<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Compiled Firewall Programs and Shorewall Lite</title><link rel="stylesheet" href="html.css" type="text/css" /><meta name="generator" content="DocBook XSL Stylesheets V1.73.2" /></head><body><div class="article" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title"><a id="id257527"></a>Compiled Firewall Programs and Shorewall Lite</h2></div><div><div class="authorgroup"><div class="author"><h3 class="author"><span class="firstname">Tom</span> <span class="surname">Eastep</span></h3></div></div></div><div><p class="copyright">Copyright © 2006-2007 Thomas M. Eastep</p></div><div><div class="legalnotice"><a id="id292634"></a><p>Permission is granted to copy, distribute and/or modify this
document under the terms of the GNU Free Documentation License, Version
1.2 or any later version published by the Free Software Foundation; with
no Invariant Sections, with no Front-Cover, and with no Back-Cover
Texts. A copy of the license is included in the section entitled
“<span class="quote"><a class="ulink" href="GnuCopyright.htm" target="_self">GNU Free Documentation
License</a></span>”.</p></div></div><div><p class="pubdate">2008/12/15</p></div></div><hr /></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="section"><a href="#Overview">Overview</a></span></dt><dd><dl><dt><span class="section"><a href="#Restrictions">Restrictions</a></span></dt></dl></dd><dt><span class="section"><a href="#Compile">The "shorewall compile" command</a></span></dt><dt><span class="section"><a href="#Lite">Shorewall Lite</a></span></dt><dd><dl><dt><span class="section"><a href="#Converting">Converting a system from Shorewall to Shorewall Lite</a></span></dt></dl></dd><dt><span class="section"><a href="#Shorecap">The /etc/shorewall/capabilities file and the shorecap
program</a></span></dt><dt><span class="section"><a href="#Running">Running compiled programs directly</a></span></dt></dl></div><div class="caution" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Caution</h3><p><span class="bold"><strong>This article applies to Shorewall 4.0 and
later. If you are running a version of Shorewall earlier than Shorewall
4.0.0 then please see the documentation appropriate for your
version.</strong></span></p></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Overview"></a>Overview</h2></div></div></div><p>Beginning with Shorewall version 3.1, Shorewall has the capability
to compile a Shorewall configuration and produce a runnable firewall
program script. The script is a complete program which can be placed on a
system with <span class="emphasis"><em>Shorewall Lite</em></span> installed and can serve as
the firewall creation script for that system.</p><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="Restrictions"></a>Restrictions</h3></div></div></div><p>While compiled Shorewall programs are useful in many cases, there
are some important restrictions that you should be aware of before
attempting to use them.</p><div class="orderedlist"><ol type="1"><li><p>The <span class="bold"><strong>detectnets</strong></span> interface
option is not supported.</p></li><li><p>DYNAMIC_ZONES=Yes in <code class="filename">shorewall.conf</code> is
not supported.</p></li><li><p>All extension scripts used are copied into the program (with
the exception of <a class="ulink" href="shorewall_extension_scripts.htm" target="_self">those
executed at compile-time by Shorewall-perl</a>). The
ramifications of this are:</p><div class="itemizedlist"><ul type="disc"><li><p>If you update an extension script, the compiled program
will not use the updated script.</p></li><li><p>Beginning with Shorewall 3.2.9 and 3.4.0 RC2, the
<code class="filename">params</code> file is only processed at compile
time if you set EXPORTPARAMS=No in
<code class="filename">shorewall.conf</code>. For run-time setting of
shell variables, use the <code class="filename">init</code> extension
script. Although the default setting is EXPORTPARAMS=Yes for
compatibility, the recommended setting is
EXPORTPARAMS=No.</p><p>If the <code class="filename">params</code> file needs to set shell
variables based on the configuration of the firewall system, you
can use this trick:</p><pre class="programlisting">EXT_IP=$(ssh root@firewall "/sbin/shorewall-lite call find_first_interface_address eth0")</pre><p>The <span class="command"><strong>shorewall-lite call</strong></span> command allows
you to to call interactively any Shorewall function that you can
call in an extension script.</p></li></ul></div></li><li><p>You must install Shorewall Lite on the system where you want
to run the script. You then install the compiled program in
/usr/share/shorewall-lite/firewall and use the /sbin/shorewall-lite
program included with Shorewall Lite to control the firewall just as
if the full Shorewall distribution was installed.</p></li></ol></div></div></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Compile"></a>The "shorewall compile" command</h2></div></div></div><p>A compiled script is produced using the <span class="command"><strong>compile</strong></span>
