How-To Alpine Wall - Revision history

Prabuanand: added wikilink and simplified introduction

2026-01-24T16:56:34Z

added wikilink and simplified introduction

← Older revision		Revision as of 16:56, 24 January 2026
Line 1:		Line 1:
	This ~~guide~~ shows how to configure ~~a firewall using~~ Alpine Wall (awall)~~, a Linux~~ firewall ~~configuration tool, providing various benefits over plain iptables~~. ~~[https://git~~.~~alpinelinux~~.~~org/awall/about/ Alpine Wall User Guide] is~~ the ~~official source for details about the syntax~~.		This page shows how to configure Alpine Wall(awall) as compared to {{pkg\|Shorewall}} firewall. This comparison is meant to help readers who are familiar with Shorewall learn AWall. Awall users should follow the AWall configuration examples. Use the Shorewall examples as contextual references, or ignore them, if unfamiliar with Shorewall.

	~~The purpose of this~~ page is ~~to illustrate~~ Alpine Wall ~~(AWall) by example. This page explains AWall from the viewpoint of {{pkg\|Shorewall}}, a firewall configuration tool used in many applications. This comparison~~ is ~~meant to help readers who are familiar with Shorewall learn AWall. You should follow~~ the ~~AWall configuration examples. Use~~ the ~~Shorewall examples as contextual references, or ignore them, if unfamiliar with Shorewall~~.		[[Zero-To-Awall]] howto page is meant for users with no firewall experience and [https://git.alpinelinux.org/awall/about/ Alpine Wall User Guide] is the official source for details about the syntax.

	== Installation ==		== Installation ==

Prabuanand: additional changes by rewording sentence based on email from W. Michael Petullo

2026-01-24T16:21:16Z

additional changes by rewording sentence based on email from W. Michael Petullo <mike@flyn.org>

← Older revision		Revision as of 16:21, 24 January 2026
Line 1:		Line 1:
	[https://git.alpinelinux.org/awall/about/ Alpine Wall User Guide] is the official source for details about the syntax. The purpose of this page is to illustrate Alpine Wall (AWall) by example. This page explains AWall from the viewpoint of a Shorewall ~~user~~.		This guide shows how to configure a firewall using Alpine Wall (awall), a Linux firewall configuration tool, providing various benefits over plain iptables. [https://git.alpinelinux.org/awall/about/ Alpine Wall User Guide] is the official source for details about the syntax.

			The purpose of this page is to illustrate Alpine Wall (AWall) by example. This page explains AWall from the viewpoint of {{pkg\|Shorewall}}, a firewall configuration tool used in many applications. This comparison is meant to help readers who are familiar with Shorewall learn AWall. You should follow the AWall configuration examples. Use the Shorewall examples as contextual references, or ignore them, if unfamiliar with Shorewall.

	== Installation ==		== Installation ==
Line 33:		Line 35:
	* services ''(like {{Path\|/usr/share/shorewall/macro.HTTP}})''		* services ''(like {{Path\|/usr/share/shorewall/macro.HTTP}})''

	== Basic home firewall ==		== Basic home firewall configuration ==

	The below ~~example shows the "Basic~~ home firewall~~" configuration for both Shorewall and~~ AWall. ~~Based on below example, it can be clearly seen~~ that AWall ''Policy'' files ~~are not equivalent to~~ Shorewall's ~~{{Path\|/etc/shorewall/~~policy}} files.		The examples below show how to configure a basic home firewall using AWall. Note that AWall Policy files differ substantially from Shorewall's policy files in syntax and layout.

	=== Shorewall configuration ===		=== Shorewall configuration ===

	Let's suppose you have the following Shorewall configuration: {{cat\|/etc/shorewall/zones\|inet ipv4		Let's suppose you have the following Shorewall configuration files in {{Path\|/etc/shorewall/}}, which you want to convert to a [[#AWall configuration\|configuration for AWall]]. {{cat\|/etc/shorewall/zones\|inet ipv4
	loc ipv4}}		loc ipv4}}

Line 53:		Line 55:
	=== AWall configuration ===		=== AWall configuration ===

	The equivalent AWall configuration that does the same thing as the above Shorewall example is given below.		The equivalent AWall configuration that does the same thing as the above [[#Shorewall configuration\|Shorewall example]] is given below.

