<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Shorewall Features</title><link rel="stylesheet" href="html.css" type="text/css" /><meta name="generator" content="DocBook XSL Stylesheets V1.73.2" /></head><body><div class="article" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title"><a id="shorewall_features"></a>Shorewall Features</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Tom</span> <span class="surname">Eastep</span></h3></div></div><div><p class="copyright">Copyright © 2001-2007 Thomas M Eastep</p></div><div><div class="legalnotice"><a id="id288224"></a><p>Permission is granted to copy, distribute and/or modify this
document under the terms of the GNU Free Documentation License, Version
1.2 or any later version published by the Free Software Foundation; with
no Invariant Sections, with no Front-Cover, and with no Back-Cover
Texts. A copy of the license is included in the section entitled
“<span class="quote"><a class="ulink" href="GnuCopyright.htm" target="_self">GNU Free Documentation
License</a></span>”.</p></div></div><div><p class="pubdate">2008/12/15</p></div></div><hr /></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="section"><a href="#Features">Features</a></span></dt></dl></div><div class="caution" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Caution</h3><p><span class="bold"><strong>This article applies to Shorewall 3.0 and
later. If you are running a version of Shorewall earlier than Shorewall
3.0.0 then please see the documentation for that
release.</strong></span></p></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Features"></a>Features</h2></div></div></div><div class="itemizedlist"><ul type="disc"><li><p>Uses Netfilter's connection tracking facilities for stateful
packet filtering.</p></li><li><p>Can be used in<span class="bold"><strong> a wide range of
router/firewall/gateway applications</strong></span> .</p><div class="itemizedlist"><ul type="circle"><li><p>Completely customizable using configuration files.</p></li><li><p>No limit on the number of network interfaces.</p></li><li><p>Allows you to partition the network into <a class="ulink" href="manpages/shorewall-zones.html" target="_self">zones</a> and gives you complete
control over the connections permitted between each pair of
zones.</p></li><li><p>Multiple interfaces per zone and multiple zones per
interface permitted.</p></li><li><p>Supports nested and overlapping zones.</p></li></ul></div></li><li><p><a class="ulink" href="shorewall_quickstart_guide.htm" target="_self">QuickStart Guides
(HOWTOs)</a> to help get your first firewall up and running
quickly</p></li><li><p>A <span class="bold"><strong>GUI</strong></span> is available via Webmin
1.060 and later (<a class="ulink" href="http://www.webmin.com" target="_self">http://www.webmin.com</a>)</p></li><li><p>Extensive <span class="bold"><strong><a class="ulink" href="Documentation_Index.html" target="_self">documentation</a></strong></span> is
available in both Docbook XML and HTML formats.</p></li><li><p><span class="bold"><strong>Flexible address management/routing
support</strong></span> (and you can use all types in the same
firewall):</p><div class="itemizedlist"><ul type="circle"><li><p><a class="ulink" href="manpages/shorewall-masq.html" target="_self">Masquerading/SNAT</a>.</p></li><li><p><a class="ulink" href="FAQ.htm#faq1" target="_self">Port Forwarding
(DNAT)</a>.</p></li><li><p><a class="ulink" href="NAT.htm" target="_self">One-to-one NAT</a>.</p></li><li><p><a class="ulink" href="ProxyARP.htm" target="_self">Proxy ARP</a>.</p></li><li><p><a class="ulink" href="netmap.html" target="_self">NETMAP</a> (requires a 2.6
kernel or a patched 2.4 kernel).</p></li><li><p><a class="ulink" href="Shorewall_and_Routing.html" target="_self">Multiple ISP
support</a></p></li></ul></div></li><li><p><a class="ulink" href="blacklisting_support.htm" target="_self"><span class="bold"><strong>Blacklisting</strong></span></a> of individual IP addresses
and subnetworks is supported.</p></li><li><p><a class="ulink" href="starting_and_stopping_shorewall.htm" target="_self">Operational
Support</a>.</p><div class="itemizedlist"><ul type="circle"><li><p>Commands to start, stop and clear the firewall</p></li><li><p>Supports status monitoring with an audible alarm when an
“<span class="quote">interesting</span>” packet is detected.</p></li><li><p>Wide variety of informational commands.</p></li></ul></div></li><li><p><span class="bold"><strong>VPN Support</strong></span>.</p><div class="itemizedlist"><ul type="circle"><li><p><a class="ulink" href="manpages/shorewall-tunnels.html" target="_self">IPSEC, GRE, IPIP and
OpenVPN Tunnels</a>.</p></li><li><p><a class="ulink" href="PPTP.htm" target="_self">PPTP</a> clients and
Servers.</p></li></ul></div></li><li><p>Support for <a class="ulink" href="traffic_shaping.htm" target="_self"><span class="bold"><strong>Traffic</strong></span> Control/<span class="bold"><strong>Shaping</strong></span></a>.</p></li><li><p>Wide support for different <span class="bold"><strong>GNU/Linux
Distributions</strong></span>.</p><div class="itemizedlist"><ul type="circle"><li><p><a class="ulink" href="Install.htm#Install_RPM" target="_self">RPM</a> and <a class="ulink" href="http://idea.sec.dico.unimi.it/%7Elorenzo/index.html#Debian" target="_self">Debian</a>
packages available.</p></li><li><p>Includes automated <a class="ulink" href="Install.htm" target="_self">install,
upgrade, fallback and uninstall facilities</a> for users who
can't use or choose not to use the RPM or Debian packages.</p></li><li><p>Included as a standard part of <a class="ulink" href="http://leaf.sourceforge.net/devel/jnilo" target="_self">LEAF/Bering</a>
(router/firewall on a floppy, CD or compact flash).</p></li></ul></div></li><li><p><a class="ulink" href="MAC_Validation.html" target="_self">Media Access Control (<span class="bold"><strong>MAC</strong></span>) Address <span class="bold"><strong>Verification</strong></span></a>.</p></li><li><p><span class="bold"><strong><a class="ulink" href="Accounting.html" target="_self">Traffic
Accounting</a>.</strong></span></p></li><li><p><a class="ulink" href="bridge-Shorewall-perl.html" target="_self"><span class="bold"><strong>Bridge</strong></span>/Firewall support</a></p></li></ul></div></div></div></body></html>