command:</p><div class="blockquote"><blockquote class="blockquote"><p><span class="command"><strong>shorewall compile [ -e ] [ C {perl|shell} ] [
<directory name> ] <path name></strong></span></p></blockquote></div><p>where</p><div class="blockquote"><blockquote class="blockquote"><div class="variablelist"><dl><dt><span class="term">-e</span></dt><dd><p>Indicates that the program is to be "exported" to another
system. When this flag is set, neither the "detectnets" interface
option nor DYNAMIC_ZONES=Yes in shorewall.conf are allowed. The
created program may be run on a system that has only Shorewall
Lite installed</p><p>When this flag is given, Shorewall does not probe the
current system to determine the kernel/iptables features that it
supports. It rather reads those capabilities from
<code class="filename">/etc/shorewall/capabilities</code>. See below for
details.</p></dd><dt><span class="term">-C {perl|shell}</span></dt><dd><p>Specifies the compiler to use. Overrides the
SHOREWALL_COMPILER setting in <code class="filename"><a class="ulink" href="manpages/shorewall.conf.html" target="_self">shorewall.conf</a></code>.</p></dd><dt><span class="term"><directory name></span></dt><dd><p>specifies a directory to be searched for configuration files
before those directories listed in the CONFIG_PATH variable in
<code class="filename">shorewall.conf</code>.</p><p>When -e <directory-name> is included, only the
SHOREWALL_SHELL and VERBOSITY settings from
<code class="filename">/etc/shorewall/shorewall.conf</code> are used and
these apply only to the compiler itself. The settings used by the
compiled firewall script are determined by the contents of
<code class="filename"><directory name>/shorewall.conf</code>.</p></dd><dt><span class="term"><path name></span></dt><dd><p>specifies the name of the script to be created.</p></dd></dl></div></blockquote></div></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Lite"></a>Shorewall Lite</h2></div></div></div><p>Shorewall Lite is a companion product to Shorewall and is designed
to allow you to maintain all Shorewall configuration information on a
single system within your network.</p><div class="orderedlist"><ol type="a"><li><p>You install the full Shorewall release on one system within your
network. You need not configure Shorewall there and you may totally
disable startup of Shorewall in your init scripts. For ease of
reference, we call this system the 'administrative system'.</p></li><li><p>On each system where you wish to run a Shorewall-generated
firewall, you install Shorewall Lite. For ease of reference, we will
call these systems the 'firewall systems'.</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>The firewall systems do <span class="bold"><strong>NOT</strong></span>
need to have the full Shorewall product installed but rather only
the Shorewall Lite product. Shorewall and Shorewall Lite may be
installed on the same system but that isn't encouraged.</p></div></li><li><p>On the administrative system you create a separate 'export
directory' for each firewall system. You copy the contents of
<code class="filename">/usr/share/shorewall/configfiles</code> into
each export directory.</p></li><li><p>The <code class="filename">/etc/shorewall/shorewall.conf</code> file is
used to determine several settings during the compilation process,
even though there is a shorewall.conf file in the export directory.
<code class="filename">/sbin/shorewall</code> uses the SHOREWALL_COMPILER
setting from <code class="filename">/etc/shorewall/shorewall.conf</code> to
determine which compiler to launch. If the compiler is
shorewall-shell, then the SHOREWALL_SHELL setting from
<code class="filename">/etc/shorewall/shorewall.conf</code> determines the
shell to use. <code class="filename">/sbin/shorewall</code> also uses the
VERBOSITY setting from
<code class="filename">/etc/shorewall/shorewall.conf</code> for determining how
much output the compiler generates. All other settings are taken from
the <code class="filename">shorewall.conf </code>file in the remote systems
export directory.</p><div class="caution" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Caution</h3><p>If you want to be able to allow non-root users to manage
remote firewall systems, then the files
<code class="filename">/etc/shorewall/params</code> and
<code class="filename">/etc/shorewall/shorewall.conf</code> must be readable
by all users on the administrative system. Not all packages secure
the files that way and you may have to change the file permissions
yourself.</p></div></li><li><p><a id="Debian"></a>On each firewall system, If you are running Debian or one of its
derivatives like Ubuntu then edit
<code class="filename">/etc/default/shorewall-lite</code> and set
startup=1.</p></li><li><p>On the administrative system, for each firewall system you do
the following (this may be done by a non-root user who has root ssh
access to the firewall system):</p><div class="orderedlist"><ol type="i"><li><p>modify the files in the corresponding export directory
appropriately. It's a good idea to include the IP address of the
administrative system in the <code class="filename">routestopped</code>
