2002-09-16 19:13:39 +02:00
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
< html >
< head >
2003-05-15 21:39:23 +02:00
2002-09-29 23:42:38 +02:00
< meta http-equiv = "Content-Type"
content="text/html; charset=windows-1252">
2002-09-16 19:13:39 +02:00
< title > Upgrade Issues< / title >
2003-05-15 21:39:23 +02:00
2002-09-16 19:13:39 +02:00
< meta name = "GENERATOR" content = "Microsoft FrontPage 5.0" >
2003-05-15 21:39:23 +02:00
2003-01-31 22:50:51 +01:00
< meta name = "ProgId" content = "FrontPage.Editor.Document" >
2003-05-15 21:39:23 +02:00
2002-09-16 19:13:39 +02:00
< meta name = "Microsoft Theme" content = "none" >
< / head >
2002-09-29 23:42:38 +02:00
< body >
2003-05-15 21:39:23 +02:00
2002-09-29 23:42:38 +02:00
< table border = "0" cellpadding = "0" cellspacing = "0"
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
bgcolor="#400169" height="90">
2003-05-15 21:39:23 +02:00
< tbody >
< tr >
< td width = "100%" >
2002-09-29 23:42:38 +02:00
< h1 align = "center" > < font color = "#ffffff" > Upgrade Issues< / font > < / h1 >
2003-05-15 21:39:23 +02:00
< / td >
< / tr >
< / tbody >
2002-09-29 23:42:38 +02:00
< / table >
2003-05-15 21:39:23 +02:00
2002-09-29 23:42:38 +02:00
< p > For upgrade instructions see the < a
2003-03-22 01:25:40 +01:00
href="Install.htm">Install/Upgrade page< / a > .< br >
2003-05-15 21:39:23 +02:00
< / p >
< p > It is important that you read all of the sections on this page where the
version number mentioned in the section title is later than what you are
2003-04-13 17:28:32 +02:00
currently running.< br >
2003-05-15 21:39:23 +02:00
< / p >
< p > In the descriptions that follows, the term < b > < i > group < / i > < / b > refers
to a particular network or subnetwork (which may be 0.0.0.0/0 or it may be
a host address) accessed through a particular interface.< br >
< / p >
2003-04-13 17:28:32 +02:00
< p > Examples:< br >
2003-05-15 21:39:23 +02:00
<20> <> <EFBFBD> < br >
<20> <> <EFBFBD> eth0:0.0.0.0/0< br >
<20> <> <EFBFBD> eth2:192.168.1.0/24< br >
<20> <> <EFBFBD> eth3:192.0.2.123< br >
< / p >
< p > You can use the "shorewall check" command to see the groups associated
with each of your zones.< br >
< / p >
2003-03-22 01:25:40 +01:00
< h3 > < / h3 >
2003-05-15 21:39:23 +02:00
2003-04-13 17:28:32 +02:00
< h3 > Version > = 1.4.2< / h3 >
2003-05-15 21:39:23 +02:00
There are some cases where you may want to handle traffic from a particular
group to itself. While I personally think that such a setups are ridiculous,
2003-04-13 17:28:32 +02:00
there are two cases covered in this documentation where it can occur:< br >
2003-05-15 21:39:23 +02:00
2003-04-13 17:28:32 +02:00
< ol >
2003-05-15 21:39:23 +02:00
< li > < a href = "FAQ.htm#faq2" > In FAQ #2< / a > .< / li >
< li > < a href = "Shorewall_Squid_Usage.html" > When running Squid as a transparent
2003-04-13 17:28:32 +02:00
proxy in your local zone.< / a > < / li >
2003-05-15 21:39:23 +02:00
2003-04-13 17:28:32 +02:00
< / ol >
2003-05-15 21:39:23 +02:00
If you have either of these cases, you will want to review the current documentation
2003-04-13 17:28:32 +02:00
and change your configuration accordingly.< br >
2003-05-15 21:39:23 +02:00
2003-03-22 01:25:40 +01:00
< h3 > Version > = 1.4.1< / h3 >
2003-05-15 21:39:23 +02:00
2003-01-31 22:50:51 +01:00
< ul >
2003-05-15 21:39:23 +02:00
< li > Beginning with Version 1.4.1, traffic between groups in the same