	Create a new file called {{Path\|/etc/awall/optional/home-policy.json}} and add the following content {{Cat\|/etc/awall/optional/home-policy.json\|<nowiki>		Create a new file called {{Path\|/etc/awall/optional/home-policy.json}} and add the following content {{Cat\|/etc/awall/optional/home-policy.json\|<nowiki>
Line 72:		Line 74:
	{ "out": "inet" }		{ "out": "inet" }
	]		]
	}</nowiki>		}</nowiki>}}
	}}
	The above configuration will:		The above configuration will:
	* Create a description of your ''Policy''		* Create a description of your ''Policy''
Line 86:		Line 88:
	=== Activating/Applying a Policy ===		=== Activating/Applying a Policy ===

	After saving the ''Policy'' you can run the following commands to activate your firewall settings:		After saving the ''Policy'' you can run the following commands to activate your firewall settings.
	{{cmd\|awall list ~~# Listing available~~ 'Policy~~(s)~~' ~~(This step is optional)~~		To listing available 'Policy(s)' {{cmd\|# awall list}}
	awall enable ~~test~~-policy ~~# Enables the 'Policy'~~		To enable the 'Policy' created in the previous section:{{cmd\|# awall enable home-policy}}
	~~awall activate # Genereates~~ firewall configuration from the 'Policy' ~~files~~ and ~~enables~~ it ~~(starts~~ the firewall)}}		To generate firewall configuration from the 'Policy' file and enable it i.e start the firewall: {{Cmd\|# awall activate}}

	If you have multiple policies, after enabling or disabling them, you need to always run ''awall activate'' in order to update the iptables rules.		If you have multiple policies, after enabling or disabling them, you need to always run {{Codeline\|'''awall activate'''}} in order to update the iptables rules.

	== Advanced configuration ==		== Advanced configuration ==

	Assuming you have your {{Path\|/etc/awall/optional/home-policy.json}} with your "Basic home firewall" settings, you could choose to modify that file to test the below examples.		Assuming you have your {{Path\|/etc/awall/optional/home-policy.json}} with your "Basic home firewall" settings, you could choose to modify that file to test the below examples. You could also create new files in {{Path\|/etc/awall/optional/}} for testing some of the below examples.

			AWall already has a "service" definition list for several services like HTTP, FTP, SNMP, etc. '' in the file {{Path\|/usr/share/awall/mandatory/services.json}})''

	{{~~Tip~~\|~~You could also create new files~~ in ~~{{Path\|/etc/awall/optional/}} for testing some of the below examples~~}}		{{Note\|If you are adding the sample content given in this section to an already existing policy file, then make sure you add "," signs where they are needed!}}

	=== Logging ===		=== Logging ===
Line 105:		Line 109:
	You could add the following row to the "policy" section in your ''Policy'' file in order to see the dropped packets.		You could add the following row to the "policy" section in your ''Policy'' file in order to see the dropped packets.
	<pre>{ "in": "inet", "out": "loc", "action": "drop" }</pre>		<pre>{ "in": "inet", "out": "loc", "action": "drop" }</pre>

	~~{{Note\|If you are adding the above content to an already existing file, then make sure you add "," signs where they are needed!}}~~

	=== Port forwarding ===		=== Port forwarding ===

	Let's suppose you have a local web server (192.168.1.10) that you want to make accessible from the "inet".<br>		Let's suppose you have a local web server (192.168.1.10) that you want to make accessible from the "inet".<br>
	With Shorewall you would have a rule like this in your {{~~Path~~\|/etc/shorewall/rules~~}}:~~		With Shorewall you would have a rule like this in your {{Cat\|/etc/shorewall/rules\|<nowiki>#ACTION SOURCE DEST PROTO DEST PORT(S) SOURCEPORT(S) ORIGINALDEST
	<~~pre~~>		DNAT inet loc:192.168.1.10 tcp 80</nowiki>}}
	#ACTION SOURCE DEST PROTO DEST ~~SOURCE ORIGINAL~~
	# PORT(S) ~~PORT~~(S) ~~DEST~~
	DNAT inet loc:192.168.1.10 tcp 80
	</~~pre~~>

