1) On systems running Upstart, shorewall-init cannot reliably secure the firewall before interfaces are brought up. 2) The 'enable', 'reenable' and 'disable' commands do not work correctly in configurations with USE_DEFAULT_RT=No and optional providers listed in the DUPLICATE column. 3) When SHAREDIR is not set to /usr/share/, the Shorewall-core installer fails to update lib.base and lib.cli to look in the correct directory for the shorewallrc file. Workaround: Edit the two files and modify the line following this comment to source the correct shorewallrc file. # # This is modified by the installer when ${SHAREDIR} != /usr/share # Alternative workaround: Edit install.sh and change these two lines replacing "${PRODUCT}" with "shorewall". eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/${PRODUCT}/lib.base eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/${PRODUCT}/lib.cli You can ignore the like that modifies lib.core, since that files does not actually require modification. Corrected in Shorewall 5.1.10.1.