zone is accepted by default. Previously, traffic from a zone to itself was
treated just like any other traffic; any matching rules were applied followed
by enforcement of the appropriate policy. With 1.4.1 and later versions,
unless you have explicit rules for traffic from Z to Z or you have an explicit
Z to Z policy (where "Z" is some zone) then traffic between the groups
in zone Z will be accepted. If you do have one or more explicit rules for
Z to Z or if you have an explicit Z to Z policy then the behavior is as it
was in prior versions.< / li >
2003-03-22 01:25:40 +01:00
< / ul >
2003-05-15 21:39:23 +02:00
< blockquote >
2003-03-22 01:25:40 +01:00
< ol >
2003-05-15 21:39:23 +02:00
< li > If you have a Z Z ACCEPT policy for a zone to allow traffic
between two interfaces to the same zone, that policy can be removed and
traffic between the interfaces will traverse fewer rules than previously.< / li >
< li > If you have a Z Z DROP or Z Z REJECT policy or you have Z-> Z
2003-04-13 17:28:32 +02:00
rules then your configuration should not require any change.< / li >
2003-05-15 21:39:23 +02:00
< li > If you are currently relying on a implicit policy (one that has
"all" in either the SOURCE or DESTINATION column) to prevent traffic between
two interfaces to a zone Z and you have no rules for Z-> Z then you should
2003-04-13 17:28:32 +02:00
add an explicit DROP or REJECT policy for Z to Z.< br >
2003-05-15 21:39:23 +02:00
< / li >
2003-03-22 01:25:40 +01:00
< / ol >
2003-05-15 21:39:23 +02:00
< / blockquote >
2003-03-22 01:25:40 +01:00
< ul >
2003-05-15 21:39:23 +02:00
< li > Sometimes, you want two separate zones on one interface but you
don't want Shorewall to set up any infrastructure to handle traffic between
them. < / li >
2003-03-07 00:41:31 +01:00
< / ul >
2003-05-15 21:39:23 +02:00
< blockquote > Example:< br >
< blockquote >
< pre > /etc/shorewall/zones< br > < br > z1 Zone1 The first Zone< br > z2 Zone2 The secont Zone< br > < br > /etc/shorewall/interfaces< br > < br > z2 eth1 192.168.1.255< br > < br > /etc/shorewall/hosts< br > < br > z1 eth1:192.168.1.3< br > < / pre >
< / blockquote >
Here, zone z1 is nested in zone z2 and the firewall is not going to be
involved in any traffic between these two zones. Beginning with Shorewall
1.4.1, you can prevent Shorewall from setting up any infrastructure to handle
traffic between z1 and z2 by using the new NONE policy:< br >
< blockquote >
< pre > /etc/shorewall/policy< br > < pre > z1 z2 NONE< br > z2 z1 NONE< / pre > < / pre >
2003-04-13 17:28:32 +02:00
< / blockquote >
2003-05-15 21:39:23 +02:00
Note that NONE policies are generally used in pairs unless there is asymetric
routing where only the traffic on one direction flows through the firewall
and you are using a NONE polciy in the other direction.<2E> < / blockquote >
< h3 > Version 1.4.1< br >
< / h3 >
< ul >
< li > In Version 1.4.1, Shorewall will never create rules to deal
with traffic from a given group back to itself. The < i > multi< / i > interface
option is no longer available so if you want to route traffic between two
subnetworks on the same interface then I recommend that you upgrade to Version
1.4.2 and use the 'routeback' interface or host option.<2E> < / li >
< / ul >
2003-03-22 01:25:40 +01:00
< h3 > Version > = 1.4.0< / h3 >
2003-05-15 21:39:23 +02:00
< b > IMPORTANT: Shorewall > =1.4.0 < / b > < b > requires< / b > < b > the iproute
