Section: Configuration Files (5)
addresses - Specifying addresses within a Shorewall configuration
In both Shorewall and Shorewall6, there are two basic types of addresses:
This address type refers to a single host.
In IPv4, the format is
are decimal numbers between 1 and 255.
In IPv6, the format is
consist of 1 to 4 hexadecimal digits (leading zeros may be omitted). a single series of 0 addresses may be omitted. For example 2001:227:e857:1:0:0:0:0:1 may be written 2001:227:e857:1::1.
A network address refers to 1 or more hosts and consists of a host address followed by a slash ("/") and a
Variable Length Subnet Mask
(VLSM). This is known as
Classless Internet Domain Routing
The VLSM is a decimal number. For IPv4, it is in the range 0 through 32. For IPv6, the range is 0 through 128. The number represents the number of leading bits in the address that represent the network address; the remainder of the bits are a host address and are generally given as zero.
In the Shorewall documentation and manpages, we have tried to make it clear which type of address is accepted in each specific case.
Because Shorewall uses a colon (":") as a separator in many contexts, IPv6 addresses are best written using the standard convention in which the address itself is enclosed in square brackets:
SPECIFYING SOURCE AND DEST
Entries in Shorewall configuration files often deal with the source (SOURCE) and destination (DEST) of connections and Shorewall implements a uniform way for specifying them.
A SOURCE or DEST consists of one to three parts separated by colons (":"):
ZONE --- The name of a zone declared in
/etc/shorewall6/zones. This part is only available in the rules file (/etc/shorewall/rules,
INTERFACE --- The name of an interface that matches an entry in
Beginning with Shorweall 5.2.1, the
may be preceded with '!' which matches all interfaces except the one specified.
ADDRESS LIST --- A list of one or more addresses (host or network) or address ranges, separated by commas. In an IPv6 configuration, this list must be included in square or angled brackets ("[...]" or "<...>"). The list may have exclusion.
All hosts in the
Subnet 192.168.1.0/29 in the
All hosts in the net zone connecting through
All hosts interfaced by
Subnet 10.0.1.0/24 interfacing through
Host 2002:ce7c:92b4:1:a00:27ff:feb1:46a9 in the
The primary IP address of eth0 in the $FW zone -
All hosts in Vatican City -
IP ADDRESS RANGES
If you kernel and iptables have
IP Range match support, you may use IP address ranges in Shorewall configuration file entries; IP address ranges have the syntax <low IP address>-<high IP address>.
For more information about addressing, see them[blue]Setup Guidem.