Alpine Wall User's Guide - Revision history

Prabuanand: added redirect link

2026-01-24T16:35:38Z

added redirect link

← Older revision		Revision as of 16:35, 24 January 2026
Line 1:		Line 1:
	~~{{Delete\|All wikilinks on the entire wiki have already been changed to point to the awall guide on git. Nothing points to this article, nor should it}}~~		#REDIRECT [https://git.alpinelinux.org/awall/about/ Alpine Wall User's Guide]

	~~The current Alpine Wall User's Guide is available~~ [https://git.alpinelinux.org/awall/about/ ~~here~~].

Zcrayfish: Remove cat and add request for deletion.

2024-01-21T17:59:23Z

Remove cat and add request for deletion.

← Older revision		Revision as of 17:59, 21 January 2024
Line 1:		Line 1:
			{{Delete\|All wikilinks on the entire wiki have already been changed to point to the awall guide on git. Nothing points to this article, nor should it}}

	The current Alpine Wall User's Guide is available [https://git.alpinelinux.org/awall/about/ here].		The current Alpine Wall User's Guide is available [https://git.alpinelinux.org/awall/about/ here].


	~~[[Category:Networking]]~~

Sertonix: update cgit link

2023-08-25T21:02:23Z

update cgit link

← Older revision		Revision as of 21:02, 25 August 2023
Line 1:		Line 1:
	The current Alpine Wall User's Guide is available [~~http~~://git.alpinelinux.org~~/cgit~~/awall/about/ here].		The current Alpine Wall User's Guide is available [https://git.alpinelinux.org/awall/about/ here].


	[[Category:Networking]]		[[Category:Networking]]

Innsill: + Category:Networking

2019-09-13T12:22:23Z

+ Category:Networking

← Older revision		Revision as of 12:22, 13 September 2019
Line 1:		Line 1:
	The current Alpine Wall User's Guide is available [http://git.alpinelinux.org/cgit/awall/about/ here].		The current Alpine Wall User's Guide is available [http://git.alpinelinux.org/cgit/awall/about/ here].


			[[Category:Networking]]

Kunkku: Replaced content with "The current Alpine Wall User's Guide is available [http://git.alpinelinux.org/cgit/awall/about/ here]."

2015-12-24T11:01:16Z

Replaced content with "The current Alpine Wall User's Guide is available [http://git.alpinelinux.org/cgit/awall/about/ here]."

Show changes

Kunkku: /* Filter Rules */

2014-09-29T10:47:29Z

Filter Rules

← Older revision		Revision as of 10:47, 29 September 2014
Line 335:		Line 335:
	specified address replaces the original destination address. If		specified address replaces the original destination address. If
	also port translation is desired, the attribute may be defined as		also port translation is desired, the attribute may be defined as
	an object consisting of attributes '''addr''' and '''port'''.		an object consisting of attributes '''addr''' and '''port'''. The
	This option has no effect on IPv6 packets.		format of the '''port''' attribute is similar to that of the
			'''to-port''' attribute of [[#NAT Rules\|NAT rules]]. This option
			has no effect on IPv6 packets.

	Filter objects may have a boolean attribute named '''no-track'''. If		Filter objects may have a boolean attribute named '''no-track'''. If

Kunkku: /* Filter Rules */

2014-09-29T10:43:35Z

Filter Rules

← Older revision		Revision as of 10:43, 29 September 2014
Line 330:		Line 330:
	rule objects.		rule objects.

	Filter objects may have an attribute named '''dnat''', the value of		Filter objects may have an attribute named '''dnat''', the value
	which is an IPv4 address. If defined, this enables destination NAT for		of which is an IPv4 address. If defined, this enables destination
	all IPv4 packets matching the rule, such that the specified address		NAT for all IPv4 packets matching the rule, such that the
	replaces the original destination address. This option has no effect		specified address replaces the original destination address. If
	on IPv6 packets.		also port translation is desired, the attribute may be defined as
			an object consisting of attributes '''addr''' and '''port'''.
			This option has no effect on IPv6 packets.

	Filter objects may have a boolean attribute named '''no-track'''. If		Filter objects may have a boolean attribute named '''no-track'''. If

Kunkku: /* Configuration Objects */

2014-09-19T08:55:24Z

Configuration Objects

@@ Line 158: / Line 158: @@
 but their definitions overlap. In this case, the '''route-back'''
 attribute of the '''out''' zone determines the behavior.
 === Logging Classes ===
@@ Line 180: / Line 210: @@
 |-
 |'''limit'''
-|Maximum number of packets to be logged per second per this rule
+|Maximum number of packets to be logged defined as [[#Limits|limit]]
 |-
 |'''prefix'''
@@ Line 293: / Line 323: @@
 limits for packet flow or new connections. These are specified with
 the '''flow-limit''' and '''conn-limit''' attributes,
-respectively. The values of these attributes are limit objects that
+respectively. The values of these attributes are
-have two attributes: '''count''' and '''interval'''. '''count'''
+[[#Limits|limit objects]]. The '''drop''' action is applied to the
-specifies how many new connections or packets are allowed within the
+packets exceeding the limit. Optionally, the limit object may have an
-time frame specified by '''interval''' in seconds (default: 1). The
+attribute named '''log'''. It defines how the dropped packets should
-'''drop''' action is applied to the packets exceeding the
+be logged and is semantically similar to the '''log''' attribute of
-limit. Optionally, the limit object may have an attribute named
+rule objects.
 Filter objects may have an attribute named '''dnat''', the value of

