. The lockfile is created in the STATEDIR defined in /etc/shorewall/shorewall.conf and has the name "lock". |
![]() | "shorewall start" no longer fails if "detect" is specified in /etc/shorewall/interfaces for an interface with subnet mask 255.255.255.255. |
1/27/2002 - Shorewall 1.2.3 Debian Package Available -- see http://security.dsi.unimi.it/~lorenzo/debian.html
1/20/2002 - Corrected firewall script available
Corrects a problem with BLACKLIST_LOGLEVEL. See the errata for details.
1/19/2002 - Shorewall 1.2.3 Released
This is a minor feature and bugfix release. The single new feature is:
![]() | Support for TCP MSS Clamp to PMTU -- This support is usually required when the internet connection is via PPPoE or PPTP and may be enabled using the CLAMPMSS option in /etc/shorewall/shorewall.conf. |
The following problems were corrected:
![]() | The "shorewall status" command no longer hangs. |
![]() | The "shorewall monitor" command now displays the icmpdef chain |
![]() | The CLIENT PORT(S) column in tcrules is no longer ignored |
1/18/2002 - Shorewall 1.2.2 packaged with new LEAF release
Jacques Nilo and Eric Wolzak have released a kernel 2.4.16 LEAF distribution that includes Shorewall 1.2.2. See http://leaf.sourceforge.net/devel/jnilo for details.
1/11/2002 - Debian Package (.deb) Now Available - Thanks to Lorenzo Martignoni, a 1.2.2 Shorewall Debian package is now available. There is a link to Lorenzo's site from the Shorewall download page.
1/9/2002 - Updated 1.2.2 /sbin/shorewall available - This corrected version restores the "shorewall status" command to health.
1/8/2002 - Shorewall 1.2.2 Released
In version 1.2.2
![]() | Support for IP blacklisting has been added
| ||||||||||
![]() | Use of TCP RST replies has been expanded
| ||||||||||
![]() | A LOGFILE specification has been added to /etc/shorewall/shorewall.conf. LOGFILE is used to tell the /sbin/shorewall program where to look for Shorewall messages. |
1/5/2002 - New Parameterized Samples (version 1.2.0) released. These are minor updates to the previously-released samples. There are two new rules added:
![]() | Unless you have explicitly enabled Auth connections (tcp port 113) to your firewall, these connections will be REJECTED rather than DROPPED. This speeds up connection establishment to some servers. |
![]() | Orphan DNS replies are now silently dropped. |
See the README file for upgrade instructions.
1/1/2002 - Shorewall Mailing List Moving
The Shorewall mailing list hosted at Sourceforge is moving to Shorewall.net. If you are a current subscriber to the list at Sourceforge, please see these instructions. If you would like to subscribe to the new list, visit http://www.shorewall.net/mailman/listinfo/shorewall-users.
12/31/2001 - Shorewall 1.2.1 Released
In version 1.2.1:
![]() | Logging of Mangled/Invalid Packets is added. |
![]() | The tunnel script has been corrected. |
![]() | 'shorewall show tc' now correctly handles tunnels. |
12/21/2001 - Shorewall 1.2.0 Released! - I couldn't resist releasing 1.2 on 12/21/2001
Version 1.2 contains the following new features:
![]() | Support for Traffic Control/Shaping |
![]() | Support for Filtering of Mangled/Invalid Packets |
![]() | Support for GRE Tunnels |
For the next month or so, I will continue to provide corrections to version 1.1.18 as necessary so that current version 1.1.x users will not be forced into a quick upgrade to 1.2.0 just to have access to bug fixes.
For those of you who have installed one of the Beta RPMS, you will need to use the "--oldpackage" option when upgrading to 1.2.0:
rpm -Uvh --oldpackage shorewall-1.2-0.noarch.rpm
12/19/2001 - Thanks to Steve Cowles, there is now a Shorewall mirror in Texas. This web site is mirrored at http://www.infohiiway.com/shorewall and the ftp site is at ftp://ftp.infohiiway.com/pub/mirrors/shorewall.
