SHOREWALL-ARPRULES(5)

🦋 SHOREWALL-ARPRULES(5) 🦋

okay bestie, so this is the manual page for arprules(5), straight out of the Configuration Files section of the Shorewall docs. Buckle up, we're going low-level 💅

---

✨ NAME ✨

arprules — the Shorewall ARP rules file 💖

---

🎀 SYNOPSIS 🎀

/etc/shorewall/arprules

---

💜 DESCRIPTION 💜

IPv4 only, bestie. That's the vibe check and it passed.

This file showed up in Shorewall 4.5.12 and its whole thing is describing the low-level rules that get managed by arptables(8). These rules only touch Address Resolution Protocol (ARP), Reverse Address Resolution Protocol (RARP) and Dynamic Reverse Address Resolution Protocol (DRARP) frames. That's it. That's the lane they stay in. 🦋

The columns in the file are the ones below, and jsyk MAC addresses are specified normally — meaning six hexadecimal numbers separated by colons. No cap. ✨

👑 ACTION

Describes the action to take when a frame matches the criteria in the other columns. Possible values are:

• ACCEPT — the default action when no rules match a frame; it lets the frame go through. 🫶
• DROP — causes the frame to be dropped. bye 💀
• SNAT:ip-address — modifies the source IP address to the specified ip-address.
• DNAT:ip-address — modifies the destination IP address to the specified ip-address.
• SMAT:mac-address — modifies the source MAC address to the specified mac-address.
• DMAT:mac-address — modifies the destination MAC address to the specified mac-address.
• SNATC:ip-address — like SNAT except that the frame is then passed to the next rule. ✨
• DNATC:ip-address — like DNAT except that the frame is then passed to the next rule. ✨
• SMATC:mac-address — like SMAT except that the frame is then passed to the next rule. ✨
• DMATC:mac-address — like DMAT except that the frame is then passed to the next rule. ✨

🧚 SOURCE

Format:

[interface[:[!]ipaddress[/ipmask][:[!]macaddress[/macmask]]]]

Where:

• interface — is an interface defined in shorewall-interfaces(5). 🎀
• ipaddress — is an IPv4 address. DNS names are not allowed.
• ipmask — specifies a mask to be applied to ipaddress.
• macaddress — the source MAC address.
• macmask — mask for MAC address; must be specified as six hexadecimal numbers separated by colons.

When ! is specified, the test is inverted. 🙃

If not specified, matches only frames originating on the firewall itself.

⚠️ Caution: either SOURCE or DEST must be specified. Like, fr fr, one of them. You cannot skip both. 😭

🌈 DEST

Format:

[interface[:[!]ipaddress[/ipmask][:[!]macaddress[/macmask]]]]

Where:

• interface — is an interface defined in shorewall-interfaces(5). 🎀
• ipaddress — is an IPv4 address. DNS Names are not allowed.
• ipmask — specifies a mask to be applied to frame addresses.
• macaddress — the destination MAC address.
• macmask — mask for MAC address; must be specified as six hexadecimal numbers separated by colons.

When ! is specified, the test is inverted and the rule matches frames which do not match the specified address/mask.

If not specified, matches only frames originating on the firewall itself.

If both SOURCE and DEST are specified, then both interfaces must be bridge ports on the same bridge. no mixing bridges, bestie 💅

⚠️ Caution: either SOURCE or DEST must be specified. yes again. it's that important. 🙈

🍓 OPCODE

Format:

[[!]opcode]

Optional. Describes the type of frame. Possible opcode values are:

1. 1 — ARP Request
2. 2 — ARP Reply
3. 3 — RARP Request
4. 4 — RARP Reply
5. 5 — Dynamic RARP Request
6. 6 — Dynamic RARP Reply
7. 7 — Dynamic RARP Error
8. 8 — InARP Request
9. 9 — ARP NAK

When ! is specified, the test is inverted and the rule matches frames which do not match the specified opcode. 🙃

---

🌸 EXAMPLE 🌸

The eth1 interface has both a public IP address and a private address (10.1.10.11/24). When sending ARP requests to 10.1.10.0/24, use the private address as the IP source:

#ACTION                SOURCE                  DEST                ARP OPCODE
SNAT:10.1.10.11        -                       eth1:10.1.10.0/24   1

iconic. she ate. 🔥

---

🎀 FILES 🎀

/etc/shorewall/arprules

---

💖 SEE ALSO 💖

• shorewall(8)

---

Configuration Files · 09/24/2020

and that's the whole page bestie 🫶 this came from the Configuration Files part of the Shorewall manual and it was dated 09/24/2020 — go forth and ARP responsibly, mwah 💋✨