Kunkku: /* Configuration Objects */

2014-09-19T08:19:07Z

Configuration Objects

← Older revision		Revision as of 08:19, 19 September 2014
Line 208:		Line 208:
	\|}		\|}

	Filter and policy rules can have an attribute named '''log'''. If it		[[#Filter Rules\|Filter]] and [[#Policy Rules\|policy]] rules can have
	is a string, it is interpreted as a reference to a logging class, and		an attribute named '''log'''. If it is a string, it is interpreted as
	logging is performed according to the definitions. If the value of the		a reference to a logging class, and logging is performed according to
	'''log''' attribute is '''true''' (boolean), logging is done using		the definitions. If the value of the '''log''' attribute is '''true'''
	default settings. If the value is '''false''' (boolean), logging is		(boolean), logging is done using default settings. If the value is
	disabled for the rule. If '''log''' is not defined, logging is done		'''false''' (boolean), logging is disabled for the rule. If '''log'''
	using the default settings except for accept rules, for which logging		is not defined, logging is done using the default settings except for
	is omitted.		accept rules, for which logging is omitted.

	Default logging settings can be set by defining a logging class named		Default logging settings can be set by defining a logging class named
Line 234:		Line 234:

	All rule objects can have the '''in''' and '''out''' attributes		All rule objects can have the '''in''' and '''out''' attributes
	referring to zones as described in the previous section. In addition,		referring to [[#Zones\|zones]] as described in the previous section. In
	the scope of the rule can be further constrained with the following		addition, the scope of the rule can be further constrained with the
	attributes:		following attributes:

	{\|		{\|
Line 242:		Line 242:
	\|-		\|-
	\|'''src'''		\|'''src'''
	\|Similar to '''addr''' attribute of zone objects		\|Similar to '''addr''' attribute of [[#Zones\|zone objects]]
	\|Packet's source address matches the value		\|Packet's source address matches the value
	\|-		\|-
	\|'''dest'''		\|'''dest'''
	\|Similar to '''addr''' attribute of zone objects		\|Similar to '''addr''' attribute of [[#Zones\|zone objects]]
	\|Packet's destination address matches the value		\|Packet's destination address matches the value
	\|-		\|-
	\|'''ipset'''		\|'''ipset'''
	\|Object containing two attributes: '''name''' referring to an IP set and '''args''', which is a list of strings '''in''' and '''out'''		\|Object containing two attributes: '''name''' referring to an [[#IP Sets\|IP set]] and '''args''', which is a list of strings '''in''' and '''out'''
	\|Packet matches the IP set referred here when the match arguments are taken from the source ('''in''') and destination ('''out''') address or port in the order specified by '''args'''		\|Packet matches the IP set referred here when the match arguments are taken from the source ('''in''') and destination ('''out''') address or port in the order specified by '''args'''
	\|-		\|-
Line 269:		Line 269:
	Filter objects specify an action for packets fulfilling certain		Filter objects specify an action for packets fulfilling certain
	criteria. The top-level attribute '''filter''' is a list of filter		criteria. The top-level attribute '''filter''' is a list of filter
	~~objects. The precedence rules are similar to those of policy~~ objects.		objects.

	Filter objects must have an attribute named '''action''', the value of		Filter objects must have an attribute named '''action''', the value of
Line 331:		Line 331:

	Policy objects must have the '''action''' attribute defined. The		Policy objects must have the '''action''' attribute defined. The
	possible values and their semantics are the same as in filter ~~objects~~.		possible values and their semantics are the same as in
			[[#Filter Rules\|filter rules]].

	==== Packet Logging Rules ====		==== Packet Logging Rules ====
Line 363:		Line 364:
	is kept intact.		is kept intact.

	~~Like~~ NAT rules, ~~connection tracking bypass rules~~ may have an		NAT rules, may have an '''action''' attribute set to value
	'''action''' attribute set to value '''include''' or		'''include''' or '''exclude'''. The latter means that NAT is not
	'''~~exclude~~'''.		performed on the matching packets (unless they match an '''include'''
			rule processed earlier). The default value is '''include'''.

	==== Packet Marking Rules ====		==== Packet Marking Rules ====
Line 413:		Line 415:
	attribute '''no-track''' is a list of such rules.		attribute '''no-track''' is a list of such rules.

	Like NAT rules, connection tracking bypass rules may have an		Like [[#NAT Rules\|NAT rules]], connection tracking bypass rules may
	'''action''' attribute set to value '''include''' or		have an '''action''' attribute set to value '''include''' or
	'''exclude'''.		'''exclude'''.

Kunkku: /* Connection Tracking Bypass Rules */

2014-03-31T16:50:44Z

Connection Tracking Bypass Rules

← Older revision		Revision as of 16:50, 31 March 2014
Line 413:		Line 413:
	attribute '''no-track''' is a list of such rules.		attribute '''no-track''' is a list of such rules.

	~~Connection~~ tracking bypass rules may have an '''action'''		Like NAT rules, connection tracking bypass rules may have an
	attribute set to value '''include''' or '''exclude'''~~, with~~		'''action''' attribute set to value '''include''' or
	~~behavior similar to that of NAT rules~~.		'''exclude'''.

	=== IP Sets ===		=== IP Sets ===