11/30/2001 - A new set of the parameterized Sample Configurations has been released. In this version:
![]() | Ping is now allowed between the zones. |
![]() | In the three-interface configuration, it is now possible to configure the internet services that are to be available to servers in the DMZ. |
11/20/2001 - The current version of Shorewall is 1.1.18.
In this version:
![]() | The spelling of ADD_IP_ALIASES has been corrected in the shorewall.conf file |
![]() | The logic for deleting user-defined chains has been simplified so that it avoids a bug in the LRP version of the 'cut' utility. |
![]() | The /var/lib/lrpkg/shorwall.conf file has been corrected to properly display the NAT entry in that file. |
11/19/2001 - Thanks to Juraj Ontkanin, there is now a Shorewall mirror in the Slovak Republic. The website is now mirrored at http://www.nrg.sk/mirror/shorewall and the FTP site is mirrored at ftp://ftp.nrg.sk/mirror/shorewall.
11/2/2001 - Announcing Shorewall Parameter-driven Sample Configurations. There are three sample configurations:
![]() | One Interface -- for a standalone system. |
![]() | Two Interfaces -- A masquerading firewall. |
![]() | Three Interfaces -- A masquerading firewall with DMZ. |
Samples may be downloaded from ftp://ftp.shorewall.net/pub/shorewall/samples-1.1.17 . See the README file for instructions.
11/1/2001 - The current version of Shorewall is 1.1.17. I intend this to be the last of the 1.1 Shorewall releases.
In this version:
![]() | The handling of ADD_IP_ALIASES has been corrected. |
10/22/2001 - The current version of Shorewall is 1.1.16. In this version:
![]() | A new "shorewall show connections" command has been added. |
![]() | In the "shorewall monitor" output, the currently tracked connections are now shown on a separate page. |
![]() | Prior to this release, Shorewall unconditionally added the external IP adddress(es) specified in /etc/shorewall/nat. Beginning with version 1.1.16, a new parameter (ADD_IP_ALIASES) may be set to "no" (or "No") to inhibit this behavior. This allows IP aliases created using your distribution's network configuration tools to be used in static NAT. |
10/15/2001 - The current version of Shorewall is 1.1.15. In this version:
![]() | Support for nested zones has been improved. See the documentation for details |
![]() | Shorewall now correctly checks the alternate configuration directory for the 'zones' file. |
10/4/2001 - The current version of Shorewall is 1.1.14. In this version
![]() | Shorewall now supports alternate configuration directories. When an
alternate directory is specified when starting or restarting Shorewall
(e.g., "shorewall -c /etc/testconf restart"), Shorewall will first
look for configuration files in the alternate directory then in
/etc/shorewall. To create an alternate configuration simply: 1. Create a New Directory 2. Copy to that directory any of your configuration files that you want to change. 3. Modify the copied files as needed. 4. Restart Shorewall specifying the new directory. |
![]() | The rules for allowing/disallowing icmp echo-requests (pings) are now moved after rules created when processing the rules file. This allows you to add rules that selectively allow/deny ping based on source or destination address. |
![]() | Rules that specify multiple client ip addresses or subnets no longer cause startup failures. |
![]() | Zone names in the policy file are now validated against the zones file. |
![]() | If you have packet mangling support enabled, the "norfc1918" interface option now logs and drops any incoming packets on the interface that have an RFC 1918 destination address. |
9/12/2001 - The current version of Shorewall is 1.1.13. In this version
![]() | Shell variables can now be used to parameterize Shorewall rules. |
![]() | The second column in the hosts file may now contain a comma-separated
list. Example: sea eth0:130.252.100.0/24,206.191.149.0/24 |
![]() | Handling of multi-zone interfaces has been improved. See the documentation for the /etc/shorewall/interfaces file. |
8/28/2001 - The current version of Shorewall is 1.1.12. In this version
![]() | Several columns in the rules file may now contain comma-separated lists. |
![]() | Shorewall is now more rigorous in parsing the options in /etc/shorewall/interfaces. |
![]() | Complementation using "!" is now supported in rules. |
7/28/2001 - The current version of Shorewall is 1.1.11. In this version
