2003-02-21 23:22:52 +01:00
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
< html >
< head >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< meta http-equiv = "Content-Type"
content="text/html; charset=windows-1252">
< title > Shorewall 1.3 Errata< / title >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< meta name = "GENERATOR" content = "Microsoft FrontPage 5.0" >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< meta name = "ProgId" content = "FrontPage.Editor.Document" >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< meta name = "Microsoft Theme" content = "none" >
< / head >
< body >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< table border = "0" cellpadding = "0" cellspacing = "0"
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
bgcolor="#400169" height="90">
2003-03-18 02:13:38 +01:00
< tbody >
< tr >
2003-03-23 19:47:54 +01:00
< td width = "100%" >
2003-02-21 23:22:52 +01:00
< h1 align = "center" > < font color = "#ffffff" > Shorewall Errata/Upgrade Issues< / font > < / h1 >
2003-03-18 02:13:38 +01:00
< / td >
< / tr >
2003-03-23 19:47:54 +01:00
< / tbody >
2003-02-21 23:22:52 +01:00
< / table >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< p align = "center" > < b > < u > IMPORTANT< / u > < / b > < / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< ol >
2003-03-23 19:47:54 +01:00
< li >
2003-02-21 23:22:52 +01:00
< p align = "left" > < b > < u > I< / u > f you use a Windows system to download
2003-03-18 02:13:38 +01:00
a corrected script, be sure to run the script through < u >
< a href = "http://www.megaloman.com/%7Ehany/software/hd2u/"
2003-02-21 23:22:52 +01:00
style="text-decoration: none;"> dos2unix< / a > < / u > after you have moved
2003-03-18 02:13:38 +01:00
it to your Linux system.< / b > < / p >
< / li >
2003-03-23 19:47:54 +01:00
< li >
2003-02-21 23:22:52 +01:00
< p align = "left" > < b > If you are installing Shorewall for the
first time and plan to use the .tgz and install.sh script, you can
untar the archive, replace the 'firewall' script in the untarred directory
2003-03-18 02:13:38 +01:00
with the one you downloaded below, and then run install.sh.< / b > < / p >
< / li >
2003-03-23 19:47:54 +01:00
< li >
2003-02-21 23:22:52 +01:00
< p align = "left" > < b > If you are running a Shorewall version earlier
2003-03-23 19:47:54 +01:00
than 1.3.11, when the instructions say to install a corrected
2003-03-18 02:13:38 +01:00
firewall script in /etc/shorewall/firewall, /usr/lib/shorewall/firewall
2003-02-21 23:22:52 +01:00
or /var/lib/shorewall/firewall, use the 'cp' (or 'scp') utility to
overwrite the existing file. DO NOT REMOVE OR RENAME THE OLD
/etc/shorewall/firewall or /var/lib/shorewall/firewall before
you do that. /etc/shorewall/firewall and /var/lib/shorewall/firewall
are symbolic links that point to the 'shorewall' file used by
your system initialization scripts to start Shorewall during
boot. It is that file that must be overwritten with the corrected
script. Beginning with Shorewall 1.3.11, you may rename the existing file
before copying in the new file.< / b > < / p >
2003-03-18 02:13:38 +01:00
< / li >
2003-03-23 19:47:54 +01:00
< li >
2003-02-21 23:22:52 +01:00
< p align = "left" > < b > < font color = "#ff0000" > DO NOT INSTALL CORRECTED COMPONENTS
2003-03-18 02:13:38 +01:00
ON A RELEASE EARLIER THAN THE ONE THAT THEY ARE LISTED UNDER BELOW.
