SHOREWALL-INTERFACE(5)						  [FIXME: manual]					    SHOREWALL-INTERFACE(5)

NAME

       interfaces - Shorewall interfaces file

SYNOPSIS

       /etc/shorewall/interfaces

DESCRIPTION

       The interfaces file serves to define the firewall's network interfaces to Shorewall. The order of entries in this file is not significant
       in determining zone composition.

       Beginning with Shorewall 4.5.3, the interfaces file supports two different formats:

       FORMAT 1 (default - deprecated)
	   There is a BROADCAST column which can be used to specify the broadcast address associated with the interface.

       FORMAT 2
	   The BROADCAST column is omitted.

       The format is specified by a line as follows:

       FORMAT {1|2}

       The columns in the file are as follows.

       ZONE - zone-name
	   Zone for this interface. Must match the name of a zone declared in /etc/shorewall/zones. You may not list the firewall zone in this
	   column.

	   If the interface serves multiple zones that will be defined in the shorewall-hosts[1](5) file, you should place "-" in this column.

	   If there are multiple interfaces to the same zone, you must list them in separate entries.

	   Example:

	       #ZONE   INTERFACE       BROADCAST
	       loc     eth1	       -
	       loc     eth2	       -

       INTERFACE - interface[:port]
	   Logical name of interface. Each interface may be listed only once in this file. You may NOT specify the name of a "virtual" interface
	   (e.g., eth0:0) here; see http://www.shorewall.net/FAQ.htm#faq18. If the physical option is not specified, then the logical name is also
	   the name of the actual interface.

	   You may use wildcards here by specifying a prefix followed by the plus sign ("+"). For example, if you want to make an entry that
	   applies to all PPP interfaces, use 'ppp+'; that would match ppp0, ppp1, ppp2, ... Please note that the '+' means 'one or more
	   additional characters' so 'ppp' does not match 'ppp+'.

	   When using Shorewall versions before 4.1.4, care must be exercised when using wildcards where there is another zone that uses a
	   matching specific interface. See shorewall-nesting[2](5) for a discussion of this problem.

	   Shorewall allows '+' as an interface name.

	   There is no need to define the loopback interface (lo) in this file.

	   If a port is given, then the interface must have been defined previously with the bridge option. The OPTIONS column may not contain the
	   following options when a port is given.
	       arp_filter
	       arp_ignore
	       bridge
	       log_martians
	       mss
	       optional
	       proxyarp
	       required
	       routefilter
	       sourceroute
	       upnp
	       wait

       BROADCAST (Optional) - {-|detect|address[,address]...}
	   Only available if FORMAT 1.

	   If you use the special value detect, Shorewall will detect the broadcast address(es) for you if your iptables and kernel include
	   Address Type Match support.

	   If your iptables and/or kernel lack Address Type Match support then you may list the broadcast address(es) for the network(s) to which
	   the interface belongs. For P-T-P interfaces, this column is left blank. If the interface has multiple addresses on multiple subnets
	   then list the broadcast addresses as a comma-separated list.

	   If you don't want to give a value for this column but you want to enter a value in the OPTIONS column, enter - in this column.

       OPTIONS (Optional) - [option[,option]...]
	   A comma-separated list of options from the following list. The order in which you list the options is not significant but the list
	   should have no embedded white space.

	   arp_filter[={0|1}]
	       If specified, this interface will only respond to ARP who-has requests for IP addresses configured on the interface. If not
	       specified, the interface can respond to ARP who-has requests for IP addresses on any of the firewall's interface. The interface
	       must be up when Shorewall is started.

	       Only those interfaces with the arp_filter option will have their setting changed; the value assigned to the setting will be the
	       value specified (if any) or 1 if no value is given.

		   Note
		   This option does not work with a wild-card interface name (e.g., eth0.+) in the INTERFACE column.

	   arp_ignore[=number]
	       If specified, this interface will respond to arp requests based on the value of number (defaults to 1).

