SHOREWALL-INIT(8)

💖 SHOREWALL-INIT — the companion package 💖

okay bestie, so this is shorewall-init, and it lives in section 8 of the manual (Administrative Commands, if you're keeping score 🎀). It's the lil sidekick package that hangs out with the big kids. Let's get into it ✨

---

🌸 NAME 🌸

shorewall-init — the companion package. that's it, that's the name, and honestly? iconic. 👑

---

🦋 SYNOPSIS 🦋

shorewall-init [start|stop]

that's the whole vibe. you either start it or you stop it. pick your fighter 💅

---

💜 DESCRIPTION 💜

okay so shorewall-init is an optional package — it's been around since Shorewall 4.4.10 — and you can install it alongside Shorewall, Shorewall6, Shorewall-lite and/or Shorewall6-lite. no cap.

It gives you two key features:

1. It can close (stop) the firewall during boot, before the network starts. The way this matters?? it can prevent unwanted connections from being accepted in that cursed little window after the network comes up but before the firewall is started. like, the gap era. we don't do that anymore. 🚫🔥
2. It can interface with your distribution's ifup/ifdown scripts and/or NetworkManager so the firewall can do its little actions when an interface starts or stops. so coordinated. so demure. 🧚

Both of these capabilities can be enabled separately. you do you, boo.

After you install the shorewall-init package, you activate it by editing the Shorewall-init configuration file:

• On Debian-based systems, that file is /etc/default/shorewall-init.
• On other systems, that file is /etc/sysconfig/shorewall-init.

⭐ Activating the safe boot feature ⭐

To turn on the safe boot feature, edit that config file and set PRODUCTS to a space-separated list of Shorewall products you want to be closed before networking starts.

Example, bestie:

PRODUCTS="shorewall shorewall6"

You also must make sure that the compiled scripts for the listed products are compiled using Shorewall 4.4.10 or later. no skipping this, fr fr.

• Shorewall — run:

shorewall compile

• Shorewall6 — run:

shorewall6 compile

• Shorewall-lite — on the administrative system, enter the command shorewall export firewall from the firewall's configuration directory.
• Shorewall6-lite — on the administrative system, enter the command shorewall6 export firewall from the firewall's configuration directory.

🌈 Activating the ifup/ifdown + NetworkManager thing 🌈

The second feature (the ifup/ifdown and NetworkManager integration) should only be activated on systems that do not use a link status monitor line swping or LSM. read that again. only. okay periodt.

• Edit the configuration file and set IFUPDOWN=1.

For NetworkManager integration, you're gonna want to disable firewall startup at boot and delay it to when your interface comes up. For this to work correctly, you must set the required or the optional option on at least one interface, and then:

• On Debian-based systems, edit /etc/default/product for each product listed in the PRODUCTS setting and set startup=0.
• On other systems, use the distribution's service control tool (insserv, chkconfig, etc.) to disable startup of the products listed in the PRODUCTS setting.

🫶 the laptop situation 🫶

On a laptop with both Ethernet and wireless interfaces, you'll want to make both interfaces optional and set the REQUIRE_INTERFACE option to Yes in shorewall.conf[1](5) or shorewall6.conf[1] (5). This causes the firewall to remain stopped until at least one of the interfaces comes up. main character energy: it waits for its moment. 💅✨

---

🎀 FILES 🎀

/etc/default/shorewall-init (Debian-based systems) or /etc/sysconfig/shorewall-init (other distributions)

---

👑 SEE ALSO 👑

shorewall(8)

---

💀 NOTES 💀

1. shorewall.conf https://shorewall.org/manpages/shorewall.conf.html

---

and that's the page, bestie!! 🦋 go forth and firewall responsibly. this was Administrative Commands, dated 09/24/2020, and yes the header/footer said SHOREWALL-INIT(8) the whole time — we just said it cuter. mwah 💖🌸✨