1)  On systems running Upstart, shorewall-init cannot reliably secure
    the firewall before interfaces are brought up.

2)  The 'enable', 'reenable' and 'disable' commands do not work
    correctly in configurations with USE_DEFAULT_RT=No and optional
    providers listed in the DUPLICATE column.

3)  While the 'ip' utility now accepts IPv6 routes with multiple
    'nexthop' destinations, these routes are not balanced. They are
    rather instantiated as a sequence of single routes with different
    metrics.  Furthermore,  the 'ip route replace' command fails on
    such routes. Beginning with Shorewall6 5.0.15, the generated script
    uses a "delete..add.." sequence on these routes rather than a
    single "replace" command.

4)  On Debian-derived systems, when DOCKER=Yes, the 'systemctl restart
    shorewall' command looses Docker rules.

    Workaround (courtesy of J Cliff Armstrong):

    Type (as root):

        `systemctl edit shorewall.service`.

    This will open the default terminal editor to a blank file in
    which you can paste the following:

    [Service]
    # reset ExecStop
    ExecStop=
    # set ExecStop to "stop" instead of "clear"
    ExecStop=/sbin/shorewall $OPTIONS stop

    Then type `systemctl daemon-reload` to activate the changes. This
    change will survive future updates of the shorewall package from apt
    repositories. The override file itself will be saved to
    `/etc/systemd/system/shorewall.service.d/`.