2003-04-13 17:28:32 +02:00
package ('ip' utility).< / b > < br >
2003-05-15 21:39:23 +02:00
< br >
< b > Note: < / b > Unfortunately, some distributions call this package iproute2
2003-04-13 17:28:32 +02:00
which will cause the upgrade of Shorewall to fail with the diagnostic:< br >
2003-05-15 21:39:23 +02:00
< br >
<20> <20> <20> error: failed dependencies:iproute is needed by shorewall-1.4.0-1
2003-03-23 19:47:54 +01:00
< br >
2003-05-15 21:39:23 +02:00
< br >
This may be worked around by using the --nodeps option of rpm (rpm
2003-04-13 17:28:32 +02:00
-Uvh --nodeps < shorewall rpm> ).< br >
2003-05-15 21:39:23 +02:00
< br >
If you are upgrading from a version < 1.4.0, then:< br >
2003-02-20 00:21:55 +01:00
< ul >
2003-05-15 21:39:23 +02:00
< li > The < b > noping < / b > and < b > forwardping< / b > interface options
are no longer supported nor is the < b > FORWARDPING < / b > option in shorewall.conf.
ICMP echo-request (ping) packets are treated just like any other connection
2003-04-13 17:28:32 +02:00
request and are subject to rules and policies.< / li >
2003-05-15 21:39:23 +02:00
< li > Interface names of the form < device> :< integer>
in /etc/shorewall/interfaces now generate a Shorewall error at startup
2003-04-13 17:28:32 +02:00
(they always have produced warnings in iptables).< / li >
2003-05-15 21:39:23 +02:00
< li > The MERGE_HOSTS variable has been removed from shorewall.conf.
Shorewall 1.4 behaves like 1.3 did when MERGE_HOSTS=Yes; that is zone
contents are determined by BOTH the interfaces and hosts files when there
are entries for the zone in both files.< / li >
< li > The < b > routestopped< / b > option in the interfaces and hosts
2003-04-13 17:28:32 +02:00
file has been eliminated; use entries in the routestopped file instead.< / li >
2003-05-15 21:39:23 +02:00
< li > The Shorewall 1.2 syntax for DNAT and REDIRECT rules is
2003-04-13 17:28:32 +02:00
no longer accepted; you must convert to using the new syntax.< / li >
2003-05-15 21:39:23 +02:00
< li value = "6" > The ALLOWRELATED variable in shorewall.conf is
no longer supported. Shorewall 1.4 behavior is the same as 1.3 with
ALLOWRELATED=Yes.< / li >
< li value = "6" > Late-arriving DNS replies are now dropped by
default; there is no need for your own /etc/shorewall/common file simply
to avoid logging these packets.< / li >
< li value = "6" > The 'firewall', 'functions' and 'version' file
have been moved to /usr/share/shorewall.< / li >
< li value = "6" > The icmp.def file has been removed. If you include
2003-04-13 17:28:32 +02:00
it from /etc/shorewall/icmpdef, you will need to modify that file.< / li >
2003-05-15 21:39:23 +02:00
2003-02-20 00:21:55 +01:00
< ul >
2003-05-15 21:39:23 +02:00
2003-02-20 00:21:55 +01:00
< / ul >
2003-05-15 21:39:23 +02:00
< li > If you followed the advice in FAQ #2 and call find_interface_address
2003-04-13 17:28:32 +02:00
in /etc/shorewall/params, that code should be moved to /etc/shorewall/init.< br >
2003-05-15 21:39:23 +02:00
< / li >
2003-03-22 01:25:40 +01:00
< / ul >
2003-05-15 21:39:23 +02:00
2003-03-22 01:25:40 +01:00
< ul >
2003-05-15 21:39:23 +02:00
2003-03-22 01:25:40 +01:00
< / ul >
2003-05-15 21:39:23 +02:00
2003-03-22 01:25:40 +01:00
< h3 > Version 1.4.0< / h3 >
2003-05-15 21:39:23 +02:00
2003-03-22 01:25:40 +01:00
< ul >
2003-05-15 21:39:23 +02:00
< li value = "8" > The 'multi' interface option is no longer supported.
