In Shorewall6, there is no NAT of any kind (Netfilter6 doesn't support any form of NAT). Most people consider this to be a giant step forward.

When an ISP assigns you an IPv6 address, you are actually assigned an IPv6 prefix (similar to a subnet). A 64-bit prefix defines a subnet with 4 billion hosts squared (the size of the IPv4 address space squared). Regardless of the length of your prefix, you get to assign local addresses within that prefix.

The default zone type in Shorewall6 is ipv6. It is suggested that you specify ipv6 in the TYPE column of /etc/shorewall6/zones and a type of ipv4 in /etc/shorewall/zones; that way, if you run the wrong utility on a configuration, you will get an instant error.

The following interface options are available in /etc/shorewall6/interfaces:

The following host options are available in /etc/shorewall6/hosts:

Shorewall follows the usual convention of distinguishing IPv6 address by enclosing them in square brackets ("[" and "]").

Anywhere that an address or address list follows a colon (":"), the address or list may be enclosed in square brackets to improve readability.

Example (/etc/shorewall6/rules):

#ACTION        SOURCE              DEST                        PROTO          DEST
#                                                                             PORT(S)
ACCEPT         net                 $FW:[2002:ce7c:92b4::3]     tcp            22

When the colon is preceeded by an interface name, the angle brackets are required. This is true even when the address is a MAC address in Shorewall format.

Example (/etc/shorewall6/rules):

#ACTION        SOURCE                            DEST          PROTO          DEST
#                                                                             PORT(S)
ACCEPT         net:wlan0:[2002:ce7c:92b4::3]     tcp                          22

Prior to Shorewall 4.5.4, angled brackets ("<" and ">") were used. While these are still accepted, their use is deprecated in favor of square brackets.

Example (/etc/shorewall6/rules):

#ACTION        SOURCE                            DEST          PROTO          DEST
#                                                                             PORT(S)
ACCEPT         net:wlan0:<2002:ce7c:92b4::3>     tcp                          22

Prior to Shorewall 4.5.9, network addresses were required to be enclosed in either angle brackets or square brackets (e.g. [2001:470:b:787::/64]). Beginning with Shorewall 4.5.9, the more common representation that places the VLSM outside the brackets is accepted and preferred (e.g., [2001:470:b:787::]/64).

Beginning with Shorewall 4.5.14, the rules compiler translates "<" and ">" to "[" and "]" respectively before parsing. So square brackets may appear in error messages even when angled brackets were used.

When Shorewall6 or Shorewall6 Lite is in the stopped state, the following traffic is still allowed.

The Linux IPv6 stack does not support balancing (multi-hop) routes. Thehe balance and fallback options in shorewall6-providers(5) and USE_DEFAULT_RT=Yes in shorewall6.conf(5) are supported, but at most one provider can have the balance option and at most one provider can have the fallback option.

Several commands supported by /sbin/shorewall and /sbin/shorewall-lite are not supported by /sbin/shorewall6 and /sbin/shorewall6-lite:

The Shorewall6 package depends on Shorewall-common for application macros. Only certain address-family specific macros such as macro.AllowICMPs are included in Shorewall6. As a consequence, /usr/share/shorewall/ is included in the default Shorewall6 CONFIG_PATH.