SHOREWALL-HOSTS(5)

💖 SHOREWALL-HOSTS 💖

okay bestie, welcome to shorewall-hosts (that's the page from the Configuration Files manual, section 5, if you're keeping receipts) 💅

---

✨ NAME ✨

hosts — the Shorewall file, yes that's literally it, that's the whole name 🎀

---

🌸 SYNOPSIS 🌸

/etc/shorewall[6]/hosts

---

🦋 DESCRIPTION 🦋

So this file is where you define zones in terms of subnets and/or individual IP addresses. That's the whole vibe. 💫

But listen — most simple setups don't need to (and honestly should not) put anything in this file. If you can avoid it, avoid it. Main character energy is knowing when to not touch a config file. 🙈

The order of the entries in this file is not significant when it comes to determining zone composition. Nope! Instead, the order that the zones are declared in shorewall-zones[1](5) is what determines the order in which the records in this file get interpreted. So the zones file is the one calling the shots. 👑

⚠️ Warning ⚠️ The only time you actually need this file is when you have more than one zone connected through a single interface. That's it. That's the one scenario.

⚠️ Warning ⚠️ If you've got an entry for a zone and interface over in shorewall-interfaces[2](5), then do not include any entries in this file for that same (zone, interface) pair. Just don't. They would be fighting and we don't do that here. 💀

The columns in the file go like this. 👇

🌈 ZONE — zone-name

The name of a zone that's declared in shorewall-zones[1](5). Also — you may not list the firewall zone in this column. Not allowed, bestie. 🚫

🌈 HOST(S) —

interface:{[{address-or-range[,address-or-range]...|+ipset|dynamic}[exclusion]

The name of an interface defined in the shorewall-interfaces[2](5) file, followed by a colon (":") and then a comma-separated list. The elements of that list are either:

1. The IP address of a host.
2. A network in CIDR format.
3. An IP address range of the form low.address-high.address. Heads up — your kernel and iptables must have iprange match support for this one.
4. The name of an ipset.
5. The word dynamic, which makes the zone dynamic in that you can use the shorewall add and shorewall delete commands to change to composition of the zone.

You may also exclude certain hosts through use of an exclusion (see shorewall-exclusion[3](5)). 💅

🌈 OPTIONS (Optional) — [option[,option]...]

A comma-separated list of options pulled from the list below. The order you list them in is not significant, BUT the list must have no embedded white-space. None. Zero. Not even one sneaky space. 🫶

• blacklist — Check packets arriving on this port against the shorewall-blacklist[4](5) file.
• broadcast — Used when you want to include limited broadcasts (destination IP address 255.255.255.255) from the firewall to this zone. Only necessary when:
  1. The network specified in the HOST(S) column does not include 255.255.255.255.
  2. The zone does not have an entry for this interface in shorewall-interfaces[2](5).
• destonly — Normally used with the Multi-cast IP address range (224.0.0.0/4). Specifies that traffic will be sent to the specified net(s) but that no traffic will be received from the net(s). Sending only, no receiving. It's giving one-way street. 🚗
• ipsec — The zone is accessed via a kernel 2.6 ipsec SA. Note that if the zone named in the ZONE column is specified as an IPSEC zone in the shorewall-zones[1](5) file then you do NOT need to specify the ipsec option here. Don't double up, it's not the move. 💅
• maclist — Connection requests from these hosts are compared against the contents of shorewall-maclist[5](5). If this option is specified, the interface must be an Ethernet NIC or equivalent and must be up before Shorewall is started. Both. Non-negotiable. ✨
• mss=mss — Added in Shorewall 4.5.2. When present, causes the TCP mss for new connections to/from the hosts given in the HOST(S) column to be clamped at the specified mss.
• nosmurfs — This option only makes sense for ports on a bridge. It filters packets for smurfs (packets with a broadcast address as the source). Smurfs will be optionally logged based on the setting of SMURF_LOG_LEVEL in shorewall.conf[6](5). After logging, the packets are dropped. bye smurfs 👋
• routeback — Shorewall should set up the infrastructure to pass packets from this/these address(es) back to themselves. This is necessary if hosts in this group use the services of a transparent proxy that is a member of the group, or if DNAT is used to send requests originating from this group to a server in the group. They're literally talking to themselves and that's valid here. 💖
• tcpflags — Packets arriving from these hosts are checked for certain illegal combinations of TCP flags. Packets found to have such a combination of flags are handled according to the setting of TCP_FLAGS_DISPOSITION after having been logged according to the setting of TCP_FLAGS_LOG_LEVEL.

---

🎀 EXAMPLES 🎀

Example 1

The firewall runs a PPTP server which creates a ppp interface for each remote client. The clients are assigned IP addresses in the network 192.168.3.0/24 and in a zone named vpn.

#ZONE       HOST(S)               OPTIONS
vpn         ppp+:192.168.3.0/24

look at that. clean. no notes. 🔥

---

⭐ FILES ⭐

• /etc/shorewall/hosts
• /etc/shorewall6/hosts

---

💜 SEE ALSO 💜

• https://shorewall.org/configuration_file_basics.htm#Pairs[7]
• shorewall(8)

---

🌸 NOTES 🌸

1. shorewall-zones https://shorewall.org/manpages/shorewall-zones.html
2. shorewall-interfaces https://shorewall.org/manpages/shorewall-interfaces.html
3. shorewall-exclusion https://shorewall.org/manpages/shorewall-exclusion.html
4. shorewall-blacklist https://shorewall.org/manpages/shorewall-blacklist.html
5. shorewall-maclist https://shorewall.org/manpages/shorewall-maclist.html
6. shorewall.conf https://shorewall.org/manpages/shorewall.conf.html
7. https://shorewall.org/configuration_file_basics.htm#Pairs https://shorewall.org/configuration_file_basics.htm#Pairs

---

and that's the whole page bestie, you ate it, periodt 💅✨

this one was from the Configuration Files manual, dated 09/24/2020 — shoutout to the version for keeping it iconic. go forth and configure responsibly, mwah 🫶🎀