For example, do NOT install the 1.3.9a firewall script if you are running
1.3.7c.< / font > < / b > < br >
< / p >
< / li >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< / ol >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< ul >
2003-03-18 02:13:38 +01:00
< li > < b > < a href = "upgrade_issues.htm" > Upgrade Issues< / a > < / b > < / li >
< li > < b > < a
2003-02-21 23:22:52 +01:00
href="#V1.3">Problems in Version 1.3< / a > < / b > < / li >
2003-03-18 02:13:38 +01:00
< li > < b > < a
2003-02-21 23:22:52 +01:00
href="errata_2.htm">Problems in Version 1.2< / a > < / b > < / li >
2003-03-18 02:13:38 +01:00
< li > < b > < font
2003-02-21 23:22:52 +01:00
color="#660066"> < a href = "errata_1.htm" > Problems in Version 1.1< / a > < / font > < / b > < / li >
2003-03-18 02:13:38 +01:00
< li > < b > < font
2003-03-23 19:47:54 +01:00
color="#660066">< a href = "#iptables" > Problem with iptables version 1.2.3
2003-03-18 02:13:38 +01:00
on RH7.2< / a > < / font > < / b > < / li >
< li > < b > < a
2003-03-23 19:47:54 +01:00
href="#Debug">Problems with kernels > = 2.4.18 and
2003-02-21 23:22:52 +01:00
RedHat iptables< / a > < / b > < / li >
2003-03-18 02:13:38 +01:00
< li > < b > < a href = "#SuSE" > Problems installing/upgrading
RPM on SuSE< / a > < / b > < / li >
< li > < b > < a href = "#Multiport" > Problems with iptables
version 1.2.7 and MULTIPORT=Yes< / a > < / b > < / li >
2003-03-23 19:47:54 +01:00
< li > < b > < a href = "#NAT" > Problems with RH Kernel 2.4.18-10
2003-03-18 02:13:38 +01:00
and NAT< / a > < / b > < br >
< / li >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< / ul >
2003-03-23 19:47:54 +01:00
< hr >
2003-02-21 23:22:52 +01:00
< h2 align = "left" > < small > < / small > < a name = "V1.3" > < / a > Problems in Version 1.3< / h2 >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< h3 > Version 1.3.14< / h3 >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< ul >
2003-03-18 02:13:38 +01:00
< li > There is an < a
2003-03-23 19:47:54 +01:00
href="http://www.shorewall.net/pub/shorewall/errata/1.3.14/rfc1918">updated
rfc1918< / a > file that reflects the resent allocation of 222.0.0.0/8 and
2003-02-21 23:22:52 +01:00
223.0.0.0/8.< / li >
2003-03-23 19:47:54 +01:00
2003-03-18 02:13:38 +01:00
< / ul >
2003-03-23 19:47:54 +01:00
2003-03-18 02:13:38 +01:00
< ul >
2003-03-23 19:47:54 +01:00
< li > The documentation for the routestopped file claimed that a comma-separated
2003-03-18 02:13:38 +01:00
list could appear in the second column while the code only supported a single
host or network address.< / li >
< li > Log messages produced by 'logunclean' and 'dropunclean' were not rate-limited.< / li >
< li > 802.11b devices with names of the form < i > wlan< / i > < n> don't
support the 'maclist' interface option.< / li >
< li > Log messages generated by RFC 1918 filtering are not rate limited.< / li >
< li > The firewall fails to start in the case where you have "eth0 eth1"
in /etc/shorewall/masq and the default route is through eth1.< br >
2003-02-21 23:22:52 +01:00
< / li >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< / ul >
2003-03-18 02:13:38 +01:00
These problems have been corrected in < a
2003-03-23 19:47:54 +01:00
href="http://www.shorewall.net/pub/shorewall/errata/1.3.14/firewall">this
firewall script< / a > which may be installed in /usr/lib/shorewall as described
2003-03-18 02:13:38 +01:00
above.< br >
2003-03-23 19:47:54 +01:00
2003-03-18 02:13:38 +01:00
< h3 > Version 1.3.13< / h3 >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< ul >
2003-03-18 02:13:38 +01:00
< li > The 'shorewall add' command produces an error message referring
to 'find_interfaces_by_maclist'.< / li >
< li > The 'shorewall delete' command can leave behind undeleted rules.< / li >
< li > The 'shorewall add' command can fail with "iptables: Index of insertion
too big".< br >
< / li >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< / ul >
2003-03-18 02:13:38 +01:00
All three problems are corrected by < a
2003-02-21 23:22:52 +01:00
href="http://www.shorewall.net/pub/shorewall/errata/1.3.13/firewall">this
2003-03-18 02:13:38 +01:00
firewall script< / a > which may be installed in /usr/lib/shorewall as described
above.< br >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< ul >
2003-03-23 19:47:54 +01:00
< li > VLAN interface names of the form "eth< i > n< / i > .< i > m< / i > " (e.g.,
eth0.1) are not supported in this version or in 1.3.12. If you need such
2003-03-18 02:13:38 +01:00
support, post on the users list and I can provide you with a patched version.< br >
< / li >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< / ul >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< h3 > Version 1.3.12< / h3 >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< ul >
2003-03-23 19:47:54 +01:00
< li > If RFC_1918_LOG_LEVEL is set to anything but ULOG, the effect
2003-03-18 02:13:38 +01:00
is the same as if RFC_1918_LOG_LEVEL=info had been specified. The problem
is corrected by < a
2003-02-21 23:22:52 +01:00
href="http://www.shorewall.net/pub/shorewall/errata/1.3.12/firewall">this
2003-03-18 02:13:38 +01:00
firewall script< / a > which may be installed in /usr/lib/shorewall as described
above.< / li >
2003-03-23 19:47:54 +01:00
< li > VLAN interface names of the form "eth< i > n< / i > .< i > m< / i > " (e.g.,
eth0.1) are not supported in this version or in 1.3.13. If you need such
2003-03-18 02:13:38 +01:00
support, post on the users list and I can provide you with a patched version.< br >
< / li >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< / ul >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< h3 > Version 1.3.12 LRP< / h3 >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< ul >
2003-03-18 02:13:38 +01:00
< li > The .lrp was missing the /etc/shorewall/routestopped file
-- a new lrp (shorwall-1.3.12a.lrp) has been released which corrects
this problem.< br >