![]() | A "shorewall refresh" command has been added to allow for refreshing the rules associated with the broadcast address on a dynamic interface. This command should be used in place of "shorewall restart" when the internet interface's IP address changes. |
![]() | The /etc/shorewall/start file (if any) is now processed after all temporary rules have been deleted. This change prevents the accidental removal of rules added during the processing of that file. |
![]() | The "dhcp" interface option is now applicable to firewall interfaces used by a DHCP server running on the firewall. |
![]() | The RPM can now be built from the .tgz file using "rpm -tb" |
7/6/2001 - The current version of Shorewall is 1.1.10. In this version
![]() | Shorewall now enables Ipv4 Packet Forwarding by default. Packet forwarding may be disabled by specifying IP_FORWARD=Off in /etc/shorewall/shorewall.conf. If you don't want Shorewall to enable or disable packet forwarding, add IP_FORWARDING=Keep to your /etc/shorewall/shorewall.conf file. |
![]() | The "shorewall hits" command no longer lists extraneous service names in its last report. |
![]() | Erroneous instructions in the comments at the head of the firewall script have been corrected. |
6/23/2001 - The current version of Shorewall is 1.1.9. In this version
![]() | The "tunnels" file really is in the RPM now. |
![]() | SNAT can now be applied to port-forwarded connections. |
![]() | A bug which would cause firewall start failures in some dhcp configurations has been fixed. |
![]() | The firewall script now issues a message if you have the name of an interface in the second column in an entry in /etc/shorewall/masq and that interface is not up. |
![]() | You can now configure Shorewall so that it doesn't require the NAT and/or mangle netfilter modules. |
![]() | Thanks to Alex Polishchuk, the "hits" command from seawall is now in shorewall. |
![]() | Support for IPIP tunnels has been added. |
6/18/2001 - The current version of Shorewall is 1.1.8. In this version
![]() | A typo in the sample rules file has been corrected. |
![]() | It is now possible to restrict masquerading by destination host or subnet. |
![]() | It is now possible to have static NAT rules applied to packets originating on the firewall itself. |
6/2/2001 - The current version of Shorewall is 1.1.7. In this version
![]() | The TOS rules are now deleted when the firewall is stopped. |
![]() | The .rpm will now install regardless of which version of iptables is installed. |
![]() | The .rpm will now install without iproute2 being installed. |
![]() | The documentation has been cleaned up. |
![]() | The sample configuration files included in Shorewall have been formatted to 80 columns for ease of editing on a VGA console. |
5/25/2001 - The current version of Shorewall is 1.1.6. In this version
![]() | You may now rate-limit the packet log. |
![]() | Previous versions of Shorewall have an implementation of Static NAT which violates the principle of least surprise. NAT only occurs for packets arriving at (DNAT) or send from (SNAT) the interface named in the INTERFACE column of /etc/shorewall/nat. Beginning with version 1.1.6, NAT effective regardless of which interface packets come from or are destined to. To get compatibility with prior versions, I have added a new "ALL "ALL INTERFACES" column to /etc/shorewall/nat. By placing "no" or "No" in the new column, the NAT behavior of prior versions may be retained. |
![]() | The treatment of IPSEC Tunnels where the remote gateway is a standalone system has been improved. Previously, it was necessary to include an additional rule allowing UDP port 500 traffic to pass through the tunnel. Shorewall will now create this rule automatically when you place the name of the remote peer's zone in a new GATEWAY ZONE column in /etc/shorewall/tunnels. |
5/20/2001 - The current version of Shorewall is 1.1.5. In this version
![]() | You may now pass parameters when loading netfilter modules and you can specify the modules to load. |
![]() | Compressed modules are now loaded. This requires that you modutils support loading compressed modules. |
![]() | You may now set the Type of Service (TOS) field in packets. |
![]() | Corrected rules generated for port redirection (again). |
5/10/2001 - The current version of Shorewall is 1.1.4. In this version
![]() | Accepting RELATED connections is now optional. |
![]() | Corrected problem where if "shorewall start" aborted early (due to kernel configuration errors for example), superfluous 'sed' error messages were reported. |