<EFBFBD> Shorewall will generate rules for sending packets back out the same interface
that they arrived on in two cases:< / li >
2003-03-22 01:25:40 +01:00
< / ul >
2003-05-15 21:39:23 +02:00
< blockquote >
2003-02-20 00:21:55 +01:00
< ul >
2003-05-15 21:39:23 +02:00
< li > There is an < u > explicit< / u > policy for the source zone to or
from the destination zone. An explicit policy names both zones and does
2003-04-13 17:28:32 +02:00
not use the 'all' reserved word.< / li >
2003-05-15 21:39:23 +02:00
2003-02-20 00:21:55 +01:00
< / ul >
2003-05-15 21:39:23 +02:00
2003-03-22 01:25:40 +01:00
< ul >
2003-05-15 21:39:23 +02:00
< li > There are one or more rules for traffic for the source zone
to or from the destination zone including rules that use the 'all' reserved
word. Exception: if the source zone and destination zone are the same then
the rule must be explicit - it must name the zone in both the SOURCE and
DESTINATION columns.< / li >
2003-03-22 01:25:40 +01:00
< / ul >
2003-05-15 21:39:23 +02:00
< / blockquote >
2003-02-20 00:21:55 +01:00
< h3 > Version > = 1.3.14< / h3 >
2003-05-15 21:39:23 +02:00
< img src = "images/BD21298_3.gif" alt = "" width = "13"
2003-04-13 17:28:32 +02:00
height="13">
2003-05-15 21:39:23 +02:00
<20> <> <20> Beginning in version 1.3.14, Shorewall treats entries in
< a href = "Documentation.htm#Masq" > /etc/shorewall/masq < / a > differently. The
change involves entries with an < b > interface name< / b > in the < b > SUBNET< / b >
(second) < b > column< / b > :< br >
2003-02-20 00:21:55 +01:00
< ul >
2003-05-15 21:39:23 +02:00
< li > Prior to 1.3.14, Shorewall would detect the FIRST subnet
on the interface (as shown by "ip addr show < i > interface< / i > ") and would
masquerade traffic from that subnet. Any other subnets that routed through
eth1 needed their own entry in /etc/shorewall/masq to be masqueraded
2003-03-23 19:47:54 +01:00
or to have SNAT applied.< / li >
2003-05-15 21:39:23 +02:00
< li > Beginning with Shorewall 1.3.14, Shorewall uses the firewall's
routing table to determine ALL subnets routed through the named interface.
Traffic originating in ANY of those subnets is masqueraded or has SNAT
2003-04-13 17:28:32 +02:00
applied.< / li >
2003-05-15 21:39:23 +02:00
2003-02-20 00:21:55 +01:00
< / ul >
2003-05-15 21:39:23 +02:00
You will need to make a change to your configuration if:< br >
2003-01-31 22:50:51 +01:00
< ol >
2003-05-15 21:39:23 +02:00
< li > You have one or more entries in /etc/shorewall/masq with
2003-04-13 17:28:32 +02:00
an interface name in the SUBNET (second) column; and< / li >
2003-05-15 21:39:23 +02:00
< li > That interface connects to more than one subnetwork.< / li >
2003-01-31 22:50:51 +01:00
< / ol >
2003-05-15 21:39:23 +02:00
Two examples:< br >
< br >
<20> < b > Example 1< / b > -- Suppose that your current config is as
2003-04-13 17:28:32 +02:00
follows:< br >
2003-05-15 21:39:23 +02:00
<20> <> < br >
2003-01-31 22:50:51 +01:00
