The default zone type in Shorewall6 is ipv6. It is suggested that you specify ipv6 in the TYPE column of /etc/shorewall6/zones and a type of ipv4 in /etc/shorewall/zones; that way, if you run the wrong utility on a configuration, you will get an instant error.

The following interface options are available in /etc/shorewall6/interfaces:

The following host options are available in /etc/shorewall6/hosts:

Shorewall follows the usual convention of distinguishing IPv6 address by enclosing them in square brackets ("[" and "]").

Anywhere that an address or address list follows a colon (":"), the address or list may be enclosed in square brackets to improve readability.

Example (/etc/shorewall6/rules):

#ACTION         SOURCE          DEST                    PROTO   DPORT

?SECTION NEW

ACCEPT          net             $FW:[2002:ce7c:92b4::3] tcp     22

When the colon is preceeded by an interface name, the angle brackets are required. This is true even when the address is a MAC address in Shorewall format.

Example (/etc/shorewall6/rules):

#ACTION         SOURCE                          DEST            PROTO   DPORT

?SECTION NEW

ACCEPT          net:wlan0:[2002:ce7c:92b4::3]   $FW             tcp     22

Prior to Shorewall 4.5.4, angled brackets ("<" and ">") were used. While these are still accepted, their use is deprecated in favor of square brackets.

Example (/etc/shorewall6/rules):

#ACTION         SOURCE                          DEST            PROTO   DPORT

SECTION NEW

ACCEPT          net:wlan0:<2002:ce7c:92b4::3>   $FW             tcp     22

Prior to Shorewall 4.5.9, network addresses were required to be enclosed in either angle brackets or square brackets (e.g. [2001:470:b:787::/64]). Beginning with Shorewall 4.5.9, the more common representation that places the VLSM outside the brackets is accepted and preferred (e.g., [2001:470:b:787::]/64).

Beginning with Shorewall 4.5.14, the rules compiler translates "<" and ">" to "[" and "]" respectively before parsing. So square brackets may appear in error messages even when angled brackets were used.

When Shorewall6 or Shorewall6 Lite is in the stopped state, the following traffic is still allowed.

The Linux IPv6 stack does not support balancing (multi-hop) routes. Thehe balance and fallback options in shorewall6-providers(5) and USE_DEFAULT_RT=Yes in shorewall6.conf(5) are supported, but at most one provider can have the balance option and at most one provider can have the fallback option.

Several commands supported by /sbin/shorewall and /sbin/shorewall-lite are not supported by /sbin/shorewall6 and /sbin/shorewall6-lite:

The Shorewall6 package depends on Shorewall for application macros. Only certain address-family specific macros such as macro.AllowICMPs are included in Shorewall6. As a consequence, /usr/share/shorewall/ is included in the default Shorewall6 CONFIG_PATH.