Shorewall 5.2.0 Beta 1 is now available for download.

Problems Corrected:

1)  This release includes defect repair through Shorewall

2)  Under rare rare circumstances, syn flood limiting specified in a
    policy was previously not enforced by the generated ruleset. That
    has been corrected.

New Features:

)  The MAPOLDACTIONS option in shorewall.conf has been removed. This
    option provided compatibility with releases prior to Shorewall 3.0.
    'shorewall update' will remove the setting of this option from

2)  The INLINE_MATCH option has been removed. Shorewall now behaves as
    if INLINE_MATCH=No had been specified:

    - A single semicolon (';') is used to separate column-oriented
      input from column-name/value input.

    - The preferred method of specifying column-name/value input is to
      enclose such input in curly braces ("{....}").

    - A pair of semicolons (';;') is used to introduce raw IP[6]TABLES
      input. This is true in INLINE and IP[6]TABLES rules as well as
      rules with other targets.

    As part of this change, 'shorewall update' will replace ';' with
    ';;' in INLINE and IP[6]TABLES rules.

3)  With the wide availability of ipset-based blacklisting, the need
    for the 'refresh' command has been largely eliminated. As a result,
    that command has been removed.

4)  The following deprecated macros and actions have been removed:

        Action A_AllowICMPs  - use AllowICMPs(A_ACCEPT)
        Action A_Drop        - see below
        Action A_Reject      - see below
        Action Drop          - see below
        Action Reject        - see below
        Macro SNMPTrap       - use SNMPtrap

     The [A_]Drop and [A_]Reject actions are used primarily as policy
     actions. As part of this change, 'shorewall update' will update
     DROP_DEFAULT=[A_]Drop and REJECT_DEFAULT=[A_]Reject as follows:


         DROP_DEFAULT=Drop becomes Broadcast(DROP),Multicast(DROP)
         DROP_DEFAULT=A_Drop becomes
         REJECT_DEFAULT=Reject becomes Broadcast(DROP),Multicast(DROP)
         REJECT_DEFAULT=A_Reject becomes


         DROP_DEFAULT=Drop becomes
         DROP_DEFAULT=A_Drop becomes
         REJECT_DEFAULT=Reject becomes
         REJECT_DEFAULT=A_Reject becomes

   See the Migration Issues for additional information.

5) A 'show saves' command has been added to list the snapshots
   created using the 'save' command.


      root@gateway:~# shorewall show saves
      Shorewall 5.2.0 Saves at gateway - Thu Feb 15 11:58:37 PST 2018
      Saved snapshots are:

      Feb 15 10:08 foo
      Feb 14 12:34 restore (default)


    The snapshots are listed by creation time from latest to
    earliest. If the name of one matches the RESTOREFILE setting, that
    snapshot is marked as the default for the 'restore' command.

6)  For installing into a Sandbox, the file shorewallrc.sandbox has
    been added to Shorewall-core. See

7)  The "Use Pkttype Match (USEPKTTYPE)" capability is no longer used
    and has been deleted. This removal has introduced a new
    capabilities version.

8)  When a log message is issued from a chain that relates to a pair of
    zones (e.g, 'fw-net'), the chain name normally appears in the log
    message (unless LOGTAGONLY=Yes and a log tag is specified). This
    can prevent OPTIMIZE category 8 from combining chains which are
    identical except for chain names in logging rules. The new
    LOG_ZONE option in shorewall[6].conf allows for only the source or
    destination zone to appear in the messages by setting LOG_ZONE to
    'src' or 'dst' respectively. If LOG_ZONE=both (the default), then
    the full chain name is included in log messages

    Setting LOG_ZONE=src has been shown to decrease the size of the
    generated ruleset by more than 10 prcent in some cases. Your
    results may vary.

Thank you for testing,

Tom Eastep        \   Q: What do you get when you cross a mobster with
Shoreline,         \     an international standard?
Washington, USA     \ A: Someone who makes you an offer you can't \   understand

Attachment: signature.asc
Description: OpenPGP digital signature

Check out the vibrant tech community on one of the world's most
engaging tech sites,!
Shorewall-users mailing list

Reply via email to