SHOREWALL6-INTERFAC(5)						  [FIXME: manual]					    SHOREWALL6-INTERFAC(5)

NAME

       interfaces - shorewall6 interfaces file

SYNOPSIS

       /etc/shorewall6/interfaces

DESCRIPTION

       The interfaces file serves to define the firewall's network interfaces to shorewall6. The order of entries in this file is not significant
       in determining zone composition.

       Beginning with Shorewall 4.5.3, the interfaces file supports two different formats:

       FORMAT 1 (default - deprecated)
	   There is a ANYCAST column which provides compatibility with older versions of Shorewall..

       FORMAT 2
	   The BROADCAST column is omitted.

       The format is specified by a line as follows:

       FORMAT {1|2}

       The columns in the file are as follows.

       ZONE - zone-name
	   Zone for this interface. Must match the name of a zone declared in /etc/shorewall6/zones. You may not list the firewall zone in this
	   column.

	   If the interface serves multiple zones that will be defined in the shorewall6-hosts[1](5) file, you should place "-" in this column.

	   If there are multiple interfaces to the same zone, you must list them in separate entries.

	   Example:

	       #ZONE   INTERFACE       BROADCAST
	       loc     eth1	       -
	       loc     eth2	       -

       INTERFACE - interface[:port]
	   Logical name of interface. Each interface may be listed only once in this file. You may NOT specify the name of a "virtual" interface
	   (e.g., eth0:0) here; see http://www.shorewall.net/FAQ.htm#faq18. If the physical option is not specified, then the logical name is also
	   the name of the actual interface.

	   You may use wildcards here by specifying a prefix followed by the plus sign ("+"). For example, if you want to make an entry that
	   applies to all PPP interfaces, use 'ppp+'; that would match ppp0, ppp1, ppp2, ...Please note that the '+' means 'one or more additional
	   characters' so 'ppp' does not match 'ppp+'.

	   Care must be exercised when using wildcards where there is another zone that uses a matching specific interface. See
	   shorewall6-nesting[2](5) for a discussion of this problem.

	   Shorewall6 allows '+' as an interface name.

	   There is no need to define the loopback interface (lo) in this file.

	   If a port is given, then the interface must have been defined previously with the bridge option. The OPTIONS column must be empty when
	   a port is given.

       ANYCAST - -
	   Enter '-' in this column. It is here for compatibility between Shorewall6 and Shorewall and is omitted if FORMAT is 2.

       OPTIONS (Optional) - [option[,option]...]
	   A comma-separated list of options from the following list. The order in which you list the options is not significant but the list
	   should have no embedded white space.

	   blacklist
	       Check packets arriving on this interface against the shorewall6-blacklist[3](5) file.

	       Beginning with Shorewall 4.4.13:

	       o   If a zone is given in the ZONES column, then the behavior is as if blacklist had been specified in the IN_OPTIONS column of
		   shorewall6-zones[4](5).

	       o   Otherwise, the option is ignored with a warning: WARNING: The 'blacklist' option is ignored on mult-zone interfaces

	   bridge
	       Designates the interface as a bridge. Beginning with Shorewall 4.4.7, setting this option also sets routeback.

	   dhcp
	       Specify this option when any of the following are true:

		1. the interface gets its IP address via DHCP

		2. the interface is used by a DHCP server running on the firewall

		3. the interface has a static IP but is on a LAN segment with lots of DHCP clients.

		4. the interface is a simple bridge[5] with a DHCP server on one port and DHCP clients on another port.

		       Note
		       If you use Shorewall-perl for firewall/bridging[6], then you need to include DHCP-specific rules in shorewall-rules[7](8).
		       DHCP uses UDP ports 546 and 547.

	       This option allows DHCP datagrams to enter and leave the interface.

	   forward[={0|1}]
	       Sets the /proc/sys/net/ipv6/conf/interface/forwarding option to the specified value. If no value is supplied, then 1 is assumed.

	   ignore[=1]
	       When specified, causes the generated script to ignore up/down events from Shorewall-init for this device. Additionally, the option
	       exempts the interface from hairpin filtering. When '=1' is omitted, the ZONE column must contain '-' and ignore must be the only
	       OPTION.

	       Beginning with Shorewall 4.5.5, may be specified as 'ignore=1' which only causes the generated script to ignore up/down events from
	       Shorewall-init; hairpin filtering is still applied. In this case, the above restrictions on the ZONE and OPTIONS columns are
	       lifted.

	   mss=number
	       Causes forwarded TCP SYN packets entering or leaving on this interface to have their MSS field set to the specified number.

	   nets=(net[,...])
	       Limit the zone named in the ZONE column to only the listed networks. If you specify this option, be sure to include the link-local
	       network (ff80::/10).

	   nets=dynamic
	       Added in Shorewall 4.4.21. Defines the zone as dynamic. Requires ipset match support in your iptables and kernel. See
	       http://www.shorewall.net/Dynamic.html for further information.

	   optional
	       When optional is specified for an interface, shorewall6 will be silent when:

	       o   a /proc/sys/net/ipv6/conf/ entry for the interface cannot be modified.

	       o   The first global IPv6 address of the interface cannot be obtained.

