--- name: "shorewall-routestopped" section: "5" platform: "linux" package: "shorewall" version: "4.6.4.3-2" release: "Debian 8 (Jessie)" platforms: ["linux"] url: "https://new.carta.tech/shorewall-routestopped" --- # shorewall-routestopped(5) The Shorewall file that governs what traffic flows through the firewall while it is in the 'stopped' state. ## NAME routestopped - The Shorewall file that governs what traffic flows through the firewall while it is in the 'stopped' state. ## SYNOPSIS **/etc/shorewall/routestopped** ## DESCRIPTION This file is deprecated in favor of the **shorewall-stoppedrules**\[1\](5) file. This file is used to define the hosts that are accessible when the firewall is stopped or is being stopped. **Warning**\ Changes to this file do not take effect until after the next **shorewall start** or **shorewall restart** command. The columns in the file are as follows (where the column name is followed by a different name in parentheses, the different name is used in the alternate specification syntax). **INTERFACE** - *interface* Interface through which host(s) communicate with the firewall **HOST(S)** (hosts) - \[**-**\|*address*\[,*address*\]...\] Optional. Comma-separated list of IP/subnet addresses. If your kernel and iptables include iprange match support, IP address ranges are also allowed. If left empty or supplied as "-", 0.0.0.0/0 is assumed. **OPTIONS** - \[**-**\|*option*\[**,***option*\]...\] Optional. A comma-separated list of options. The order of the options is not important but the list can contain no embedded white-space. The currently-supported options are: **routeback** Set up a rule to ACCEPT traffic from these hosts back to themselves. Beginning with Shorewall 4.4.9, this option is automatically set if **routeback** is specified in **shorewall-interfaces**\[2\] (5) or if the rules compiler detects that the interface is a bridge. **source** Allow traffic from these hosts to ANY destination. Without this option or the **dest** option, only traffic from this host to other listed hosts (and the firewall) is allowed. If **source** is specified then **routeback** is redundant. **dest** Allow traffic to these hosts from ANY source. Without this option or the **source** option, only traffic from this host to other listed hosts (and the firewall) is allowed. If **dest** is specified then **routeback** is redundant. **notrack** The traffic will be exempted from connection tracking. **Note**\ The **source** and **dest** options work best when used in conjunction with ADMINISABSENTMINDED=Yes in **shorewall6.conf**\[3\](5). PROTO (Optional) – *protocol-name-or-number* Protocol. DEST PORT(S) (dport) – *service-name/port-number-list* Optional. A comma-separated list of port numbers and/or service names from /etc/services. May also include port ranges of the form *low-port*:*high-port* if your kernel and iptables include port range support. SOURCE PORT(S) (sport) – *service-name/port-number-list* Optional. A comma-separated list of port numbers and/or service names from /etc/services. May also include port ranges of the form *low-port*:*high-port* if your kernel and iptables include port range support. Beginning with Shorewall 4.5.15, you may place '=' in this column, provided that the DEST PORT(S) column is non-empty. This causes the rule to match when either the source port or the destination port in a packet matches one of the ports specified in DEST PORTS(S). Use of '=' requires multi-port match in your iptables and kernel. **Note**\ The **source** and **dest** options work best when used in conjunction with ADMINISABSENTMINDED=Yes in **shorewall.conf**\[4\](5). ## EXAMPLE Example 1: ``` #INTERFACE HOST(S) OPTIONS PROTO DEST SOURCE # PORT(S) PORT(S) eth2 192.168.1.0/24 eth0 192.0.2.44 br0 - routeback eth3 - source eth4 - notrack 41 ``` ## FILES /etc/shorewall/routestopped ## SEE ALSO **http://www.shorewall.net/starting\_and\_stopping\_shorewall.htm**\[5\] **http://www.shorewall.net/configuration\_file\_basics.htm#Pairs**\[6\] [shorewall(8)](/shorewall/8.md), [shorewall-accounting(5)](/shorewall-accounting/5.md), [shorewall-actions(5)](/shorewall-actions/5.md), [shorewall-blacklist(5)](/shorewall-blacklist/5.md), [shorewall-hosts(5)](/shorewall-hosts/5.md), shorewall\_interfaces(5), [shorewall-ipsets(5)](/shorewall-ipsets/5.md), [shorewall-maclist(5)](/shorewall-maclist/5.md), [shorewall-masq(5)](/shorewall-masq/5.md), [shorewall-nat(5)](/shorewall-nat/5.md), [shorewall-netmap(5)](/shorewall-netmap/5.md), [shorewall-params(5)](/shorewall-params/5.md), [shorewall-policy(5)](/shorewall-policy/5.md), [shorewall-providers(5)](/shorewall-providers/5.md), [shorewall-proxyarp(5)](/shorewall-proxyarp/5.md), [shorewall-rtrules(5)](/shorewall-rtrules/5.md), [shorewall-rules(5)](/shorewall-rules/5.md), [shorewall.conf(5)](/shorewall.conf/5.md), [shorewall-secmarks(5)](/shorewall-secmarks/5.md), [shorewall-tcclasses(5)](/shorewall-tcclasses/5.md), [shorewall-tcdevices(5)](/shorewall-tcdevices/5.md), [shorewall-mangle(5)](/shorewall-mangle/5.md), [shorewall-tos(5)](/shorewall-tos/5.md), [shorewall-tunnels(5)](/shorewall-tunnels/5.md), [shorewall-zones(5)](/shorewall-zones/5.md) ## NOTES - 1\. shorewall-stoppedrules http://www.shorewall.net/manpages/shorewall-stoppedrules.html - 2\. shorewall-interfaces http://www.shorewall.net/manpages/shorewall-interfaces.html - 3\. shorewall6.conf http://www.shorewall.netshorewall6.conf.html - 4\. shorewall.conf http://www.shorewall.net/manpages/shorewall.conf.html - 5\. http://www.shorewall.net/starting\_and\_stopping\_shorewall.htm http://www.shorewall.net/starting\_and\_stopping\_shorewall.htm - 6\. http://www.shorewall.net/configuration\_file\_basics.htm#Pairs http://www.shorewall.net/configuration\_file\_basics.htm#Pairs