SHOREWALL-ADDRESSES(5)

✨ shorewall-addresses(5) ✨

okay so bestie, this is section 5 of the manual — Configuration Files — and it's literally just the glow-up guide for how addresses work inside a Shorewall config. sit down, grab a snack 🍓, we're doing this.

---

💖 NAME 💖

addresses — the way you write addresses inside a Shorewall configuration. that's it, that's the whole name, iconic.

---

🌸 DESCRIPTION 🌸

so in both Shorewall and Shorewall6, there are exactly two basic types of addresses, and you gotta know them both or nothing else makes sense:

• Host Address — this one is just one single host. one. solo. main character energy, no entourage.
  • In IPv4, the format is i.j.k.l where i through l are decimal numbers between 1 and 255.
  • In IPv6, the format is a:b:c:d:e:f:g:h where a through h consist of 1 to 4 hexadecimal digits (leading zeros may be omitted). a single series of 0 addresses may be omitted. for example 2001:227:e857:1:0:0:0:0:1 may be written 2001:227:e857:1::1. the abbreviation ate, no crumbs 💅
• Network Address — this one refers to 1 or more hosts, and it's built like a host address followed by a slash ("/") and a Variable Length Subnet Mask (VLSM). this is what the girlies call Classless Internet Domain Routing (CIDR) notation. yes the acronym stacks are a lot, we move.
  • The VLSM is a decimal number. For IPv4, it's in the range 0 through 32. For IPv6, the range is 0 through 128. that number = how many leading bits of the address represent the network address; the rest of the bits are a host address and are generally given as zero.
  • Examples, because we love a demo:

IPv4: 192.168.1.0/24

IPv6: 2001:227:e857:1:0:0:0:0:1/64

In the Shorewall documentation and manpages, they've tried to make it clear which type of address is accepted in each specific case. respect for the transparency honestly 🫶

⚠️ important vibe check: because Shorewall uses a colon (":") as a separator in many contexts, IPv6 addresses are best written using the standard convention where the address itself is enclosed in square brackets:

[2001:227:e857:1::1]
[2001:227:e857:1::]/64

---

🦋 SPECIFYING SOURCE AND DEST 🦋

Entries in Shorewall configuration files often deal with the source (SOURCE) and destination (DEST) of connections, and Shorewall implements a uniform way for specifying them. one format to rule them all, slay.

A SOURCE or DEST consists of one to three parts separated by colons (":"):

1. ZONE — the name of a zone declared in /etc/shorewall/zones or /etc/shorewall6/zones. this part is only available in the rules file (/etc/shorewall/rules, /etc/shorewall/blrules,/etc/shorewall6/rules and /etc/shorewall6/blrules).
2. INTERFACE — the name of an interface that matches an entry in /etc/shorewall/interfaces (/etc/shorewall6/interfaces).
   • Beginning with Shorweall 5.2.1, the interface may be preceded with '!' which matches all interfaces except the one specified. not me excluding people from the party 🙈
3. ADDRESS LIST — a list of one or more addresses (host or network) or address ranges, separated by commas. in an IPv6 configuration, this list must be included in square or angled brackets ("[...]" or "<...>"). the list may have exclusion.

⭐ Examples ⭐

1. All hosts in the net zone — net
2. Subnet 192.168.1.0/29 in the loc zone — loc:192.168.1.0/29
3. All hosts in the net zone connecting through ppp0 — net:ppp0
4. All hosts interfaced by eth3 — eth3
5. Subnet 10.0.1.0/24 interfacing through eth2 — eth2:10.0.1.0/24
6. Host 2002:ce7c:92b4:1:a00:27ff:feb1:46a9 in the loc zone — loc:[2002:ce7c:92b4:1:a00:27ff:feb1:46a9]
7. The primary IP address of eth0 in the $FW zone - $FW:&eth0
8. All hosts in Vatican City - net:^VA (Requires the GeoIP Match capability).

---

🔥 IP ADDRESS RANGES 🔥

If you kernel and iptables have IP Range match support, you may use IP address ranges in Shorewall configuration file entries; IP address ranges have the syntax <low IP address>-<high IP address>.

Example: 192.168.1.5-192.168.1.12.

---

👑 SEE ALSO 👑

For more information about addressing, see the Setup Guide[1].

---

💜 NOTES 💜

1. Setup Guide https://shorewall.org/manpages/shorewall_setup_guide.htm#Addressing

---

and that's the whole thing bestie, you're officially an addressing expert, no cap 🎀 this was Configuration Files, dated 09/24/2020, and you just read SHOREWALL-ADDRESSES(5) — go forth and subnet responsibly 💖✨🦋