< pre > [root@gateway test]# cat /etc/shorewall/masq< br > #INTERFACE<43> <45> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> SUBNET<45> <54> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> ADDRESS< br > eth0<68> <30> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> eth2<68> <32> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> 206.124.146.176< br > eth0<68> <30> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> 192.168.10.0/24<32> <34> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> 206.124.146.176< br > #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE< br > [root@gateway test]# ip route show dev eth2< br > 192.168.1.0/24<32> scope link< br > 192.168.10.0/24<32> proto kernel<65> scope link<6E> src 192.168.10.254< br > [root@gateway test]#< / pre >
2003-05-15 21:39:23 +02:00
< blockquote > In this case, the second entry in /etc/shorewall/masq is no longer
2003-04-13 17:28:32 +02:00
required.< br >
2003-05-15 21:39:23 +02:00
< / blockquote >
< b > Example 2< / b > -- What if your current configuration is like
2003-04-13 17:28:32 +02:00
this?< br >
2003-05-15 21:39:23 +02:00
2003-01-31 22:50:51 +01:00
< pre > [root@gateway test]# cat /etc/shorewall/masq < br > #INTERFACE<43> <45> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> SUBNET<45> <54> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> ADDRESS < br > eth0<68> <30> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> eth2<68> <32> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> 206.124.146.176< br > #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE < br > [root@gateway test]# ip route show dev eth2 < br > 192.168.1.0/24<32> scope link< br > 192.168.10.0/24<32> proto kernel<65> scope link<6E> src 192.168.10.254 < br > [root@gateway test]#< / pre >
2003-05-15 21:39:23 +02:00
< blockquote > In this case, you would want to change the entry in /etc/shorewall/masq
2003-04-13 17:28:32 +02:00
to:< br >
2003-05-15 21:39:23 +02:00
< / blockquote >
2003-01-31 22:50:51 +01:00
< pre > #INTERFACE<43> <45> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> SUBNET<45> <54> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> ADDRESS < br > eth0<68> <30> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> 192.168.1.0/24<32> <34> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> 206.124.146.176< br > #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE< / pre >
2003-05-15 21:39:23 +02:00
< img src = "images/BD21298_3.gif" alt = "" width = "13"
2003-04-13 17:28:32 +02:00
height="13">
2003-05-15 21:39:23 +02:00
<20> <> <EFBFBD> Version 1.3.14 also introduced simplified ICMP echo-request
(ping) handling. The option OLD_PING_HANDLING=Yes in /etc/shorewall/shorewall.conf
is used to specify that the old (pre-1.3.14) ping handling is to be
used (If the option is not set in your /etc/shorewall/shorewall.conf then
OLD_PING_HANDLING=Yes is assumed). I don't plan on supporting the old
handling indefinitely so I urge current users to migrate to using the
new handling as soon as possible. See the < a href = "ping.html" > 'Ping' handling
documentation< / a > for details.< br >
2002-11-09 19:06:34 +01:00
< h3 > Version 1.3.10< / h3 >
2003-05-15 21:39:23 +02:00
If you have installed the 1.3.10 Beta 1 RPM and are now upgrading
2003-04-13 17:28:32 +02:00
to version 1.3.10, you will need to use the '--force' option:< br >
2003-05-15 21:39:23 +02:00
< br >
< blockquote >
2002-11-09 19:06:34 +01:00
< pre > rpm -Uvh --force shorewall-1.3.10-1.noarch.rpm<70> < / pre >
2003-05-15 21:39:23 +02:00
< / blockquote >
2003-01-31 22:50:51 +01:00
< h3 > Version > = 1.3.9< / h3 >
2003-05-15 21:39:23 +02:00
The 'functions' file has moved to /usr/lib/shorewall/functions.