file.</p><p>It is important to understand that with Shorewall Lite, the
firewall's export directory on the administrative system acts as
<code class="filename">/etc/shorewall</code> for that
firewall. So when the Shorewall documentation gives instructions
for placing entries in files in the firewall's <code class="filename">/etc/shorewall</code>, when using Shorewall
Lite you make those changes in the firewall's export directory on
the administrative system.</p><p>The CONFIG_PATH variable is treated as follows:</p><div class="itemizedlist"><ul type="disc"><li><p>The value of CONFIG_PATH in
<code class="filename">/etc/shorewall/shorewall.conf</code> is ignored
when compiling for export (the -e option in given) and when
the <span class="command"><strong>load</strong></span> or <span class="command"><strong>reload</strong></span>
command is being executed (see below).</p></li><li><p>The value of CONFIG_PATH in the
<code class="filename">shorewall.conf</code> file in the export
directory is used to search for configuration files during
compilation of that configuration.</p></li><li><p>The value of CONFIG_PATH used when the script is run on
the firewall system is
"/etc/shorewall-lite:/usr/share/shorewall-lite".</p></li></ul></div></li><li><pre class="programlisting"><span class="command"><strong>cd <export directory></strong></span>
<span class="command"><strong>/sbin/shorewall load -c firewall</strong></span></pre><p>The <a class="ulink" href="starting_and_stopping_shorewall.htm#Load" target="_self"><span class="command"><strong>load</strong></span></a>
command compiles a firewall script from the configuration files in
the current working directory (using <span class="command"><strong>shorewall compile
-e</strong></span>), copies that file to the remote system via scp and
starts Shorewall Lite on the remote system via ssh. The -c option
causes the capabilities of the remote system to be generated and
copied to a file named capabilities in the export directory. See
<a class="link" href="#Shorecap" title="The /etc/shorewall/capabilities file and the shorecap program">below</a>.</p><p>Example (firewall's DNS name is 'gateway'):</p><p><span class="command"><strong>/sbin/shorewall load -c gateway</strong></span></p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>Although scp and ssh are used by default, you can use
other utilities by setting RSH_COMMAND and RCP_COMMAND in
<code class="filename">/etc/shorewall/shorewall.conf</code>. </p></div></li></ol></div></li><li><p>If you later need to change the firewall's configuration, change
the appropriate files in the firewall's export directory then:</p><pre class="programlisting"><span class="command"><strong>cd <export directory></strong></span>
<span class="command"><strong>/sbin/shorewall reload firewall</strong></span></pre><p>The <a class="ulink" href="manpages/shorewall.html" target="_self"><span class="command"><strong>reload</strong></span></a>
command compiles a firewall script from the configuration files in the
current working directory (using <span class="command"><strong>shorewall compile
-e</strong></span>), copies that file to the remote system via scp and
restarts Shorewall Lite on the remote system via ssh. Note: In
Shorewall 3.2.6 and later, the <span class="bold"><strong>reload</strong></span>
command also supports the '-c' option.</p><p>I personally place a <code class="filename">Makefile</code> in each
export directory as follows:</p><div class="blockquote"><blockquote class="blockquote"><pre class="programlisting"># Shorewall Packet Filtering Firewall Export Directory Makefile - V3.3
#
# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
#
# (c) 2006 - Tom Eastep (teastep@shorewall.net)
#
# Shorewall documentation is available at http://www.shorewall.net
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of Version 2 of the GNU General Public License
# as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
################################################################################
# Place this file in each export directory. Modify each copy to set HOST
# to the name of the remote firewall corresponding to the directory.
#
# To make the 'firewall' script, type "make".
#
# Once the script is compiling correctly, you can install it by
# typing "make install".
#
################################################################################
# V A R I A B L E S
#
# Files in the export directory on which the firewall script does not depend
#
IGNOREFILES = firewall% Makefile% trace% %~
#
# Remote Firewall system
#
HOST = gateway
#
# Save some typing
#
LITEDIR = /var/lib/shorewall-lite
#
# Set this if the remote system has a non-standard modules directory
#
MODULESDIR=
#
# Default target is the firewall script
#
################################################################################
# T A R G E T S
#
all: firewall
#
# Only generate the capabilities file if it doesn't already exist
#
capabilities:
ssh root@$(HOST) "MODULESDIR=$(MODULESDIR) /usr/share/shorewall-lite/shorecap > $(LITEDIR)/capabilities"
scp root@$(HOST):$(LITEDIR)/capabilities .