	Lets configure our AWall ''Policy'' file likewise by adding the following content.		Lets configure our AWall ''Policy'' file likewise by adding the following content.
Line 137:		Line 135:
	* "variable" section where we specify some IP-addresses		* "variable" section where we specify some IP-addresses
	* "filter" section where we do the actual port-forwarding (using the variables we just created and using some preexisting "services" definitions)		* "filter" section where we do the actual port-forwarding (using the variables we just created and using some preexisting "services" definitions)
	~~{{Note\|If you are adding the above content to a already existing file, then make sure you add "," signs where they are needed!}}~~
	~~{{Tip\|AWall already has a "service" definition list for several services like HTTP, FTP, SNMP, etc. ''(see {{Path\|/usr/share/awall/mandatory/services.json}})''}}~~

	If you need to forward to a different port (e.g. 8080) you can do:		If you need to forward to a different port (e.g. 8080) you can do:
Line 158:		Line 154:
	}		}
	</pre>		</pre>
	~~{{Note\|If you are adding the above content to a already existing file, then make sure you add "," signs where they are needed!}}~~

	=== Inherit services or variables ===		=== Inherit services or variables ===
Line 183:		Line 178:

	== See also ==		== See also ==

	* [https://git.alpinelinux.org/awall/about/ Alpine Wall User Guide]		* [https://git.alpinelinux.org/awall/about/ Alpine Wall User Guide]
	* [[Zero-To-Awall]]		* [[Zero-To-Awall]]
	* [https://www.cyberciti.biz/faq/how-to-set-up-a-firewall-with-awall-on-alpine-linux/ How To Set Up a Firewall with Awall on Alpine Linux]		* [https://www.cyberciti.biz/faq/how-to-set-up-a-firewall-with-awall-on-alpine-linux/ How To Set Up a Firewall with Awall on Alpine Linux]


	[[Category:Firewall]]		[[Category:Firewall]]

Prabuanand: updated instructions based on https://lists.alpinelinux.org/~alpine/devel/%3CaVhxrpww1wvEmBWB%40imp.flyn.org%3E#%3C7f95fffb-67ed-2ea8-95e0-e4794363bed9@alpinelinux.org%3E

2026-01-24T06:35:17Z

updated instructions based on https://lists.alpinelinux.org/~alpine/devel/%3CaVhxrpww1wvEmBWB%40imp.flyn.org%3E#%3C7f95fffb-67ed-2ea8-95e0-e4794363bed9@alpinelinux.org%3E

@@ Line 1: / Line 1: @@
 [https://git.alpinelinux.org/awall/about/ Alpine Wall User Guide] is the official source for details about the syntax. The purpose of this page is to illustrate Alpine Wall (AWall) by example. This page explains AWall from the viewpoint of a Shorewall user.
-== Configuration files ==
+== Installation ==
 Your [[Alpine Wall]] configuration files go in {{Path|/etc/awall/optional}}. From version 0.2.12 and later, Awall will look for ''Policy'' files in both the former and {{Path|/usr/share/awall/optional}}

Prabuanand: removed wrong instructions based on email from Kaarle Ritvanen in alpine-devel mailing list 8 days ago

2026-01-24T06:04:44Z

removed wrong instructions based on email from Kaarle Ritvanen in alpine-devel mailing list 8 days ago

← Older revision		Revision as of 06:04, 24 January 2026
Line 1:		Line 1:
	[https://git.alpinelinux.org/awall/about/ Alpine Wall User Guide] is the official source for details about the syntax. The purpose of this page is to illustrate Alpine Wall (AWall) by example. This page explains AWall from the viewpoint of a Shorewall user.		[https://git.alpinelinux.org/awall/about/ Alpine Wall User Guide] is the official source for details about the syntax. The purpose of this page is to illustrate Alpine Wall (AWall) by example. This page explains AWall from the viewpoint of a Shorewall user.