If you have an application that uses functions from that file, your
2003-04-13 17:28:32 +02:00
application will need to be changed to reflect this change of location.< br >
2003-05-15 21:39:23 +02:00
2002-09-29 23:42:38 +02:00
< h3 > Version > = 1.3.8< / h3 >
2003-05-15 21:39:23 +02:00
< p > If you have a pair of firewall systems configured for failover
or if you have asymmetric routing, you will need to modify
your firewall setup slightly under Shorewall
versions > = 1.3.8. Beginning with version 1.3.8,
you must set NEWNOTSYN=Yes in your
/etc/shorewall/shorewall.conf file.< / p >
2002-09-29 23:42:38 +02:00
< h3 > Version > = 1.3.7< / h3 >
2003-05-15 21:39:23 +02:00
< p > Users specifying ALLOWRELATED=No in /etc/shorewall.conf
will need to include the following
rules in their /etc/shorewall/icmpdef file (creating this file
if necessary):< / p >
2002-09-29 23:42:38 +02:00
< pre > run_iptables -A icmpdef -p ICMP --icmp-type echo-reply -j ACCEPT< br > run_iptables -A icmpdef -p ICMP --icmp-type source-quench -j ACCEPT< br > run_iptables -A icmpdef -p ICMP --icmp-type destination-unreachable -j ACCEPT< br > run_iptables -A icmpdef -p ICMP --icmp-type time-exceeded -j ACCEPT< br > run_iptables -A icmpdef -p ICMP --icmp-type parameter-problem -j ACCEPT< / pre >
2003-05-15 21:39:23 +02:00
< p > Users having an /etc/shorewall/icmpdef file may remove the ". /etc/shorewall/icmp.def"
2003-04-13 17:28:32 +02:00
command from that file since the icmp.def file is now empty.< / p >
2003-05-15 21:39:23 +02:00
2003-04-13 17:28:32 +02:00
< h3 > < b > < a name = "Bering" > Upgrading < / a > Bering to Shorewall > = 1.3.3< / b > < / h3 >
2003-05-15 21:39:23 +02:00
2003-04-13 17:28:32 +02:00
< p > To properly upgrade with Shorewall version 1.3.3 and later:< / p >
2003-05-15 21:39:23 +02:00
2002-09-29 23:42:38 +02:00
< ol >
2003-05-15 21:39:23 +02:00
< li > Be sure you have
a backup -- you will need to transcribe
any Shorewall configuration changes
that you have made to the new configuration.< / li >
< li > Replace the shorwall.lrp
package provided on the Bering floppy
with the later one. If you did not
obtain the later version from Jacques's site, see additional instructions
below.< / li >
< li > Edit the /var/lib/lrpkg/root.exclude.list
file and remove the /var/lib/shorewall
entry if present. Then do not forget
2003-04-13 17:28:32 +02:00
to backup root.lrp !< / li >
2003-05-15 21:39:23 +02:00
2002-09-16 19:13:39 +02:00
< / ol >
2003-05-15 21:39:23 +02:00
< p > The .lrp that I release isn't set up for a two-interface firewall like
Jacques's. You need to follow the < a href = "two-interface.htm" > instructions
for setting up a two-interface firewall< / a > plus you also need
2003-03-23 19:47:54 +01:00
to add the following two Bering-specific rules to /etc/shorewall/rules:< / p >
2003-05-15 21:39:23 +02:00
< blockquote >
2002-09-29 23:42:38 +02:00
< pre > # Bering specific rules:< br > # allow loc to fw udp/53 for dnscache to work< br > # allow loc to fw tcp/80 for weblet to work< br > #< br > ACCEPT loc fw udp 53< br > ACCEPT loc fw tcp 80< / pre >
2003-05-15 21:39:23 +02:00
< / blockquote >
2002-09-29 23:42:38 +02:00
< h3 align = "left" > Version 1.3.6 and 1.3.7< / h3 >
2003-05-15 21:39:23 +02:00
< p align = "left" > If you have a pair of firewall systems configured for
