SHOREWALL-NETMAP(5)

💖 SHOREWALL-NETMAP 💖

okay bestie, welcome to SHOREWALL-NETMAP(5) — a page from the Configuration Files chapter of the Shorewall manual, and honestly? it's giving address-remapping royalty. 👑

---

✨ NAME ✨

netmap — the Shorewall NETMAP definition file. it's the file where you tell Shorewall how to map addresses from one network onto the corresponding addresses in another network. lowkey magical. 🦋

---

🌸 SYNOPSIS 🌸

/etc/shorewall[6]/netmap

yes, that [6] means the IPv6 version lives right next door. she contains multitudes. 💜

---

💅 DESCRIPTION 💅

So this file is used to map addresses in one network to corresponding addresses in a second network. that's the whole vibe. ✨

⚠️ Warning, bestie, pay attention: to use this file, your kernel and iptables must have NETMAP support included. no NETMAP support, no NETMAP. periodt. 💀

The columns in the file are as follows — and where the column name is followed by a different name in parentheses, that different name is the one used in the alternate specification syntax. iykyk. 🎀

🧚 The Columns 🧚

• TYPE — {DNAT|SNAT}
  • If DNAT, traffic entering INTERFACE and addressed to NET1 has its destination address rewritten to the corresponding address in NET2.
  • If SNAT, traffic leaving INTERFACE with a source address in NET1 has it's source address rewritten to the corresponding address in NET2.
• NET1 — network-address
  • Network in CIDR format (e.g., 192.168.1.0/24). Beginning with Shorewall 4.4.24, exclusion[1] is supported. fancy. 💖
• INTERFACE — interface
  • The name of a network interface. The interface must be defined in shorewall-interfaces[2](5). Shorewall allows loose matches to wildcard entries in shorewall-interfaces[2](5). For example, ppp0 in this file will match a shorewall-interfaces[2](8) entry that defines ppp+. yes, the + is doing a lot of work there and she's slaying. ✨
• NET2 — network-address
  • Network in CIDR format. that's it, that's the whole column. 💅
• NET3 (Optional) — network-address
  • Added in Shorewall 4.4.11. If specified, it qualifies INTERFACE. It specifies a SOURCE network for DNAT rules and a DESTINATION network for SNAT rules. situational awareness, queen. 👑
• PROTO — protocol-number-or-name
  • Optional — added in Shorewall 4.4.23.2. Only packets specifying this protocol will have their IP header modified. picky in the best way. 🙈
• DPORT — port-number-or-name-list
  • Optional — added in Shorewall 4.4.23.2. Destination Ports. A comma-separated list of Port names (from services(5)), port numbers or port ranges; if the protocol is icmp, this column is interpreted as the destination icmp-type(s). ICMP types may be specified as a numeric type, a numeric type and code separated by a slash (e.g., 3/4), or a typename. See https://shorewall.org/configuration_file_basics.htm#ICMP[3]. 🍓
  • If the protocol is ipp2p, this column is interpreted as an ipp2p option without the leading -- (example bit for bit-torrent). If no PORT is given, ipp2p is assumed.
  • An entry in this field requires that the PROTO column specify icmp (1), tcp (6), udp (17), sctp (132) or udplite (136). Use - if any of the following field is supplied.
  • This column was formerly labelled DEST PORT(S).
• SPORT — port-number-or-name-list
  • Optional — added in Shorewall 4.4.23.2. Source port(s). If omitted, any source port is acceptable. Specified as a comma-separated list of port names, port numbers or port ranges. 🌈
  • An entry in this field requires that the PROTO column specify tcp (6), udp (17), sctp (132) or udplite (136). Use - if any of the following fields is supplied.
  • This column was formerly labelled SOURCE PORT(S).

---

🎀 FILES 🎀

• /etc/shorewall/netmap
• /etc/shorewall6/netmap

two files, one for each IP situation, both iconic. ✨

---

🔥 SEE ALSO 🔥

• https://shorewall.org/netmap.html[4]
• https://shorewall.org/configuration_file_basics.htm#Pairs[5]
• shorewall(8)

---

💜 NOTES 💜

1. exclusion https://shorewall.org/manpages/shorewall-exclusion.html
2. shorewall-interfaces https://shorewall.org/manpages/shorewall-interfaces.html
3. https://shorewall.org/configuration_file_basics.htm#ICMP https://shorewall.org/configuration_file_basics.htm#ICMP
4. https://shorewall.org/netmap.html https://shorewall.org/netmap.html
5. https://shorewall.org/configuration_file_basics.htm#Pairs https://shorewall.org/configuration_file_basics.htm#Pairs

---

and that's the whole page, bestie!! 🫶 this one's filed under Configuration Files, dated 09/24/2020, and its manual name is SHOREWALL-NETMAP(5) — go map some addresses and be the main character of your own firewall. mwah. 💖✨