2004-07-18 03:20:50 +02:00
|
|
|
Shorewall 2.0.7
|
2004-03-15 19:47:21 +01:00
|
|
|
|
|
|
|
|
----------------------------------------------------------------------
|
2004-07-07 16:16:55 +02:00
|
|
|
Problems Corrected in version 2.0.4
|
2004-05-14 00:07:06 +02:00
|
|
|
|
2004-07-06 16:13:52 +02:00
|
|
|
1) A DNAT rule with 'fw' as the source that specified logging caused
|
|
|
|
|
"shorewall start" to fail.
|
2004-05-14 00:07:06 +02:00
|
|
|
|
2004-07-07 16:16:55 +02:00
|
|
|
----------------------------------------------------------------------
|
|
|
|
|
Problems Corrected in version 2.0.5
|
|
|
|
|
|
|
|
|
|
1) Eliminated "$RESTOREBASE: ambiguous redirect" messages during
|
|
|
|
|
"shorewll stop" in the case where DISABLE_IPV6=Yes in
|
|
|
|
|
shorewall.conf.
|
|
|
|
|
|
2004-07-10 04:08:03 +02:00
|
|
|
2) An anachronistic reference to the mangle option was removed from
|
|
|
|
|
shorewall.conf.
|
2004-07-11 18:17:29 +02:00
|
|
|
|
|
|
|
|
----------------------------------------------------------------------
|
|
|
|
|
Problems Corrected in version 2.0.6
|
|
|
|
|
|
2004-07-11 20:33:02 +02:00
|
|
|
1) Some users have reported the pkttype match option in iptables/
|
2004-07-11 18:17:29 +02:00
|
|
|
Netfilter failing to match certain broadcast packets. The result
|
2004-07-11 20:33:02 +02:00
|
|
|
is that the firewall log shows a lot of broadcast packets.
|
2004-07-11 18:17:29 +02:00
|
|
|
|
2004-07-14 22:08:12 +02:00
|
|
|
Other users have complained of the following message when
|
|
|
|
|
starting Shorewall:
|
|
|
|
|
|
|
|
|
|
modprobe: cant locate module ipt_pkttype
|
|
|
|
|
|
|
|
|
|
Users experiencing either of these problems can use PKTTYPE=No in
|
2004-07-11 18:17:29 +02:00
|
|
|
shorewall.conf to cause Shorewall to use IP address filtering of
|
2004-07-13 15:15:11 +02:00
|
|
|
broadcasts rather than packet type.
|
|
|
|
|
|
|
|
|
|
2) The shorewall.conf and zones file are no longer given execute
|
|
|
|
|
permission by the installer script.
|
2004-07-14 22:08:12 +02:00
|
|
|
|
|
|
|
|
3) ICMP packets that are in the INVALID state are now dropped by the
|
|
|
|
|
Reject and Drop default actions. They do so using the new
|
|
|
|
|
'dropInvalid' builtin action.
|
2004-07-18 03:20:50 +02:00
|
|
|
-----------------------------------------------------------------------
|
|
|
|
|
Problems Corrected in version 2.0.7
|
|
|
|
|
|
2004-07-21 20:57:45 +02:00
|
|
|
1) The PKTTYPE option introduced in version 2.0.6 is now used when
|
2004-07-20 20:01:45 +02:00
|
|
|
generating rules to REJECT packets. Broadcast packets are silently
|
|
|
|
|
dropped rather than being rejected with an ICMP (which is a protocol
|
|
|
|
|
violation) and users whose kernels have broken packet type match
|
|
|
|
|
support are likely to see messages reporting this violation.
|
|
|
|
|
Setting PKTTYPE=No should cause these messages to cease.
|
|
|
|
|
|
2004-07-25 19:55:29 +02:00
|
|
|
2) Multiple interfaces with the 'blacklist' option no longer result in
|
|
|
|
|
an error message at startup.