< / li >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< / ul >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< h3 > Version 1.3.11a< / h3 >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< ul >
2003-03-18 02:13:38 +01:00
< li > < a
2003-02-21 23:22:52 +01:00
href="http://www.shorewall.net/pub/shorewall/errata/1.3.11/rfc1918">This
2003-03-18 02:13:38 +01:00
copy of /etc/shorewall/rfc1918< / a > reflects the recent allocation of
2003-02-21 23:22:52 +01:00
82.0.0.0/8.< br >
2003-03-18 02:13:38 +01:00
< / li >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< / ul >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< h3 > Version 1.3.11< / h3 >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< ul >
2003-03-18 02:13:38 +01:00
< li > When installing/upgrading using the .rpm, you may receive
the following warnings:< br >
< br >
<20> <> <EFBFBD> <EFBFBD> user teastep does not exist - using root< br >
<20> <> <EFBFBD> <EFBFBD> group teastep does not exist - using root< br >
< br >
These warnings are harmless and may be ignored. Users downloading
the .rpm from shorewall.net or mirrors should no longer see these warnings
as the .rpm you will get from there has been corrected.< / li >
2003-03-23 19:47:54 +01:00
< li > DNAT rules that exclude a source subzone (SOURCE column
contains ! followed by a sub-zone list) result in an error message and
2003-03-18 02:13:38 +01:00
Shorewall fails to start.< br >
< br >
Install < a
2003-02-21 23:22:52 +01:00
href="http://www.shorewall.net/pub/shorewall/errata/1.3.11/firewall">this
2003-03-18 02:13:38 +01:00
corrected script< / a > in /usr/lib/shorewall/firewall to correct this
2003-02-21 23:22:52 +01:00
problem. Thanks go to Roger Aich who analyzed this problem and provided
a fix.< br >
2003-03-18 02:13:38 +01:00
< br >
This problem is corrected in version 1.3.11a.< br >
< / li >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< / ul >
2003-03-23 19:47:54 +01:00
2003-03-18 02:13:38 +01:00
< h3 > Version 1.3.10< / h3 >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< ul >
2003-03-23 19:47:54 +01:00
< li > If you experience problems connecting to a PPTP server
2003-03-18 02:13:38 +01:00
running on your firewall and you have a 'pptpserver' entry in /etc/shorewall/tunnels,
< a
2003-02-21 23:22:52 +01:00
href="http://www.shorewall.net/pub/shorewall/errata/1.3.10/firewall">this
2003-03-18 02:13:38 +01:00
version of the firewall script< / a > may help. Please report any cases
where installing this script in /usr/lib/shorewall/firewall solved
your connection problems. Beginning with version 1.3.10, it is safe
to save the old version of /usr/lib/shorewall/firewall before copying
in the new one since /usr/lib/shorewall/firewall is the real script
now and not just a symbolic link to the real script.< br >
< / li >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< / ul >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< h3 > Version 1.3.9a< / h3 >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< ul >
2003-03-23 19:47:54 +01:00
< li > If entries are used in /etc/shorewall/hosts and MERGE_HOSTS=No
2003-03-18 02:13:38 +01:00
then the following message appears during "shorewall [re]start":< / li >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< / ul >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< pre > recalculate_interfacess: command not found< br > < / pre >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< blockquote > The updated firewall script at < a
href="ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall"
2003-03-23 19:47:54 +01:00
target="_top">ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall< / a >
corrects this problem.Copy the script to /usr/lib/shorewall/firewall
2003-03-18 02:13:38 +01:00
as described above.< br >
< / blockquote >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< blockquote > Alternatively, edit /usr/lob/shorewall/firewall and change the
2003-03-18 02:13:38 +01:00
single occurence (line 483 in version 1.3.9a) of 'recalculate_interefacess'
to 'recalculate_interface'. < br >
< / blockquote >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< ul >
2003-03-18 02:13:38 +01:00
< li > The installer (install.sh) issues a misleading message
"Common functions installed in /var/lib/shorewall/functions" whereas
the file is installed in /usr/lib/shorewall/functions. The installer
also performs incorrectly when updating old configurations that had the
file /etc/shorewall/functions. < a
2003-02-21 23:22:52 +01:00
href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.3.9/install.sh">Here
2003-03-18 02:13:38 +01:00
is an updated version that corrects these problems.< br >
< / a > < / li >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< / ul >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< h3 > Version 1.3.9< / h3 >
2003-03-18 02:13:38 +01:00
< b > TUNNELS Broken in 1.3.9!!! < / b > There is an updated
firewall script at < a
2003-02-21 23:22:52 +01:00
href="ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall"
2003-03-23 19:47:54 +01:00
target="_top">ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall< / a >
2003-03-18 02:13:38 +01:00
-- copy that file to /usr/lib/shorewall/firewall as described above.< br >
< br >
2003-03-23 19:47:54 +01:00
Version 1.3.8
2003-02-21 23:22:52 +01:00
< ul >
2003-03-23 19:47:54 +01:00
< li > Use of shell variables in the LOG LEVEL or SYNPARMS
2003-03-18 02:13:38 +01:00
columns of the policy file doesn't work.< / li >
< li > A DNAT rule with the same original and new IP
addresses but with different port numbers doesn't work (e.g., "DNAT
loc dmz:10.1.1.1:24 tcp 25 - 10.1.1.1")< br >
< / li >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< / ul >
2003-03-18 02:13:38 +01:00
Installing < a
2003-03-23 19:47:54 +01:00
href="http://www.shorewall.net/pub/shorewall/errata/1.3.8/firewall">
2003-02-21 23:22:52 +01:00
this corrected firewall script< / a > in /var/lib/shorewall/firewall
2003-03-18 02:13:38 +01:00
as described above corrects these
2003-03-23 19:47:54 +01:00
problems.