failover or if you have asymmetric routing, you will need to modify
your firewall setup slightly under Shorewall versions
1.3.6 and 1.3.7< / p >
2002-09-29 23:42:38 +02:00
< ol >
2003-05-15 21:39:23 +02:00
< li >
< p align = "left" > Create the file /etc/shorewall/newnotsyn and in it add
2003-04-13 17:28:32 +02:00
the following rule< br >
2003-05-15 21:39:23 +02:00
< br >
< font face = "Courier" > run_iptables -A newnotsyn
-j RETURN # So that the connection tracking table can be
2003-04-13 17:28:32 +02:00
rebuilt< br >
2003-05-15 21:39:23 +02:00
<20> <> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> # from
2003-04-13 17:28:32 +02:00
non-SYN packets after takeover.< br >
2003-05-15 21:39:23 +02:00
<20> < / font > < / p >
< / li >
< li >
< p align = "left" > Create /etc/shorewall/common (if you don't already
have that file) and include the following:< br >
< br >
< font face = "Courier" > run_iptables -A common
-p tcp --tcp-flags ACK,FIN,RST ACK -j ACCEPT #Accept Acks
to rebuild connection< br >
<20> <> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD>
2003-04-13 17:28:32 +02:00
#tracking table. < br >
2003-05-15 21:39:23 +02:00
. /etc/shorewall/common.def< / font > < / p >
< / li >
2002-09-29 23:42:38 +02:00
< / ol >
2003-05-15 21:39:23 +02:00
2002-09-29 23:42:38 +02:00
< h3 align = "left" > Versions > = 1.3.5< / h3 >
2003-05-15 21:39:23 +02:00
< p align = "left" > Some forms of pre-1.3.0 rules file syntax are no longer
supported. < / p >
2002-09-29 23:42:38 +02:00
< p align = "left" > Example 1:< / p >
2003-05-15 21:39:23 +02:00
< div align = "left" >
2002-09-29 23:42:38 +02:00
< pre > ACCEPT net loc:192.168.1.12:22 tcp 11111 - all< / pre >
2003-05-15 21:39:23 +02:00
< / div >
2002-09-29 23:42:38 +02:00
< p align = "left" > Must be replaced with:< / p >
2003-05-15 21:39:23 +02:00
< div align = "left" >
2002-09-29 23:42:38 +02:00
< pre > DNAT net loc:192.168.1.12:22 tcp 11111< / pre >
2003-05-15 21:39:23 +02:00
< / div >
< div align = "left" >
2002-09-29 23:42:38 +02:00
< p align = "left" > Example 2:< / p >
2003-05-15 21:39:23 +02:00
< / div >
< div align = "left" >
2003-04-13 17:28:32 +02:00
< pre > ACCEPT loc fw::3128 tcp 80 - all< / pre >
2003-05-15 21:39:23 +02:00
< / div >
< div align = "left" >
2002-09-29 23:42:38 +02:00
< p align = "left" > Must be replaced with:< / p >
2003-05-15 21:39:23 +02:00
< / div >
< div align = "left" >
2003-04-13 17:28:32 +02:00
< pre > REDIRECT loc 3128 tcp 80< / pre >
2003-05-15 21:39:23 +02:00
< / div >
2002-09-29 23:42:38 +02:00
< h3 align = "left" > Version > = 1.3.2< / h3 >
2003-05-15 21:39:23 +02:00
< p align = "left" > The functions and versions files together with the 'firewall'
symbolic link have moved from /etc/shorewall to /var/lib/shorewall.
If you have applications that access these files, those applications
should be modified accordingly.< / p >
< p > < font size = "2" > Last updated 4/13/2003 - < a href = "support.htm" > Tom
Eastep< / a > < / font > < / p >
< p > < font face = "Trebuchet MS" > < a href = "copyright.htm" > < font size = "2" > Copyright< / font >
2003-04-13 17:28:32 +02:00
<20> < font size = "2" > 2001, 2002, 2003 Thomas M. Eastep.< / font > < / a > < / font > < br >
2003-05-15 21:39:23 +02:00
< / p >
< br >
2003-01-31 22:50:51 +01:00
< br >
2002-09-16 19:13:39 +02:00
< / body >
2002-09-29 23:42:38 +02:00
< / html >
