[Shorewall-announce] Shorewall 1.4.10-RC2
teastep at shorewall.net
Sat Jan 24 10:35:42 PST 2004
Tom Eastep \ Nothing is foolproof to a sufficiently talented fool
Shoreline, \ http://shorewall.net
Washington USA \ teastep at shorewall.net
-------------- next part --------------
This is a minor release of Shorewall.
Problems Corrected since version 1.4.9:
1. The column descriptions in the action.template file did not match
the column headings. That has been corrected.
2. The presence of IPV6 addresses on devices generates error messages
during [re]start if ADD_IP_ALIASES=Yes or ADD_SNAT_ALIASES=Yes are
specified in /etc/shorewall/shorewall.conf.
1) The INTERFACE column in the /etc/shorewall/masq file may now
specify a destination list.
#INTERFACE SUBNET ADDRESS
If the list begins with "!" then SNAT will occur only if the
destination IP address is NOT included in the list.
2) Output traffic control rules (those with the firewall as the source)
may now be qualified by the effective userid and/or effective group
id of the program generating the output. This feature is courtesy of
A new USER column has been added to /etc/shorewall/tcrules.
It may contain :
[<user name or number>]:[<group name or number>]
The colon is optionnal when specifying only a user.
Examples : john: / john / :users / john:users
3) A "detectnets" interface option has been added for entries in
/etc/shorewall/interfaces. This option automatically taylors the
definition of the zone named in the ZONE column to include just
those hosts that have routes through the interface named in the
INTERFACE column. The named interface must be UP when
Shorewall is [re]started.
WARNING: DO NOT SET THIS OPTION ON YOUR INTERNET INTERFACE!
More information about the Shorewall-announce