shorewall6-exclusion(5) [debian man page]
SHOREWALL6-EXCLUSIO(5) [FIXME: manual] SHOREWALL6-EXCLUSIO(5) NAME
exclusion - Exclude a set of hosts from a definition in a shorewall6 configuration file. SYNOPSIS
!address-or-range[,address-or-range]... !zone-name[,zone-name]... DESCRIPTION
Exclusion is used when you wish to exclude one or more addresses from a definition. An exclaimation point is followed by a comma-separated list of addresses. The addresses may be single host addresses (e.g., fe80::2a0:ccff:fedb:31c4) or they may be network addresses in CIDR format (e.g., fe80::2a0:ccff:fedb:31c4/64). If your kernel and ip6tables include iprange support, you may also specify ranges of ip addresses of the form lowaddress-highaddress No embedded whitespace is allowed. Exclusion can appear after a list of addresses and/or address ranges. In that case, the final list of address is formed by taking the first list and then removing the addresses defined in the exclusion. Beginning in Shorewall 4.4.13, the second form of exclusion is allowed after all and any in the SOURCE and DEST columns of /etc/shorewall/rules. It allows you to omit arbitrary zones from the list generated by those key words. Warning If you omit a sub-zone and there is an explicit or explicit CONTINUE policy, a connection to/from that zone can still be matched by the rule generated for a parent zone. For example: /etc/shorewall6/zones: #ZONE TYPE z1 ip z2:z1 ip ... /etc/shorewall6/policy: #SOURCE DEST POLICY z1 net CONTINUE z2 net REJECT /etc/shorewall6/rules: #ACTION SOURCE DEST PROTO DEST # PORT(S) ACCEPT all!z2 net tcp 22 In this case, SSH connections from z2 to net will be accepted by the generated z1 to net ACCEPT rule. FILES
/etc/shorewall6/hosts /etc/shorewall6/masq /etc/shorewall6/rules /etc/shorewall6/tcrules SEE ALSO
shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5), shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-interfaces(5), shorewall6-maclist(5), shoewall6-netmap(5),shorewall6-params(5), shorewall6-policy(5), shorewall6-providers(5), shorewall6-rtrules(5), shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5), shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5), shorewall6-tcrules(5), shorewall6-tos(5), shorewall6-tunnels(5), shorewall-zones(5) [FIXME: source] 06/28/2012 SHOREWALL6-EXCLUSIO(5)
Check Out this Related Man Page
SHOREWALL6-PROXYNDP(5) [FIXME: manual] SHOREWALL6-PROXYNDP(5) NAME
proxyndp - Shorewall6 Proxy NDP file SYNOPSIS
/etc/shorewall6/proxyndp DESCRIPTION
This file was added in Shoreall 4.4.16 and is used to define Proxy NDP. There is one entry in this file for each IPv6 address to be proxied. The columns in the file are as follows. ADDRESS - address IPv6 Address. INTERFACE - interface (Optional) Local interface where system with the ip address in ADDRESS is connected. Only required when the HAVEROUTE column is left empty or is set to no or No. EXTERNAL - interface External Interface to be used to access this system from the Internet. HAVEROUTE - [-|Yes|No] If there is already a route from the firewall to the host whose address is given, enter Yes or yes in this column. Otherwise, enter no or No or leave the column empty and Shorewall will add the route for you. If Shorewall6 adds the route, its persistence depends on the value of thePERSISTENT column contains Yes; otherwise, shorewall6 stop or shorewall clear6 will delete the route. PERSISTENT - [-|Yes|No] If HAVEROUTE is No or no, then the value of this column determines if the route added by Shorewall persists after a shorewall6 stop or a shorewall6 clear. If this column contains Yes or yes then the route persists; If the column is empty or contains No or no then the route is deleted by shorewall6 stop or shorewall6 clear. EXAMPLE
Example 1: Host with IPv6 2001:470:b:227::44 is connected to interface eth1 and we want hosts attached via eth0 to be able to access it using that address. #ADDRESS INTERFACE EXTERNAL 2001:470:b:227::44 eth1 eth0 FILES
/etc/shorewall6/proxyndp SEE ALSO
http://shorewall.net/configuration_file_basics.htm#Pairs shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5), shorewall6-blacklist(5), shorewall6-exclusion(5), shorewall6-hosts(5), shorewall6-interfaces(5), shorewall6-maclist(5), shorewall6-nesting(5), shoewall6-netmap(5),shorewall6-params(5), shorewall6-policy(5), shorewall6-providers(5), shorewall6-rtrules(5), shorewall6-routestopped(5), shorewall6-rules(5), shorewall6.conf(5), shorewall6-secmarks(5), shorewall6-tcclasses(5), shorewall6-tcdevices(5), shorewall6-tcrules(5), shorewall6-tos(5), shorewall6-tunnels(5), shorewall6-zones(5) [FIXME: source] 06/28/2012 SHOREWALL6-PROXYNDP(5)