SHOREWALL-LITE.CO(5)

✨ NAME ✨

shorewall-lite.conf — the Shorewall Lite global configuration file, bestie 💖 (this page lives in section 5 of the manual, aka "Configuration Files" — iykyk)

---

🌸 SYNOPSIS 🌸

/etc/shorewall-lite/shorewall-lite.conf

---

🦋 DESCRIPTION 🦋

Okay so this file is where you set the options that apply to Shorewall Lite as a whole — like, the big-picture settings, not the per-zone drama. 👑

The file is made up of three things and only three things:

• Shell comments — any line starting with #
• blank lines
• assignment statements, written as variable=value

And the way it's laid out? Each variable's setting is preceded by comments that describe the variable and its effect. So it's self-documenting, we love that for us. 🎀

🫶 Important vibe check: any option you don't specify in this file gets its value from the shorewall.conf file that was used during compilation of /var/lib/shorewall-lite/firewall. Those settings may be found in the file /var/lib/shorewall-lite/firewall.conf. So like, it's not just vibes — there's a real fallback. ✨

---

💅 OPTIONS 💅

The following options may be set in shorewall.conf. (Yes, shorewall.conf — that's literally what the page says, don't come for me. 🙈)

• IPTABLES=[pathname] — this one names the iptables executable that Shorewall is gonna use. If you don't specify it, or you specify it as a null value, then the iptables executable is located using the PATH option instead. No cap.
• LOGFILE=[pathname] — tells the /sbin/shorewall program where to go looking for Shorewall messages when it's processing the dump, logwatch, show log, and hits commands. If it's not assigned, or if it's assigned an empty value, then /var/log/messages is assumed. Default behavior, she's reliable. 🍓
• LOGFORMAT=["formattemplate"] — the value of this variable generates the --log-prefix setting for Shorewall logging rules. It contains a “printf” formatting template which accepts three arguments: the chain name, the logging rule number (optional), and the disposition.

To use LOGFORMAT with fireparse, set it like this:

LOGFORMAT="fp=%s:%d a=%s "

Okay so here's the tea ☕ — if the LOGFORMAT value contains the substring %d, then the logging rule number gets calculated and formatted in that position. If that substring is not included, then the rule number is not included. And if it's not supplied at all, or supplied as empty (LOGFORMAT=""), then Shorewall:%s:%s: is assumed. Slay.

• PATH=pathname[:pathname]... — determines the order in which Shorewall searches directories for executable files. Order matters, bestie. 🌈
• RESTOREFILE=[filename] — specifies the simple name of a file in /var/lib/shorewall to be used as the default restore script in the shorewall save, shorewall restore, shorewall forget and shorewall -f start commands. Four commands, one file, iconic behavior. 💜
• SHOREWALL_SHELL=[pathname] — used to specify the shell program that runs the Shorewall compiler and interprets the compiled script. If not specified, or specified as a null value, /bin/sh is assumed. And here's a glow-up tip: using a light-weight shell such as ash or dash can significantly improve performance. Main character optimization energy. 🔥
• SUBSYSLOCK=[pathname] — this parameter should be set to the name of a file that the firewall should create if it starts successfully and remove when it stops. Creating and removing this file is what lets Shorewall work with your distribution's initscripts. The values you want:
  • For RedHat: /var/lock/subsys/shorewall
  • For Debian: /var/state/shorewall
  • For LEAF: /var/run/shorewall
• VERBOSITY=[number] — Shorewall has traditionally been very noisy (produced lots of output 😭). You may set the default level of verbosity using the VERBOSITY option.

The values are:

1. 0 — Silent. You may make it more verbose using the -v option
2. 1 — Major progress messages displayed
3. 2 — All progress messages displayed (old default behavior)

If not specified, then 2 is assumed. So yes, by default she talks a lot. 💀

---

🧚 FILES 🧚

/etc/shorewall-lite/shorewall.conf

---

⭐ SEE ALSO ⭐

https://shorewall.org/Documentation_Index.html

shorewall-lite(8), shorewall-accounting(5), shorewall-actions(5), shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5), shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5), shorewall-netmap(5), shorewall-params(5), shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5), shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5), shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)

---

And that's the whole page, bestie — go read the rest of the girlies listed above if you want the full lore. 🫶

This one came out of the Configuration Files collection, dated 09/24/2020, and it's filed under SHOREWALL-LITE.CO(5). Periodt. 💅✨