|
|
|
|
|
|
2004-07-21 20:57:45 +02:00
|
|
|
New Features in version 2.0.7
|
|
|
|
|
|
|
|
|
|
1) To improve supportability, the "shorewall status" command now
|
|
|
|
|
includes IP and Route configuration information.
|
|
|
|
|
|
|
|
|
|
Example:
|
|
|
|
|
|
|
|
|
|
IP Configuration
|
|
|
|
|
|
|
|
|
|
1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
|
|
|
|
|
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
|
|
|
|
|
inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
|
|
|
|
|
inet6 ::1/128 scope host
|
|
|
|
|
2: eth0: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc pfifo_fast qlen 1000
|
|
|
|
|
link/ether 00:a0:c9:15:39:78 brd ff:ff:ff:ff:ff:ff
|
|
|
|
|
inet6 fe80::2a0:c9ff:fe15:3978/64 scope link
|
|
|
|
|
3: eth1: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc pfifo_fast qlen 1000
|
|
|
|
|
link/ether 00:a0:c9:a7:d7:bf brd ff:ff:ff:ff:ff:ff
|
|
|
|
|
inet6 fe80::2a0:c9ff:fea7:d7bf/64 scope link
|
|
|
|
|
5: sit0@NONE: <NOARP> mtu 1480 qdisc noop
|
|
|
|
|
link/sit 0.0.0.0 brd 0.0.0.0
|
|
|
|
|
6: eth2: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc pfifo_fast qlen 1000
|
|
|
|
|
link/ether 00:40:d0:07:3a:1b brd ff:ff:ff:ff:ff:ff
|
|
|
|
|
inet6 fe80::240:d0ff:fe07:3a1b/64 scope link
|
|
|
|
|
7: br0: <BROADCAST,MULTICAST,NOTRAILERS,UP> mtu 1500 qdisc noqueue
|
|
|
|
|
link/ether 00:40:d0:07:3a:1b brd ff:ff:ff:ff:ff:ff
|
|
|
|
|
inet 192.168.1.3/24 brd 192.168.1.255 scope global br0
|
|
|
|
|
inet6 fe80::240:d0ff:fe07:3a1b/64 scope link
|
|
|
|
|
|
|
|
|
|
Routing Rules
|
|
|
|
|
|
|
|
|
|
0: from all lookup local
|
|
|
|
|
32765: from all fwmark ca lookup www.out
|
|
|
|
|
32766: from all lookup main
|
|
|
|
|
32767: from all lookup default
|
|
|
|
|
|
|
|
|
|
Table local:
|
|
|
|
|
|
|
|
|
|
broadcast 192.168.1.0 dev br0 proto kernel scope link src 192.168.1.3
|
|
|
|
|
broadcast 127.255.255.255 dev lo proto kernel scope link src 127.0.0.1
|
|
|
|
|
local 192.168.1.3 dev br0 proto kernel scope host src 192.168.1.3
|
|
|
|
|
broadcast 192.168.1.255 dev br0 proto kernel scope link src 192.168.1.3
|
|
|
|
|
broadcast 127.0.0.0 dev lo proto kernel scope link src 127.0.0.1
|
|
|
|
|
local 127.0.0.1 dev lo proto kernel scope host src 127.0.0.1
|
|
|
|
|
local 127.0.0.0/8 dev lo proto kernel scope host src 127.0.0.1
|
|
|
|
|
|
|
|
|
|
Table www.out:
|
|
|
|
|
|
|
|
|
|
default via 192.168.1.3 dev br0
|
|
|
|
|
|
|
|
|
|
Table main:
|
|
|
|
|
|
|
|
|
|
192.168.1.0/24 dev br0 proto kernel scope link src 192.168.1.3
|
|
|
|
|
default via 192.168.1.254 dev br0
|
|
|
|
|
|
|
|
|
|
Table default:
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2004-07-14 22:08:12 +02:00
|
|
|
|
|
|
|
|
|