	~~== Installation ==~~

	~~Install the {{pkg\|awall}} package and make sure you are running the latest version by running the following commands:~~
	~~{{cmd\|<nowiki># apk add iptables awall~~
	~~$ apk version awall</nowiki>}}~~

	~~== Prerequisites ==~~

	~~After installing AWall, you need to load the following iptables modules:~~
	~~{{cmd\|<nowiki># modprobe ip_tables~~
	~~# modprobe iptable_nat #if NAT is used</nowiki>}}~~

	~~This is needed only one time after awall installation.~~

	~~To make the firewall autostart at boot and autoload the needed modules:~~
	~~{{cmd\|<nowiki># rc-update add iptables~~
	~~# rc-update add ip6tables</nowiki>}}~~

	== Configuration files ==		== Configuration files ==

Prabuanand: added links to see-also section

2025-05-22T13:10:43Z

added links to see-also section

← Older revision		Revision as of 13:10, 22 May 2025
Line 1:		Line 1:
	[https://git.alpinelinux.org/awall/about/ Alpine Wall User's Guide] is the official source for details about the syntax. The purpose of this page is to illustrate Alpine Wall (AWall) by example. This page explains AWall from the viewpoint of a Shorewall user.		[https://git.alpinelinux.org/awall/about/ Alpine Wall User Guide] is the official source for details about the syntax. The purpose of this page is to illustrate Alpine Wall (AWall) by example. This page explains AWall from the viewpoint of a Shorewall user.

	== Installation ==		== Installation ==
Line 185:		Line 185:

	== See also ==		== See also ==
			* [https://git.alpinelinux.org/awall/about/ Alpine Wall User Guide]
	* [[Zero-To-Awall]]		* [[Zero-To-Awall]]
			* [https://www.cyberciti.biz/faq/how-to-set-up-a-firewall-with-awall-on-alpine-linux/ How To Set Up a Firewall with Awall on Alpine Linux]


	[[Category:Firewall]]		[[Category:Firewall]]

Prabuanand: cleaned up page, added wikilinks, wikitags

2025-05-11T10:17:54Z

cleaned up page, added wikilinks, wikitags

Show changes

Prabuanand: added category Firewall :Category:Firewall

2025-04-09T11:17:53Z

added category Firewall Category:Firewall

← Older revision		Revision as of 11:17, 9 April 2025
Line 185:		Line 185:
	* [[Zero-To-Awall]]		* [[Zero-To-Awall]]

	[[Category:~~Networking]]~~		[[Category:Firewall]]
	~~[[Category:Security~~]]

Prabuanand: /* Structure */ fixed the dangling }}

2024-08-09T15:05:10Z

Structure: fixed the dangling }}

← Older revision		Revision as of 15:05, 9 August 2024
Line 15:		Line 15:

	== Structure ==		== Structure ==
	Your ~~awall}}~~ configuration files go in {{Path\|/etc/awall/optional}}<br>		Your [[Alpine Wall]] configuration files go in {{Path\|/etc/awall/optional}}<br>
	Each such file is called a ''Policy''.<br>		Each such file is called a ''Policy''.<br>
	{{note\| awall versions prior 0.2.12 will only look for ''Policy'' files in {{Path\|/usr/share/awall/optional}}.<br>From version 0.2.12 and higher, awall will look for ''Policy'' files in both {{Path\|/etc/awall/optional}} and {{Path\|/usr/share/awall/optional}}}}		{{note\| awall versions prior 0.2.12 will only look for ''Policy'' files in {{Path\|/usr/share/awall/optional}}.<br>From version 0.2.12 and higher, awall will look for ''Policy'' files in both {{Path\|/etc/awall/optional}} and {{Path\|/usr/share/awall/optional}}}}

Zcrayfish: Deal with excessive/redundant usage of the pkg template. Remove notes about ancient versions. other misc improvements.

2024-01-13T08:43:33Z

Deal with excessive/redundant usage of the pkg template. Remove notes about ancient versions. other misc improvements.

Show changes

Zcrayfish: Alpine Wall User's Guide has moved to git.

2023-09-06T05:32:49Z

Alpine Wall User's Guide has moved to git.

← Older revision		Revision as of 05:32, 6 September 2023
Line 4:		Line 4:

	{{pkg\|awall}} is available since Alpine v2.4.<BR>		{{pkg\|awall}} is available since Alpine v2.4.<BR>
	Please see [~~[Alpine_Wall_User~~'~~s_Guide]~~] for details about the syntax.		Please see [https://git.alpinelinux.org/awall/about/ Alpine Wall User's Guide] for details about the syntax.

	Some of the below features and examples assume you are running {{pkg\|awall}} version 0.2.12 or later.<BR>		Some of the below features and examples assume you are running {{pkg\|awall}} version 0.2.12 or later.<BR>