2003-02-21 23:22:52 +01:00
< h3 > Version 1.3.7b< / h3 >
2003-03-23 19:47:54 +01:00
< p > DNAT rules where the source zone is 'fw' ($FW)
result in an error message. Installing
2003-02-21 23:22:52 +01:00
< a
2003-03-23 19:47:54 +01:00
href="http://www.shorewall.net/pub/shorewall/errata/1.3.7/firewall">
2003-02-21 23:22:52 +01:00
this corrected firewall script< / a > in /var/lib/shorewall/firewall
2003-03-18 02:13:38 +01:00
as described above corrects this
problem.< / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< h3 > Version 1.3.7a< / h3 >
2003-03-23 19:47:54 +01:00
< p > "shorewall refresh" is not creating the proper
rule for FORWARDPING=Yes. Consequently, after
"shorewall refresh", the firewall will not forward
icmp echo-request (ping) packets. Installing
2003-02-21 23:22:52 +01:00
< a
2003-03-23 19:47:54 +01:00
href="http://www.shorewall.net/pub/shorewall/errata/1.3.7/firewall">
2003-02-21 23:22:52 +01:00
this corrected firewall script< / a > in /var/lib/shorewall/firewall
2003-03-18 02:13:38 +01:00
as described above corrects this
problem.< / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< h3 > Version < = 1.3.7a< / h3 >
2003-03-23 19:47:54 +01:00
< p > If "norfc1918" and "dhcp" are both specified as
options on a given interface then RFC 1918
checking is occurring before DHCP checking. This
means that if a DHCP client broadcasts using an
RFC 1918 source address, then the firewall will
2003-02-21 23:22:52 +01:00
reject the broadcast (usually logging it). This
2003-03-18 02:13:38 +01:00
has two problems:< / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< ol >
2003-03-18 02:13:38 +01:00
< li > If the firewall
is running a DHCP server, the
2003-03-23 19:47:54 +01:00
client won't be able to obtain an IP address
2003-03-18 02:13:38 +01:00
lease from that server.< / li >
< li > With this order
of checking, the "dhcp" option
2003-03-23 19:47:54 +01:00
cannot be used as a noise-reduction
measure where there are both dynamic and static
2003-02-21 23:22:52 +01:00
clients on a LAN segment.< / li >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< / ol >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< p > < a
2003-03-23 19:47:54 +01:00
href="http://www.shorewall.net/pub/shorewall/errata/1.3.7/firewall">
This version of the 1.3.7a firewall script < / a >
corrects the problem. It must be
installed in /var/lib/shorewall as
2003-03-18 02:13:38 +01:00
described above.< / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< h3 > Version 1.3.7< / h3 >
2003-03-23 19:47:54 +01:00
< p > Version 1.3.7 dead on arrival -- please use
version 1.3.7a and check your version against
these md5sums -- if there's a difference, please
2003-02-21 23:22:52 +01:00
download again.< / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< pre > d2fffb7fb99bcc6cb047ea34db1df10 shorewall-1.3.7a.tgz< br > 6a7fd284c8685b2b471a2f47b469fb94 shorewall-1.3.7a-1.noarch.rpm< br > 3decd14296effcff16853106771f7035 shorwall-1.3.7a.lrp< / pre >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< p > In other words, type "md5sum < < i > whatever package you downloaded< / i > >
2003-03-18 02:13:38 +01:00
and compare the result with what you see above.< / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< p > I'm embarrassed to report that 1.2.7 was also DOA -- maybe I'll skip the
2003-03-18 02:13:38 +01:00
.7 version in each sequence from now on.< / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< h3 align = "left" > Version 1.3.6< / h3 >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< ul >
2003-03-23 19:47:54 +01:00
< li >
2003-02-21 23:22:52 +01:00
< p align = "left" > If ADD_SNAT_ALIASES=Yes is specified in /etc/shorewall/shorewall.conf,
2003-03-18 02:13:38 +01:00
an error occurs when the firewall script attempts to
add an SNAT alias. < / p >
< / li >
2003-03-23 19:47:54 +01:00
< li >
2003-02-21 23:22:52 +01:00
< p align = "left" > The < b > logunclean < / b > and < b > dropunclean< / b > options
cause errors during startup when Shorewall is run with iptables
2003-03-18 02:13:38 +01:00
1.2.7. < / p >
< / li >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< / ul >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< p align = "left" > These problems are fixed in < a