	       This option may not be specified together with required.

	   physical=name
	       Added in Shorewall 4.4.4. When specified, the interface or port name in the INTERFACE column is a logical name that refers to the
	       name given in this option. It is useful when you want to specify the same wildcard port name on two or more bridges. See
	       http://www.shorewall.net/bridge-Shorewall-perl.html#Multiple.

	       If the interface name is a wildcard name (ends with '+'), then the physical name must also end in '+'.

	       If physical is not specified, then it's value defaults to the interface name.

	   required
	       Added in Shorewall 4.4.10. When specified, the firewall will fail to start if the interface named in the INTERFACE column is not
	       usable. May not be specified together with optional.

	   routeback
	       If specified, indicates that shorewall6 should include rules that allow traffic arriving on this interface to be routed back out
	       that same interface. This option is also required when you have used a wildcard in the INTERFACE column if you want to allow
	       traffic between the interfaces that match the wildcard.

	       Beginning with Shorewall 4.4.20, if you specify this option, then you should also specify sfilter (see below).

	   sourceroute[={0|1}]
	       If this option is not specified for an interface, then source-routed packets will not be accepted from that interface (sets
	       /proc/sys/net/ipv6/conf/interface/accept_source_route to 1). Only set this option if you know what you are doing. This might
	       represent a security risk and is not usually needed.

	       Only those interfaces with the sourceroute option will have their setting changes; the value assigned to the setting will be the
	       value specified (if any) or 1 if no value is given.

		   Note
		   This option does not work with a wild-card interface name (e.g., eth0.+) in the INTERFACE column.

	   sfilter=(net[,...])
	       Added in Shorewall 4.4.20. At this writing (spring 2011), Linux does not support reverse path filtering (RFC3704) for IPv6. In its
	       absence, sfilter may be used as an anti-spoofing measure.

	       This option should be used on bridges or other interfaces with the routeback option. On these interfaces, sfilter should list those
	       local networks that are connected to the firewall through other interfaces.

	   tcpflags
	       Packets arriving on this interface are checked for certain illegal combinations of TCP flags. Packets found to have such a
	       combination of flags are handled according to the setting of TCP_FLAGS_DISPOSITION after having been logged according to the
	       setting of TCP_FLAGS_LOG_LEVEL.

	   proxyndp[={0|1}]
	       Sets /proc/sys/net/ipv6/conf/interface/proxy_ndp.

	       Note: This option does not work with a wild-card interface name (e.g., eth0.+) in the INTERFACE column.

	       Only those interfaces with the proxyndp option will have their setting changed; the value assigned to the setting will be the value
	       specified (if any) or 1 if no value is given.

	   wait=seconds
	       Added in Shorewall 4.4.10. Causes the generated script to wait up to seconds seconds for the interface to become usable before
	       applying the required or optional options.

EXAMPLE

       Example 1:
	   Suppose you have eth0 connected to a DSL modem and eth1 connected to your local network You have a DMZ using eth2.

	   Your entries for this setup would look like:

	       FORMAT 2
	       #ZONE   INTERFACE OPTIONS
	       net     eth0	 -
	       loc     eth1	 -
	       dmz     eth2	 -

       Example 4 (Shorewall 4.4.9 and later):
	   You have a bridge with no IP address and you want to allow traffic through the bridge.

	       FORMAT 2
	       #ZONE   INTERFACE	OPTIONS
	       -       br0		routeback

FILES

       /etc/shorewall6/interfaces

SEE ALSO

       http://shorewall.net/configuration_file_basics.htm#Pairs

       shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5), shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-maclist(5),
       shoewall6-netmap(5),shorewall6-params(5), shorewall6-policy(5), shorewall6-providers(5), shorewall6-rtrules(5), shorewall6-routestopped(5),
       shorewall6-rules(5), shorewall6.conf(5), shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5), shorewall6-tcrules(5),
       shorewall6-tos(5), shorewall6-tunnels(5), shorewall6-zones(5)

NOTES

	1. shorewall6-hosts
	   http://www.shorewall.net/manpages6/shorewall6-hosts.html

	2. shorewall6-nesting
	   http://www.shorewall.net/manpages6/shorewall6-nesting.html

	3. shorewall6-blacklist
	   http://www.shorewall.net/manpages6/shorewall6-blacklist.html

	4. shorewall6-zones
	   http://www.shorewall.net/manpages6/shorewall6-zones.html

	5. simple bridge
	   http://www.shorewall.net/manpages6/../SimpleBridge.html

	6. Shorewall-perl for firewall/bridging
	   http://www.shorewall.net/manpages6/../bridge-Shorewall-perl.html

	7. shorewall-rules
	   http://www.shorewall.net/manpages6/shorewall-rules.html

[FIXME: source] 						    06/28/2012						    SHOREWALL6-INTERFAC(5)