	       1 - reply only if the target IP address is local address configured on the incoming interface

	       2 - reply only if the target IP address is local address configured on the incoming interface and the sender's IP address is part
	       from same subnet on this interface's address

	       3 - do not reply for local addresses configured with scope host, only resolutions for global and link

	       4-7 - reserved

	       8 - do not reply for all local addresses

		   Note
		   This option does not work with a wild-card interface name (e.g., eth0.+) in the INTERFACE column.

		   Warning
		   Do not specify arp_ignore for any interface involved in Proxy ARP[3].

	   blacklist
	       Checks packets arriving on this interface against the shorewall-blacklist[4](5) file.

	       Beginning with Shorewall 4.4.13:

	       o   If a zone is given in the ZONES column, then the behavior is as if blacklist had been specified in the IN_OPTIONS column of
		   shorewall-zones[5](5).

	       o   Otherwise, the option is ignored with a warning: WARNING: The 'blacklist' option is ignored on mult-zone interfaces

	   bridge
	       Designates the interface as a bridge. Beginning with Shorewall 4.4.7, setting this option also sets routeback.

	   dhcp
	       Specify this option when any of the following are true:

		1. the interface gets its IP address via DHCP

		2. the interface is used by a DHCP server running on the firewall

		3. the interface has a static IP but is on a LAN segment with lots of DHCP clients.

		4. the interface is a simple bridge[6] with a DHCP server on one port and DHCP clients on another port.

		       Note
		       If you use Shorewall-perl for firewall/bridging[7], then you need to include DHCP-specific rules in shorewall-rules[8](8).
		       DHCP uses UDP ports 67 and 68.

	       This option allows DHCP datagrams to enter and leave the interface.

	   ignore[=1]
	       When specified, causes the generated script to ignore up/down events from Shorewall-init for this device. Additionally, the option
	       exempts the interface from hairpin filtering. When '=1' is omitted, the ZONE column must contain '-' and ignore must be the only
	       OPTION.

	       Beginning with Shorewall 4.5.5, may be specified as 'ignore=1' which only causes the generated script to ignore up/down events from
	       Shorewall-init; hairpin filtering is still applied. In this case, the above restrictions on the ZONE and OPTIONS columns are
	       lifted.

	   logmartians[={0|1}]
	       Turn on kernel martian logging (logging of packets with impossible source addresses. It is strongly suggested that if you set
	       routefilter on an interface that you also set logmartians. Even if you do not specify the routefilter option, it is a good idea to
	       specify logmartians because your distribution may have enabled route filtering without you knowing it.

	       Only those interfaces with the logmartians option will have their setting changed; the value assigned to the setting will be the
	       value specified (if any) or 1 if no value is given.

	       To find out if route filtering is set on a given interface, check the contents of /proc/sys/net/ipv4/conf/interface/rp_filter - a
	       non-zero value indicates that route filtering is enabled.

	       Example:

			   teastep@lists:~$ cat /proc/sys/net/ipv4/conf/eth0/rp_filter
			   1
			   teastep@lists:~$

		   Note
		   This option does not work with a wild-card interface name (e.g., eth0.+) in the INTERFACE column.
	       This option may also be enabled globally in the shorewall.conf[9](5) file.

	   maclist
	       Connection requests from this interface are compared against the contents of shorewall-maclist[10](5). If this option is specified,
	       the interface must be an ethernet NIC and must be up before Shorewall is started.

	   mss=number
	       Added in Shorewall 4.0.3. Causes forwarded TCP SYN packets entering or leaving on this interface to have their MSS field set to the
	       specified number.

	   nets=(net[,...])
	       Limit the zone named in the ZONE column to only the listed networks. The parentheses may be omitted if only a single net is given
	       (e.g., nets=192.168.1.0/24). Limited broadcast to the zone is supported. Beginning with Shorewall 4.4.1, multicast traffic to the
	       zone is also supported.

	   nets=dynamic
	       Defines the zone as dynamic. Requires ipset match support in your iptables and kernel. See http://www.shorewall.net/Dynamic.html
	       for further information.

	   nosmurfs
	       Filter packets for smurfs (packets with a broadcast address as the source).

	       Smurfs will be optionally logged based on the setting of SMURF_LOG_LEVEL in shorewall.conf[9](5). After logging, the packets are
	       dropped.

	   optional
	       When optional is specified for an interface, Shorewall will be silent when:

	       o   a /proc/sys/net/ipv4/conf/ entry for the interface cannot be modified (including for proxy ARP).

	       o   The first address of the interface cannot be obtained.

