## Shorewall Version 4

### Tom Eastep

Copyright © 2007, 2009, 2015 Thomas M. Eastep

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of the license is included in the section entitled “GNU Free Documentation License”.

2026/01/29

## Introduction

Shorewall version 4.0 represented a substantial shift in direction for Shorewall. Up until then

- Shorewall had been written entirely in Bourne Shell.

- Shorewall had run the iptables utility to add each Netfilter rule.

Shorewall version 4.0 offered you a choice. You could continue to use the existing shell-based implementation or you could use a new implementation of the Shorewall compiler written in the Perl programming language. The new compiler:

- had a small disk footprint

- was very fast.

- generateed a firewall script that uses iptables-restore; so the script was very fast.

- generated better and more consistent error messages.

- did a much more thorough job of checking the configuration to avoid run-time errors.

- supported creating either Ipv4 or Ipv6 firewalls (Shorewall 4.2.4 and later).

Both compilers could be installed on your system and you could use whichever one suited you in a particular case.

## Shorewall 4.4

Shorewall 4.4 discontinued the availability of the legacy shell-based compiler. All users must migrate to the perl-based compiler before or during an upgrade to Shorewall version 4.4 or later. We highly recommend that current users of the shell-based compiler migrate before upgrading to 4.4 or later so that both compilers are available during the migration.

Shorewall 4.4 contains five packages:

- Shorewall - Everything needed to create an IPv4 firewall.

- Shorewall-lite- Can run scripts generated by Shorewall on another system.

- Shorewall6 - The utilities for creating and operating an Ipv6 firewall. Requires Shorewall.

- Shorewall6-lite - Ipv6 equivalent of Shorewall Lite. Can run scripts generated by Shoreall on another system.

- Shorewall-init - An add-on package for any of the other packages which can:

  1. Secure the firewall(s) prior to bringing up the interfaces (does not work with systems running Upstart)

  2. React to ifup/ifdown events and restart the firewall(s) if needed

## Shorewall 4.5/4.6

Shorewall 4.5 added an additional Shorewall-core package. This package contains the core Shorewall shell libraries that are required by the other packages.

## Prerequisites for using the Shorewall Version 4.2/4.4/4.5/4.6 Perl-based Compiler

- Perl (I use Perl 5.14.2 but other 5.8 or later versions should work fine).

  ### Note

  If you want to be able to use DNS names in your Shorewall6 configuration files, then Perl 5.10 or later is required together with the Perl Socket6 module.

- Perl Cwd Module

- Perl File::Basename Module

- Perl File::Temp Module

- Perl Getopt::Long Module

- Perl Carp Module

- Perl FindBin Module

- Perl Scalar::Util Module

- Perl Digest::SHA1 Module (Shorewall 4.5 only)

Please note that there are additional requirements if you plan to install and use Shorewall6.

## Incompatibilities Introduced in the Shorewall Version 4 Perl-based Compiler

The Shorewall Perl-based compiler is not 100% compatible with the Shorewall shell-based version. See this document for details.