#
# Compile the firewall script. Using the 'wildcard' function causes "*" to be expanded so that
# 'filter-out' will be presented with the list of files in this directory rather than "*"
#
firewall: $(filter-out $(IGNOREFILES) capabilities , $(wildcard *) ) capabilities
shorewall compile -e . firewall
#
# Only reload on demand.
#
install: firewall
scp firewall firewall.conf root@$(HOST):$(LITEDIR)
ssh root@$(HOST) "/sbin/shorewall-lite restart"
#
# Save running configuration
#
save:
ssh root@$(HOST) "/sbin/shorewall-lite save"
#
# Remove generated files
#
clean:
rm -f capabilities firewall firewall.conf reload
</pre></blockquote></div><p>That way, after I've changed the configuration, I can simply
type <span class="command"><strong>make</strong></span> or <span class="bold"><strong>make
install</strong></span>.</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>The above Makefile is available at <a class="ulink" href="http://www1.shorewall.net/pub/shorewall/contrib/Shorewall-lite/" target="_self">http://www.shorewall.net/pub/shorewall/contrib/Shorewall-lite/</a></p></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>I omit trace% because I often trace compiler execution while
I'm debugging new versions of Shorewall.</p></div></li></ol></div><p>There is a <code class="filename">shorewall-lite.conf</code> file installed
as part of Shorewall Lite
(<code class="filename">/etc/shorewall-lite/shorewall-lite.conf</code>). You can
use that file on the firewall system to override some of the settings from
the shorewall.conf file in the export directory.</p><p>Settings that you can override are:</p><div class="blockquote"><blockquote class="blockquote"><table class="simplelist" border="0" summary="Simple list"><tr><td>VERBOSITY</td></tr><tr><td>LOGFILE</td></tr><tr><td>LOGFORMAT</td></tr><tr><td>IPTABLES</td></tr><tr><td>PATH</td></tr><tr><td>SHOREWALL_SHELL</td></tr><tr><td>SUBSYSLOCK</td></tr><tr><td>RESTOREFILE</td></tr></table></blockquote></div><p>You will normally not need to touch
<code class="filename">/etc/shorewall-lite/shorewall-lite.conf</code> unless you
run Debian or one of its derivatives (see <a class="link" href="#Debian">above</a>).</p><p>The <code class="filename">/sbin/shorewall-lite</code> program included with
Shorewall Lite supports the same set of commands as the
<code class="filename">/sbin/shorewall</code> program in a full Shorewall
installation with the following exceptions:</p><div class="blockquote"><blockquote class="blockquote"><table class="simplelist" border="0" summary="Simple list"><tr><td>add</td></tr><tr><td>compile</td></tr><tr><td>delete</td></tr><tr><td>refresh</td></tr><tr><td>reload</td></tr><tr><td>try</td></tr><tr><td>safe-start</td></tr><tr><td>safe-restart</td></tr><tr><td>show actions</td></tr><tr><td>show macros</td></tr></table></blockquote></div><p>On systems with only Shorewall Lite installed, I recommend that you
create a symbolic link <code class="filename">/sbin/shorewall</code> and point it
at <code class="filename">/sbin/shorewall-lite</code>. That way, you can use
<span class="command"><strong>shorewall</strong></span> as the command regardless of which product is
installed.</p><div class="blockquote"><blockquote class="blockquote"><pre class="programlisting"><span class="command"><strong>ln -sf shorewall-lite /sbin/shorewall</strong></span></pre></blockquote></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="Converting"></a>Converting a system from Shorewall to Shorewall Lite</h3></div></div></div><p>Converting a firewall system that is currently running Shorewall
to run Shorewall Lite instead is straight-forward.</p><div class="orderedlist"><ol type="a"><li><p>On the administrative system, create an export directory for
the firewall system.</p></li><li><p>Copy the contents of <code class="filename">/etc/shorewall/</code> from the firewall
system to the export directory on the administrative system.</p></li><li><p>On the firewall system:</p><p>Be sure that the IP address of the administrative system is
included in the firewall's export directory
<code class="filename">routestopped</code> file.</p><pre class="programlisting"><span class="command"><strong>shorewall stop</strong></span></pre><p><span class="bold"><strong>We recommend that you uninstall
Shorewall at this point.</strong></span></p></li><li><p>Install Shorewall Lite on the firewall system.</p><p>If you are running Debian or one of its derivatives like