	       May not be specified with required.

	   physical=name
	       Added in Shorewall 4.4.4. When specified, the interface or port name in the INTERFACE column is a logical name that refers to the
	       name given in this option. It is useful when you want to specify the same wildcard port name on two or more bridges. See
	       http://www.shorewall.net/bridge-Shorewall-perl.html#Multiple.

	       If the interface name is a wildcard name (ends with '+'), then the physical name must also end in '+'.

	       If physical is not specified, then it's value defaults to the interface name.

	   proxyarp[={0|1}]
	       Sets /proc/sys/net/ipv4/conf/interface/proxy_arp. Do NOT use this option if you are employing Proxy ARP through entries in
	       shorewall-proxyarp[11](5). This option is intended solely for use with Proxy ARP sub-networking as described at:
	       http://tldp.org/HOWTO/Proxy-ARP-Subnet/index.html.[12]

	       Note: This option does not work with a wild-card interface name (e.g., eth0.+) in the INTERFACE column.

	       Only those interfaces with the proxyarp option will have their setting changed; the value assigned to the setting will be the value
	       specified (if any) or 1 if no value is given.

	   required
	       Added in Shorewall 4.4.10. If this option is set, the firewall will fail to start if the interface is not usable. May not be
	       specified together with optional.

	   routeback
	       If specified, indicates that Shorewall should include rules that allow traffic arriving on this interface to be routed back out
	       that same interface. This option is also required when you have used a wildcard in the INTERFACE column if you want to allow
	       traffic between the interfaces that match the wildcard.

	       Beginning with Shorewall 4.4.20, if you specify this option, then you should also specify either sfilter (see below) or routefilter
	       on all interfaces (see below).

	   routefilter[={0|1|2}]
	       Turn on kernel route filtering for this interface (anti-spoofing measure).

	       Only those interfaces with the routefilter option will have their setting changes; the value assigned to the setting will be the
	       value specified (if any) or 1 if no value is given.

	       The value 2 is only available with Shorewall 4.4.5.1 and later when the kernel version is 2.6.31 or later. It specifies a loose
	       form of reverse path filtering.

		   Note
		   This option does not work with a wild-card interface name (e.g., eth0.+) in the INTERFACE column.
	       This option can also be enabled globally in the shorewall.conf[9](5) file.

		   Note
		   There are certain cases where routefilter cannot be used on an interface:

		   o   If USE_DEFAULT_RT=Yes in shorewall.conf[9](5) and the interface is listed in shorewall-providers[13](5).

		   o   If there is an entry for the interface in shorewall-providers[13](5) that doesn't specify the balance option.

		   o   If IPSEC is used to allow a road-warrior to have a local address, then any interface through which the road-warrior might
		       connect cannot specify routefilter.

	   sfilter=(net[,...])
	       Added in Shorewall 4.4.20. This option provides an anti-spoofing alternative to routefilter on interfaces where that option cannot
	       be used, but where the routeback option is required (on a bridge, for example). On these interfaces, sfilter should list those
	       local networks that are connected to the firewall through other interfaces.

	   sourceroute[={0|1}]
	       If this option is not specified for an interface, then source-routed packets will not be accepted from that interface (sets
	       /proc/sys/net/ipv4/conf/interface/accept_source_route to 1). Only set this option if you know what you are doing. This might
	       represent a security risk and is usually unneeded.

	       Only those interfaces with the sourceroute option will have their setting changed; the value assigned to the setting will be the
	       value specified (if any) or 1 if no value is given.