2003-03-23 19:47:54 +01:00
href="http://www.shorewall.net/pub/shorewall/errata/1.3.6/firewall">
this correct firewall script< / a > which must be installed in
/var/lib/shorewall/ as described above. These problems are also
2003-02-21 23:22:52 +01:00
corrected in version 1.3.7.< / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< h3 align = "left" > Two-interface Samples 1.3.6 (file two-interfaces.tgz)< / h3 >
2003-03-23 19:47:54 +01:00
< p align = "left" > A line was inadvertently deleted from the "interfaces
2003-02-21 23:22:52 +01:00
file" -- this line should be added back in if the version that you
2003-03-18 02:13:38 +01:00
downloaded is missing it:< / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< p align = "left" > net<EFBFBD> <EFBFBD> <EFBFBD> eth0<68> <30> <EFBFBD> detect<63> <74> <EFBFBD> routefilter,dhcp,norfc1918< / p >
2003-03-23 19:47:54 +01:00
< p align = "left" > If you downloaded two-interfaces-a.tgz then the above
2003-02-21 23:22:52 +01:00
line should already be in the file.< / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< h3 align = "left" > Version 1.3.5-1.3.5b< / h3 >
2003-03-23 19:47:54 +01:00
< p align = "left" > The new 'proxyarp' interface option doesn't work :-(
2003-02-21 23:22:52 +01:00
This is fixed in < a
2003-03-23 19:47:54 +01:00
href="http://www.shorewall.net/pub/shorewall/errata/1.3.5/firewall">
this corrected firewall script< / a > which must be installed in
2003-02-21 23:22:52 +01:00
/var/lib/shorewall/ as described above.< / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< h3 align = "left" > Versions 1.3.4-1.3.5a< / h3 >
2003-03-23 19:47:54 +01:00
< p align = "left" > Prior to version 1.3.4, host file entries such as the
2003-02-21 23:22:52 +01:00
following were allowed:< / p >
2003-03-23 19:47:54 +01:00
< div align = "left" >
2003-02-21 23:22:52 +01:00
< pre > adm eth0:1.2.4.5,eth0:5.6.7.8< / pre >
2003-03-18 02:13:38 +01:00
< / div >
2003-03-23 19:47:54 +01:00
< div align = "left" >
2003-02-21 23:22:52 +01:00
< p align = "left" > That capability was lost in version 1.3.4 so that it is only
2003-03-18 02:13:38 +01:00
possible to<74> include a single host specification on each line.
This problem is corrected by < a
2003-02-21 23:22:52 +01:00
href="http://www.shorewall.net/pub/shorewall/errata/1.3.5a/firewall">this
2003-03-18 02:13:38 +01:00
modified 1.3.5a firewall script< / a > . Install the script in
2003-02-21 23:22:52 +01:00
/var/lib/pub/shorewall/firewall as instructed above.< / p >
2003-03-18 02:13:38 +01:00
< / div >
2003-03-23 19:47:54 +01:00
< div align = "left" >
2003-02-21 23:22:52 +01:00
< p align = "left" > This problem is corrected in version 1.3.5b.< / p >
2003-03-18 02:13:38 +01:00
< / div >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< h3 align = "left" > Version 1.3.5< / h3 >
2003-03-23 19:47:54 +01:00
< p align = "left" > REDIRECT rules are broken in this version. Install
2003-02-21 23:22:52 +01:00
< a
2003-03-23 19:47:54 +01:00
href="http://www.shorewall.net/pub/shorewall/errata/1.3.5/firewall">
2003-02-21 23:22:52 +01:00
this corrected firewall script< / a > in /var/lib/pub/shorewall/firewall
2003-03-18 02:13:38 +01:00
as instructed above. This problem is corrected in version
1.3.5a.< / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< h3 align = "left" > Version 1.3.n, n < 4< / h3 >
2003-03-23 19:47:54 +01:00
< p align = "left" > The "shorewall start" and "shorewall restart" commands
2003-02-21 23:22:52 +01:00
to not verify that the zones named in the /etc/shorewall/policy
file have been previously defined in the /etc/shorewall/zones
file. The "shorewall check" command does perform this verification
so it's a good idea to run that command after you have made configuration
2003-03-18 02:13:38 +01:00
changes.< / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< h3 align = "left" > Version 1.3.n, n < 3< / h3 >
2003-03-23 19:47:54 +01:00
< p align = "left" > If you have upgraded from Shorewall 1.2 and after
2003-02-21 23:22:52 +01:00
"Activating rules..." you see the message: "iptables: No chains/target/match
2003-03-18 02:13:38 +01:00