Ubuntu then edit <code class="filename">/etc/default/shorewall-lite</code>
and set startup=1.</p></li><li><p>On the administrative system:</p><p>It's a good idea to include the IP address of the
administrative system in the firewall system's
<code class="filename">routestopped</code> file.</p><p>Also, edit the <code class="filename">shorewall.conf</code> file in the
firewall's export directory and change the CONFIG_PATH setting to
remove <code class="filename">/etc/shorewall</code>. You
can replace it with <code class="filename">/usr/share/shorewall/configfiles</code> if you
like.</p><p>Example:</p><div class="blockquote"><blockquote class="blockquote"><p>Before editing:</p><pre class="programlisting">CONFIG_PATH=/etc/shorewall:/usr/share/shorewall</pre><p>After editing:</p><pre class="programlisting">CONFIG_PATH=/usr/share/shorewall/configfiles:/usr/share/shorewall</pre></blockquote></div><p>Changing CONFIG_PATH will ensure that subsequent compilations
using the export directory will not include any files from <code class="filename">/etc/shorewall</code> other than
<code class="filename">shorewall.conf</code> and
<code class="filename">params</code>.</p><p>If you set variables in the params file, there are a couple of
issues:</p><p>Beginning with Shorewall 3.2.9 and 3.4.0 RC2, the
<code class="filename">params</code> file is only processed at compile time
if you set EXPORTPARAMS=No in <code class="filename">shorewall.conf</code>.
For run-time setting of shell variables, use the
<code class="filename">init</code> extension script.</p><p>If the <code class="filename">params</code> file needs to set shell
variables based on the configuration of the firewall system, you can
use this trick:</p><pre class="programlisting">EXT_IP=$(ssh root@firewall "/sbin/shorewall-lite call find_first_interface_address eth0")</pre><p>The <span class="command"><strong>shorewall-lite call</strong></span> command allows you
to to call interactively any Shorewall function that you can call in
an extension script.</p><p>After having made the above changes to the firewall's export
directory, execute the following commands.</p><div class="blockquote"><blockquote class="blockquote"><pre class="programlisting"><span class="command"><strong>cd <export directory></strong></span>
<span class="command"><strong>/sbin/shorewall load -c <firewall system></strong></span>
</pre><p>Example (firewall's DNS name is 'gateway'):</p><p><span class="command"><strong>/sbin/shorewall load -c gateway</strong></span></p></blockquote></div><p>The <a class="ulink" href="starting_and_stopping_shorewall.htm#Load" target="_self"><span class="command"><strong>load</strong></span></a>
command compiles a firewall script from the configuration files in
the current working directory (using <span class="command"><strong>shorewall compile
-e</strong></span>), copies that file to the remote system via
<span class="command"><strong>scp</strong></span> and starts Shorewall Lite on the remote
system via <span class="command"><strong>ssh</strong></span>.</p></li><li><p>If you later need to change the firewall's configuration,
change the appropriate files in the firewall's export directory
then:</p><pre class="programlisting"><span class="command"><strong>cd <export directory></strong></span>
<span class="command"><strong>/sbin/shorewall reload firewall</strong></span></pre><p>The <a class="ulink" href="starting_and_stopping_shorewall.htm#Reload" target="_self"><span class="command"><strong>reload</strong></span></a>
command compiles a firewall script from the configuration files in
the current working directory (using <span class="command"><strong>shorewall compile
-e</strong></span>), copies that file to the remote system via
<span class="command"><strong>scp</strong></span> and restarts Shorewall Lite on the remote
system via <span class="command"><strong>ssh</strong></span>.</p></li><li><p>If the kernel/iptables configuration on the firewall later
changes and you need to create a new
<code class="filename">capabilities</code> file, do the following on the
firewall system:</p><pre class="programlisting"><span class="command"><strong>/usr/share/shorewall-lite/shorecap > capabilities</strong></span>
<span class="command"><strong>scp capabilities <admin system>:<this system's config dir></strong></span></pre><p>Or, if you are running Shorewall 3.2.6 or later, simply use