![]() | Corrected rules generated for port redirection. |
![]() | The order in which iptables kernel modules are loaded has been corrected (Thanks to Mark Pavlidis). |
4/28/2001 - The current version of Shorewall is 1.1.3. In this version
![]() | Correct message issued when Proxy ARP address added (Thanks to Jason Kirtland). |
![]() | /tmp/shorewallpolicy-$$ is now removed if there is an error while starting the firewall. |
![]() | /etc/shorewall/icmp.def and /etc/shorewall/common.def are now used to define the icmpdef and common chains unless overridden by the presence of /etc/shorewall/icmpdef or /etc/shorewall/common. |
![]() | In the .lrp, the file /var/lib/lrpkg/shorwall.conf has been corrected. An extra space after "/etc/shorwall/policy" has been removed and "/etc/shorwall/rules" has been added. |
![]() | When a sub-shell encounters a fatal error and has stopped the firewall, it now kills the main shell so that the main shell will not continue. |
![]() | A problem has been corrected where a sub-shell stopped the firewall and main shell continued resulting in a perplexing error message referring to "common.so" resulted. |
![]() | Previously, placing "-" in the PORT(S) column in /etc/shorewall/rules resulted in an error message during start. This has been corrected. |
![]() | The first line of "install.sh" has been corrected -- I had inadvertently deleted the initial "#". |
4/12/2001 - The current version of Shorewall is 1.1.2. In this version
![]() | Port redirection now works again. |
![]() | The icmpdef and common chains may now be user-defined. |
![]() | The firewall no longer fails to start if "routefilter" is specified for an interface that isn't started. A warning message is now issued in this case. |
![]() | The LRP Version is renamed "shorwall" for 8,3 MSDOS file system compatibility. |
![]() | A couple of LRP-specific problems were corrected. |
4/8/2001 - Shorewall is now affiliated with the Leaf
Project
4/5/2001 - The current version of Shorewall is 1.1.1. In this version:
![]() | The common chain is traversed from INPUT, OUTPUT and FORWARD before logging occurs |
![]() | The source has been cleaned up dramatically |
![]() | DHCP DISCOVER packets with RFC1918 source addresses no longer generate log messages. Linux DHCP clients generate such packets and it's annoying to see them logged. |
3/25/2001 - The current version of Shorewall is 1.1.0. In this version:
![]() | Log messages now indicate the packet disposition. |
![]() | Error messages have been improved. |
![]() | The ability to define zones consisting of an enumerated set of hosts and/or subnetworks has been added. |
![]() | The zone-to-zone chain matrix is now sparse so that only those chains that contain meaningful rules are defined. |
![]() | 240.0.0.0/4 and 169.254.0.0/16 have been added to the source subnetworks whose packets are dropped under the norfc1918 interface option. |
![]() | Exits are now provided for executing an user-defined script when a chain is defined, when the firewall is initialized, when the firewall is started, when the firewall is stopped and when the firewall is cleared. |
![]() | The Linux kernel's route filtering facility can now be specified selectively on network interfaces. |
3/19/2001 - The current version of Shorewall is 1.0.4. This version:
![]() | Allows user-defined zones. Shorewall now has only one pre-defined zone (fw) with the remaining zones being defined in the new configuration file /etc/shorewall/zones. The /etc/shorewall/zones file released in this version provides behavior that is compatible with Shorewall 1.0.3. |
![]() | Adds the ability to specify logging in entries in the /etc/shorewall/rules file. |
![]() | Correct handling of the icmp-def chain so that only ICMP packets are sent through the chain. |
![]() | Compresses the output of "shorewall monitor" if awk is installed. Allows the command to work if awk isn't installed (although it's not pretty). |
3/13/2001 - The current version of Shorewall is 1.0.3. This is a bug-fix release with no new features.
![]() | The PATH variable in the firewall script now includes /usr/local/bin and /usr/local/sbin. |
![]() | DMZ-related chains are now correctly deleted if the DMZ is deleted. |
![]() | The interface OPTIONS for "gw" interfaces are no longer ignored. |
3/8/2001 - The current version of Shorewall is 1.0.2. It supports an additional "gw" (gateway) zone for tunnels and it supports IPSEC tunnels with end-points on the firewall. There is also a .lrp available now.
Updated 3/1/2002 - Tom Eastep