by that name" then you probably have an entry in /etc/shorewall/hosts
that specifies an interface that you didn't include
2003-03-23 19:47:54 +01:00
in /etc/shorewall/interfaces. To correct this problem, you
2003-02-21 23:22:52 +01:00
must add an entry to /etc/shorewall/interfaces. Shorewall 1.3.3
2003-03-18 02:13:38 +01:00
and later versions produce a clearer error message in
this case.< / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< h3 align = "left" > Version 1.3.2< / h3 >
2003-03-23 19:47:54 +01:00
< p align = "left" > Until approximately 2130 GMT on 17 June 2002, the
2003-02-21 23:22:52 +01:00
download sites contained an incorrect version of the .lrp file. That
file can be identified by its size (56284 bytes). The correct
version has a size of 38126 bytes.< / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< ul >
2003-03-23 19:47:54 +01:00
< li > The code to detect a duplicate interface
entry in /etc/shorewall/interfaces contained a typo that
2003-03-18 02:13:38 +01:00
prevented it from working correctly. < / li >
< li > "NAT_BEFORE_RULES=No" was broken;
it behaved just like "NAT_BEFORE_RULES=Yes".< / li >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< / ul >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< p align = "left" > Both problems are corrected in < a
2003-03-23 19:47:54 +01:00
href="http://www.shorewall.net/pub/shorewall/errata/1.3.2/firewall">
2003-02-21 23:22:52 +01:00
this script< / a > which should be installed in < b > < u > /var/lib/shorewall< / u > < / b >
2003-03-18 02:13:38 +01:00
as described above.< / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< ul >
2003-03-23 19:47:54 +01:00
< li >
2003-02-21 23:22:52 +01:00
< p align = "left" > The IANA have just announced the allocation of subnet
2003-03-18 02:13:38 +01:00
221.0.0.0/8. This < a
2003-03-23 19:47:54 +01:00
href="http://www.shorewall.net/pub/shorewall/errata/1.3.2/rfc1918">
2003-02-21 23:22:52 +01:00
updated rfc1918< / a > file reflects that allocation.< / p >
2003-03-18 02:13:38 +01:00
< / li >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< / ul >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< h3 align = "left" > Version 1.3.1< / h3 >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< ul >
2003-03-18 02:13:38 +01:00
< li > TCP SYN packets may be double counted
when LIMIT:BURST is included in a CONTINUE or ACCEPT policy
(i.e., each packet is sent through the limit chain twice).< / li >
< li > An unnecessary jump to the policy
chain is sometimes generated for a CONTINUE policy.< / li >
< li > When an option is given for more than
one interface in /etc/shorewall/interfaces then depending
on the option, Shorewall may ignore all but the first
appearence of the option. For example:< br >
< br >
net<65> <74> <EFBFBD> eth0<68> <30> <EFBFBD> dhcp< br >
loc<6F> <63> <EFBFBD> eth1<68> <31> <EFBFBD> dhcp< br >
< br >
Shorewall will ignore the 'dhcp' on eth1.< / li >
< li > Update 17 June 2002 - The bug described
in the prior bullet affects the following options:
2003-02-21 23:22:52 +01:00
dhcp, dropunclean, logunclean, norfc1918, routefilter,
multi, filterping and noping. An additional bug has been
found that affects only the 'routestopped' option.< br >
2003-03-18 02:13:38 +01:00
< br >
Users who downloaded the corrected script
prior to 1850 GMT today should download and install
the corrected script again to ensure that this second
problem is corrected.< / li >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< / ul >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< p align = "left" > These problems are corrected in < a
2003-03-23 19:47:54 +01:00
href="http://www.shorewall.net/pub/shorewall/errata/1.3.1/firewall">
2003-02-21 23:22:52 +01:00
this firewall script< / a > which should be installed in /etc/shorewall/firewall
2003-03-18 02:13:38 +01:00
as described above.< / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< h3 align = "left" > Version 1.3.0< / h3 >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< ul >
2003-03-18 02:13:38 +01:00
< li > Folks who downloaded 1.3.0 from the
links on the download page before 23:40 GMT, 29 May
2002 may have downloaded 1.2.13 rather than 1.3.0.