the -c option the next time that you use the
<span class="command"><strong>reload</strong></span> command.</p></li></ol></div></div></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Shorecap"></a>The /etc/shorewall/capabilities file and the shorecap
program</h2></div></div></div><p>As mentioned above, the
<code class="filename">/etc/shorewall/capabilities</code> file specifies that
kernel/iptables capabilities of the target system. Here is a sample
file:</p><div class="blockquote"><blockquote class="blockquote"><pre class="programlisting">#
# Shorewall detected the following iptables/netfilter capabilities - Tue Jul 15 07:28:12 PDT 2008
#
NAT_ENABLED=Yes
MANGLE_ENABLED=Yes
MULTIPORT=Yes
XMULTIPORT=Yes
CONNTRACK_MATCH=Yes
USEPKTTYPE=Yes
POLICY_MATCH=Yes
PHYSDEV_MATCH=Yes
PHYSDEV_BRIDGE=Yes
LENGTH_MATCH=Yes
IPRANGE_MATCH=Yes
RECENT_MATCH=Yes
OWNER_MATCH=Yes
IPSET_MATCH=Yes
CONNMARK=Yes
XCONNMARK=Yes
CONNMARK_MATCH=Yes
XCONNMARK_MATCH=Yes
RAW_TABLE=Yes
IPP2P_MATCH=
CLASSIFY_TARGET=Yes
ENHANCED_REJECT=Yes
KLUDGEFREE=Yes
MARK=Yes
XMARK=Yes
MANGLE_FORWARD=Yes
COMMENTS=Yes
ADDRTYPE=Yes
TCPMSS_MATCH=Yes
HASHLIMIT_MATCH=Yes
NFQUEUE_TARGET=Yes
REALM_MATCH=Yes
CAPVERSION=40190</pre></blockquote></div><p>As you can see, the file contains a simple list of shell variable
assignments — the variables correspond to the capabilities listed by the
<span class="command"><strong>shorewall show capabilities</strong></span> command and they appear in
the same order as the output of that command.</p><p>To aid in creating this file, Shorewall Lite includes a
<span class="command"><strong>shorecap</strong></span> program. The program is installed in the
<code class="filename">/usr/share/shorewall-lite/</code>
directory and may be run as follows:</p><div class="blockquote"><blockquote class="blockquote"><p><span class="command"><strong>[ IPTABLES=<iptables binary> ] [
MODULESDIR=<kernel modules directory> ]
/usr/share/shorewall-lite/shorecap > capabilities</strong></span></p></blockquote></div><p>The IPTABLES and MODULESDIR options have their <a class="ulink" href="manpages/shorewall.conf.html" target="_self">usual Shorewall default
values</a>.</p><p>The <code class="filename">capabilities</code> file may then be copied to a
system with Shorewall installed and used when compiling firewall programs
to run on the remote system.</p><p>Beginning with Shorewall Lite version 3.2.2, the
<code class="filename">capabilities</code> file may also be creating using
<code class="filename">/sbin/shorewall-lite</code>:</p><div class="blockquote"><blockquote class="blockquote"><p><span class="command"><strong>shorewall-lite show -f capabilities >
capabilities</strong></span></p></blockquote></div><p>Note that unlike the <span class="command"><strong>shorecap</strong></span> program, the
<span class="command"><strong>show capabilities</strong></span> command shows the kernel's current
capabilities; it does not attempt to load additional kernel
modules.</p></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Running"></a>Running compiled programs directly</h2></div></div></div><p>Compiled firewall programs are complete programs that support the
following command line forms:</p><div class="blockquote"><blockquote class="blockquote"><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong><program> [ -q ] [ -v ] [ -n ]
start</strong></span></td></tr><tr><td><span class="command"><strong><program> [ -q ] [ -v ] [ -n ]
stop</strong></span></td></tr><tr><td><span class="command"><strong><program> [ -q ] [ -v ] [ -n ]
clear</strong></span></td></tr><tr><td><span class="command"><strong><program> [ -q ] [ -v ] [ -n ]
refresh</strong></span></td></tr><tr><td><span class="command"><strong><program> [ -q ] [ -v ] [ -n ]
reset</strong></span></td></tr><tr><td><span class="command"><strong><program> [ -q ] [ -v ] [ -n ]
restart</strong></span></td></tr><tr><td><span class="command"><strong><program> [ -q ] [ -v ] [ -n ]
status</strong></span></td></tr><tr><td><span class="command"><strong><program> [ -q ] [ -v ] [ -n ]
version</strong></span></td></tr></table></blockquote></div><p>The options have the same meanings as when they are passed to
<code class="filename">/sbin/shorewall</code> itself. The default VERBOSITY level
is the level specified in the <code class="filename">shorewall.conf</code> file
used when the program was compiled.</p></div></div></body></html>
