Shorewall on a Laptop

Tom Eastep

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of the license is included in the section entitled “GNU Free Documentation License”.


Table of Contents



Laptop computers generally have several network interfaces, one of which will be used at a time.

  1. Ethernet interface ‒ Used when the computer is on the desktop at home or at work.

  2. Wireless interface ‒ Used when the laptop is being used in a cafe, train or airline terminal.

  3. Point-to-point (PPP) interface ‒ Used when neither wired nor wireless service are available.

Shorewall can be configured to treat these interfaces the same and to be able to switch between them without having to reconfigure.


The key to configuring Shorewall on a laptop is to define multiple optional interfaces for the 'net' zone in /etc/shorewall/interfaces.

net            eth0           detect              optional,…
net            wlan0          detect              optional,…
net            ppp0           -                   optional,…

With this configuration, access to the 'net' zone is possible regardless of which of the interfaces is being used.