2003-03-23 19:47:54 +01:00
The "shorewall version" command will tell you which version
2003-02-21 23:22:52 +01:00
that you have installed.< / li >
2003-03-18 02:13:38 +01:00
< li > The documentation NAT.htm file uses
2003-03-23 19:47:54 +01:00
non-existent wallpaper and bullet graphic files. The
2003-03-18 02:13:38 +01:00
< a
2003-03-23 19:47:54 +01:00
href="http://www.shorewall.net/pub/shorewall/errata/1.3.0/NAT.htm">
2003-02-21 23:22:52 +01:00
corrected version is here< / a > .< / li >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< / ul >
2003-03-23 19:47:54 +01:00
< hr >
2003-02-21 23:22:52 +01:00
< h2 align = "left" > < a name = "Upgrade" > < / a > Upgrade Issues< / h2 >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< p align = "left" > The upgrade issues have moved to < a
href="upgrade_issues.htm">a separate page< / a > .< / p >
2003-03-23 19:47:54 +01:00
< hr >
2003-02-21 23:22:52 +01:00
< h3 align = "left" > < a name = "iptables" > < / a > < font color = "#660066" > Problem with
2003-03-18 02:13:38 +01:00
iptables version 1.2.3< / font > < / h3 >
2003-03-23 19:47:54 +01:00
< blockquote >
< p align = "left" > There are a couple of serious bugs in iptables 1.2.3 that
2003-03-18 02:13:38 +01:00
prevent it from working with Shorewall. Regrettably, RedHat
released this buggy iptables in RedHat 7.2.<2E> < / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< p align = "left" > I have built a < a
2003-03-23 19:47:54 +01:00
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3-3.i386.rpm">
corrected 1.2.3 rpm which you can download here< / a > <EFBFBD> and I have
2003-03-18 02:13:38 +01:00
also built an < a
2003-03-23 19:47:54 +01:00
href="ftp://ftp.shorewall.net/pub/shorewall/iptables-1.2.4-1.i386.rpm">
2003-02-21 23:22:52 +01:00
iptables-1.2.4 rpm which you can download here< / a > . If you are currently
2003-03-23 19:47:54 +01:00
running RedHat 7.1, you can install either of these RPMs
2003-03-18 02:13:38 +01:00
< b > < u > before< / u > < / b > you upgrade to RedHat 7.2.< / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< p align = "left" > < font color = "#ff6633" > < b > Update 11/9/2001: < / b > < / font > RedHat
2003-03-18 02:13:38 +01:00
has released an iptables-1.2.4 RPM of their own which you can
download from< font color = "#ff6633" > < a
2003-03-23 19:47:54 +01:00
href="http://www.redhat.com/support/errata/RHSA-2001-144.html">http://www.redhat.com/support/errata/RHSA-2001-144.html< / a > .
< / font > I have installed this RPM on my firewall and it works
2003-03-18 02:13:38 +01:00
fine.< / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< p align = "left" > If you would like to patch iptables 1.2.3 yourself,
2003-03-18 02:13:38 +01:00
the patches are available for download. This < a
2003-03-23 19:47:54 +01:00
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/loglevel.patch">patch< / a >
2003-03-18 02:13:38 +01:00
which corrects a problem with parsing of the --log-level specification
while this < a
2003-03-23 19:47:54 +01:00
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/tos.patch">patch< / a >
2003-03-18 02:13:38 +01:00
corrects a problem in handling the<68> TOS target.< / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< p align = "left" > To install one of the above patches:< / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< ul >
2003-03-18 02:13:38 +01:00
< li > cd iptables-1.2.3/extensions< / li >
< li > patch -p0 < < i > the-patch-file< / i > < / li >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< / ul >
2003-03-18 02:13:38 +01:00
< / blockquote >
2003-03-23 19:47:54 +01:00
< h3 > < a name = "Debug" > < / a > Problems with kernels > = 2.4.18
2003-02-21 23:22:52 +01:00
and RedHat iptables< / h3 >
2003-03-23 19:47:54 +01:00
< blockquote >
2003-02-21 23:22:52 +01:00
< p > Users who use RedHat iptables RPMs and who upgrade to kernel 2.4.18/19
2003-03-18 02:13:38 +01:00
may experience the following:< / p >
2003-03-23 19:47:54 +01:00
< blockquote >
2003-02-21 23:22:52 +01:00
< pre > # shorewall start< br > Processing /etc/shorewall/shorewall.conf ...< br > Processing /etc/shorewall/params ...< br > Starting Shorewall...< br > Loading Modules...< br > Initializing...< br > Determining Zones...< br > Zones: net< br > Validating interfaces file...< br > Validating hosts file...< br > Determining Hosts in Zones...< br > Net Zone: eth0:0.0.0.0/0< br > iptables: libiptc/libip4tc.c:380: do_check: Assertion< br > `h-> info.valid_hooks == (1 < < 0 | 1 < < 3)' failed.< br > Aborted (core dumped)< br > iptables: libiptc/libip4tc.c:380: do_check: Assertion< br > `h-> info.valid_hooks == (1 < < 0 | 1 < < 3)' failed.< br > Aborted (core dumped)< br > < / pre >