		   Note
		   This option does not work with a wild-card interface name (e.g., eth0.+) in the INTERFACE column.

	   tcpflags
	       Packets arriving on this interface are checked for certain illegal combinations of TCP flags. Packets found to have such a
	       combination of flags are handled according to the setting of TCP_FLAGS_DISPOSITION after having been logged according to the
	       setting of TCP_FLAGS_LOG_LEVEL.

	   upnp
	       Incoming requests from this interface may be remapped via UPNP (upnpd). See http://www.shorewall.net/UPnP.html[14].

	   upnpclient
	       This option is intended for laptop users who always run Shorewall on their system yet need to run UPnP-enabled client apps such as
	       Transmission (BitTorrent client). The option causes Shorewall to detect the default gateway through the interface and to accept UDP
	       packets from that gateway. Note that, like all aspects of UPnP, this is a security hole so use this option at your own risk.

	   wait=seconds
	       Added in Shorewall 4.4.10. Causes the generated script to wait up to seconds seconds for the interface to become usable before
	       applying the required or optional options.

EXAMPLE

       Example 1:
	   Suppose you have eth0 connected to a DSL modem and eth1 connected to your local network and that your local subnet is 192.168.1.0/24.
	   The interface gets its IP address via DHCP from subnet 206.191.149.192/27. You have a DMZ with subnet 192.168.2.0/24 using eth2. Your
	   iptables and/or kernel do not support "Address Type Match" and you prefer to specify broadcast addresses explicitly rather than having
	   Shorewall detect them.

	   Your entries for this setup would look like:

	       FORMAT 1
	       #ZONE   INTERFACE BROADCAST	  OPTIONS
	       net     eth0	 206.191.149.223  dhcp
	       loc     eth1	 192.168.1.255
	       dmz     eth2	 192.168.2.255

       Example 2:
	   The same configuration without specifying broadcast addresses is:

	       FORMAT 2
	       #ZONE   INTERFACE OPTIONS
	       net     eth0	 dhcp
	       loc     eth1
	       dmz     eth2

       Example 3:
	   You have a simple dial-in system with no ethernet connections.

	       FORMAT 2
	       #ZONE   INTERFACE OPTIONS
	       net     ppp0	 -

       Example 4 (Shorewall 4.4.9 and later):
	   You have a bridge with no IP address and you want to allow traffic through the bridge.

	       FORMAT 2
	       #ZONE   INTERFACE OPTIONS
	       -       br0	 routeback

FILES

       /etc/shorewall/interfaces

SEE ALSO

       http://shorewall.net/configuration_file_basics.htm#Pairs

       shorewall(8), shorewall-accounting(5), shorewall-actions(5), shorewall-blacklist(5), shorewall-hosts(5), shorewall-maclist(5),
       shorewall-masq(5), shorewall-nat(5), shorewall-netmap(5), shorewall-params(5), shorewall-policy(5), shorewall-providers(5),
       shorewall-proxyarp(5), shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5), shorewall-secmarks(5),
       shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)

NOTES

	1. shorewall-hosts
	   http://www.shorewall.net/manpages/shorewall-hosts.html

	2. shorewall-nesting
	   http://www.shorewall.net/manpages/shorewall-nesting.html

	3. Proxy ARP
	   http://www.shorewall.net/manpages/../ProxyARP.htm

	4. shorewall-blacklist
	   http://www.shorewall.net/manpages/shorewall-blacklist.html

	5. shorewall-zones
	   http://www.shorewall.net/manpages/shorewall-zones.html

	6. simple bridge
	   http://www.shorewall.net/manpages/../SimpleBridge.html

	7. Shorewall-perl for firewall/bridging
	   http://www.shorewall.net/manpages/../bridge-Shorewall-perl.html

	8. shorewall-rules
	   http://www.shorewall.net/manpages/shorewall-rules.html

	9. shorewall.conf
	   http://www.shorewall.net/manpages/shorewall.conf.html

       10. shorewall-maclist
	   http://www.shorewall.net/manpages/shorewall-maclist.html

       11. shorewall-proxyarp
	   http://www.shorewall.net/manpages/shorewall-proxyarp.html

       12. http://tldp.org/HOWTO/Proxy-ARP-Subnet/index.html.
	   http://tldp.org/HOWTO/Proxy-ARP-Subnet/index.html

       13. shorewall-providers
	   http://www.shorewall.net/manpages/shorewall-providers.html

       14. http://www.shorewall.net/UPnP.html
	   http://www.shorewall.net/manpages/../UPnP.html

[FIXME: source] 						    06/28/2012						    SHOREWALL-INTERFACE(5)