In a modular kernel, each helper is typically packaged as two kernel modules. One module handles connection tracking where NAT isn't involved and the other module handles NAT. For example, the FTP helper consists of these two modules (kernels 2.6.20 and later):

Note that the naming convention is nf_conntrack_application and nf_nat_application; more about that below.

Prior to Shorewall 4.5.7, helper modules were not auto-loaded and must be loaded explicitly using the modprob or insmod utilities. Beginning with Shorewall 4.5.7, these modules are loaded when Shorewall is determining the capabilities of your system.

Many of the modules allow parameters to be specified when the module is loaded. Among the common parameters is the ports parameter that lists one or more ports that the module is to monitor. This allows running the application on a non-standard port.

Iptables supports two ways of interacting with modules:

It is important to note that the name used in iptables is not always the same as the name in the kernel module. Names used in iptables are shown in the following table:

Netfilter helpers present an opportunity for attackers to attempt to breach your firewall by IP address spoofing; See https://home.regit.org/netfilter-en/secure-use-of-helpers/ for a description of the Netfilter facilities available to meet these attacks.

Shorewall includes support for loading the helper modules as part of its support for loading kernel modules in general. There are several options in shorewall.conf (5) that deal with kernel module loading:

The helper modules to be loaded are listed in the file /usr/share/shorewall/helpers. If you wish to customize that file to load only a subset of the helpers or to specify module parameters, then copy the file to /etc/shorewall/ and modify the copy. That way, your changes won't be overwritten the next time that Shorewall is updated on your system.

On systems running a a kernel earlier than 3.5, not all of the helpers can be totally disabled. The following modules can be disabled by using the parameter ports=0 in /etc/shorewall/helpers:

After disabling one or more helpers using this method, you must:

Note that if you choose to reboot your system to unload the modules, then if you have CT:helper entries in shorewall-conntrack (5) that refer to the module(s) and you have AUTOMAKE=Yes in shorewall.conf (5), then Shorewall will fail to start at boot time.

The iptables helper match is supported by Shorewall in the form of the HELPER column in shorewall-mangle (5) and shorewall-tcrules (5).

The CT target is supported directly in shorewall-conntrack (5).

In these files, Shorewall supports the same module names as iptables; see the table above.

Beginning with Shorewall 4.5.7, there is a HELPER column in shorewall-rules (5). In the NEW section, this column allows the explicit association of a helper with connections allowed by a given rules. The column may contain any of the helper names recognized by iptables (see the table above). In the RELATED section, the rule will only match the packet if the related connection has the named helper attached.

Also added in Shorewall 4.5.7 is the HELPER action in shorewall-rules (5). HELPER rules associate the helper listed in the HELPER column with connections that match the rule. A destination zone should not be specified in HELPER rules.

The output of shorewall show capabilities has two entries for each of the helpers listed above that can be disabled by adding ports=0 in /etc/shorewall/helpers.

shorewall show capabilities
   Amanda Helper: Available
   FTP Helper: Not available
   FTP-0 Helper: Available
   IRC Helper: Not available
   IRC-0 Helper: Available
   Netbios_ns Helper: Available
   H323 Helper: Not available
   PPTP Helper: Available
   SANE Helper: Not available
   SANE-0 Helper: Available
   SNMP Helper: Available
   TFTP Helper: Not available
   TFTP-0 Helper: Available
   iptables -S (IPTABLES_S): Available
   Basic Filter (BASIC_FILTER): Available
   CT Target (CT_TARGET): Available
   Kernel Version (KERNELVERSION): 30404
   Capabilities Version (CAPVERSION): 40507

The above output is produced when this /etc/shorewall/helpers file is used on a system running kernel 3.4.4:

loadmodule nf_conntrack_ftp         ports=0
loadmodule nf_conntrack_irc         ports=0
loadmodule nf_conntrack_netbios_ns
loadmodule nf_conntrack_sip         ports=0
loadmodule nf_conntrack_tftp        ports=0
loadmodule nf_conntrack_sane        ports=0

The reason for the double capabilities is that when ports=0 is specified, the iptables name of the helper gets '-0' added to it. So in order for the compiler to generate the correct iptables commands, it needs to know if ports=0 was specified for each of the helprs that support it.

Notice that most of the other helpers are available, even though their modules were not loaded. That's because auto-loading occurs during capability detection on those modules whose iptables name matches the module name.