2003-03-18 02:13:38 +01:00
< / blockquote >
2003-03-23 19:47:54 +01:00
< p > The RedHat iptables RPM is compiled with debugging enabled but the
2003-02-21 23:22:52 +01:00
user-space debugging code was not updated to reflect recent changes in
2003-03-18 02:13:38 +01:00
the Netfilter 'mangle' table. You can correct the problem
by installing < a
2003-03-23 19:47:54 +01:00
href="http://www.shorewall.net/pub/shorewall/iptables-1.2.5-1.i386.rpm">
this iptables RPM< / a > . If you are already running a 1.2.5 version
of iptables, you will need to specify the --oldpackage option
2003-03-18 02:13:38 +01:00
to rpm (e.g., "iptables -Uvh --oldpackage iptables-1.2.5-1.i386.rpm").< / p >
< / blockquote >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< h3 > < a name = "SuSE" > < / a > Problems installing/upgrading
2003-03-18 02:13:38 +01:00
RPM on SuSE< / h3 >
2003-03-23 19:47:54 +01:00
< p > If you find that rpm complains about a conflict
with kernel < = 2.2 yet you have a 2.4 kernel
installed, simply use the "--nodeps" option to
2003-02-21 23:22:52 +01:00
rpm.< / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< p > Installing: rpm -ivh --nodeps < i > < shorewall rpm> < / i > < / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< p > Upgrading: rpm -Uvh --nodeps < i > < shorewall rpm> < / i > < / p >
2003-03-23 19:47:54 +01:00
< h3 > < a name = "Multiport" > < / a > < b > Problems with
2003-02-21 23:22:52 +01:00
iptables version 1.2.7 and MULTIPORT=Yes< / b > < / h3 >
2003-03-23 19:47:54 +01:00
< p > The iptables 1.2.7 release of iptables has made
an incompatible change to the syntax used to
specify multiport match rules; as a consequence,
if you install iptables 1.2.7 you must be running
2003-02-21 23:22:52 +01:00
Shorewall 1.3.7a or later or:< / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< ul >
2003-03-23 19:47:54 +01:00
< li > set MULTIPORT=No
2003-03-18 02:13:38 +01:00
in /etc/shorewall/shorewall.conf; or < / li >
2003-03-23 19:47:54 +01:00
< li > if you are running
Shorewall 1.3.6 you may install
2003-03-18 02:13:38 +01:00
< a
2003-03-23 19:47:54 +01:00
href="http://www.shorewall.net/pub/shorewall/errata/1.3.6/firewall">
2003-02-21 23:22:52 +01:00
this firewall script< / a > in /var/lib/shorewall/firewall
2003-03-18 02:13:38 +01:00
as described above.< / li >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< / ul >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< h3 > < a name = "NAT" > < / a > Problems with RH Kernel 2.4.18-10 and NAT< br >
2003-03-18 02:13:38 +01:00
< / h3 >
/etc/shorewall/nat entries of the following form will result
in Shorewall being unable to start:< br >
< br >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< pre > #EXTERNAL<41> <4C> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> INTERFACE<43> <45> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> INTERNAL<41> <4C> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> ALL INTERFACES<45> <53> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> LOCAL< br > 192.0.2.22<EFBFBD> <EFBFBD> <EFBFBD> eth0<68> <30> <EFBFBD> 192.168.9.22<EFBFBD> <EFBFBD> yes<65> <73> <EFBFBD> <EFBFBD> yes< br > #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE< / pre >
2003-03-18 02:13:38 +01:00
Error message is:< br >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< pre > Setting up NAT...< br > iptables: Invalid argument< br > Terminated< br > < br > < / pre >
2003-03-23 19:47:54 +01:00
The solution is to put "no" in the LOCAL column. Kernel
support for LOCAL=yes has never worked properly and 2.4.18-10 has
disabled it. The 2.4.19 kernel contains corrected support under a new
2003-03-18 02:13:38 +01:00
kernel configuraiton option; see < a href = "Documentation.htm#NAT" > http://www.shorewall.net/Documentation.htm#NAT< / a > < br >
2003-03-23 19:47:54 +01:00
< p > < font size = "2" > Last updated 3/8/2003 -
2003-03-18 02:13:38 +01:00
< a href = "support.htm" > Tom Eastep< / a > < / font > < / p >
2003-03-23 19:47:54 +01:00
2003-02-21 23:22:52 +01:00
< p > < a href = "copyright.htm" > < font size = "2" > Copyright< / font > <20> < font
size="2">2001, 2002, 2003 Thomas M. Eastep.< / font > < / a > < br >
2003-03-18 02:13:38 +01:00
< / p >
< br >
< br >
2003-02-21 23:22:52 +01:00
< br >
< br >
< br >
< br >
< br >
< br >
< br >
< br >
< br >
< br >
< br >
< / body >
< / html >
