mirror of
https://gitlab.com/shorewall/code.git
synced 2024-11-22 23:53:30 +01:00
Shorewall 1.4.4b
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@576 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
parent
df6a59cf68
commit
1905dd9d1c
@ -926,7 +926,7 @@ log_rule() # $1 = log level, $2 = chain, $3 = disposition , $... = predicates fo
|
||||
eval iptables -A $chain $@ -j ULOG $LOGPARMS --ulog-prefix '"`printf "$LOGFORMAT" $chain $rulenum $disposition`"'
|
||||
;;
|
||||
*)
|
||||
eval iptables -A $chain $@ -j LOG $LOGPARMS --log-prefix '"`printf "$LOGFORMAT" $chain $rulenum $disposition`"'
|
||||
eval iptables -A $chain $@ -j LOG $LOGPARMS --log-level $level --log-prefix '"`printf "$LOGFORMAT" $chain $rulenum $disposition`"'
|
||||
;;
|
||||
esac
|
||||
|
||||
@ -943,7 +943,7 @@ log_rule() # $1 = log level, $2 = chain, $3 = disposition , $... = predicates fo
|
||||
eval iptables -A $chain $@ -j ULOG $LOGPARMS --ulog-prefix '"`printf "$LOGFORMAT" $chain $disposition`"'
|
||||
;;
|
||||
*)
|
||||
eval iptables -A $chain $@ -j LOG $LOGPARMS --log-prefix '"`printf "$LOGFORMAT" $chain $disposition`"'
|
||||
eval iptables -A $chain $@ -j LOG $LOGPARMS --log-level $level --log-prefix '"`printf "$LOGFORMAT" $chain $disposition`"'
|
||||
;;
|
||||
esac
|
||||
|
||||
|
@ -1 +1 @@
|
||||
1.4.4a
|
||||
1.4.4b
|
||||
|
@ -10,4 +10,6 @@ Changes since 1.4.3a
|
||||
|
||||
4. Don't include log rule number when LOGFORMAT doesn't include "%d".
|
||||
|
||||
5. Add --log-level to LOG rules.
|
||||
|
||||
|
||||
|
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@ -1,298 +1,313 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shorewall 1.4 Errata</title>
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
|
||||
|
||||
<meta name="Microsoft Theme" content="none">
|
||||
|
||||
|
||||
<meta name="author" content="Tom Eastep">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Shorewall Errata/Upgrade Issues</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<p align="center"> <b><u>IMPORTANT</u></b></p>
|
||||
|
||||
|
||||
<ol>
|
||||
<li>
|
||||
<p align="left"> <b><u>I</u>f you use a Windows system to download
|
||||
a corrected script, be sure to run the script through <u>
|
||||
<li>
|
||||
<p align="left"> <b><u>I</u>f you use a Windows system to download
|
||||
a corrected script, be sure to run the script through <u>
|
||||
<a href="http://www.megaloman.com/%7Ehany/software/hd2u/"
|
||||
style="text-decoration: none;"> dos2unix</a></u> after you have moved
|
||||
style="text-decoration: none;"> dos2unix</a></u> after you have moved
|
||||
it to your Linux system.</b></p>
|
||||
</li>
|
||||
<li>
|
||||
<p align="left"> <b>If you are installing Shorewall for the first
|
||||
time and plan to use the .tgz and install.sh script, you can untar
|
||||
the archive, replace the 'firewall' script in the untarred directory
|
||||
</li>
|
||||
<li>
|
||||
<p align="left"> <b>If you are installing Shorewall for the
|
||||
first time and plan to use the .tgz and install.sh script, you can
|
||||
untar the archive, replace the 'firewall' script in the untarred directory
|
||||
with the one you downloaded below, and then run install.sh.</b></p>
|
||||
</li>
|
||||
<li>
|
||||
<p align="left"> <b>When the instructions say to install a corrected
|
||||
firewall script in /usr/share/shorewall/firewall, you
|
||||
</li>
|
||||
<li>
|
||||
<p align="left"> <b>When the instructions say to install a corrected
|
||||
firewall script in /usr/share/shorewall/firewall, you
|
||||
may rename the existing file before copying in the new file.</b></p>
|
||||
</li>
|
||||
<li>
|
||||
<p align="left"><b><font color="#ff0000">DO NOT INSTALL CORRECTED COMPONENTS
|
||||
ON A RELEASE EARLIER THAN THE ONE THAT THEY ARE LISTED UNDER BELOW.
|
||||
For example, do NOT install the 1.3.9a firewall script if you are
|
||||
</li>
|
||||
<li>
|
||||
<p align="left"><b><font color="#ff0000">DO NOT INSTALL CORRECTED COMPONENTS
|
||||
ON A RELEASE EARLIER THAN THE ONE THAT THEY ARE LISTED UNDER BELOW.
|
||||
For example, do NOT install the 1.3.9a firewall script if you are
|
||||
running 1.3.7c.</font></b><br>
|
||||
</p>
|
||||
</li>
|
||||
|
||||
</p>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
|
||||
|
||||
<ul>
|
||||
<li><b><a href="upgrade_issues.htm">Upgrade
|
||||
<li><b><a href="upgrade_issues.htm">Upgrade
|
||||
Issues</a></b></li>
|
||||
<li><b><a href="#V1.4">Problems in Version 1.4</a></b><br>
|
||||
</li>
|
||||
<li> <b><a
|
||||
<li><b><a href="#V1.4">Problems in Version 1.4</a></b><br>
|
||||
</li>
|
||||
<li> <b><a
|
||||
href="errata_3.html">Problems in Version 1.3</a></b></li>
|
||||
<li> <b><a
|
||||
<li> <b><a
|
||||
href="errata_2.htm">Problems in Version 1.2</a></b></li>
|
||||
<li> <b><font
|
||||
<li> <b><font
|
||||
color="#660066"> <a href="errata_1.htm">Problems in Version 1.1</a></font></b></li>
|
||||
<li> <b><font
|
||||
color="#660066"><a href="#iptables"> Problem with iptables version 1.2.3
|
||||
<li> <b><font
|
||||
color="#660066"><a href="#iptables"> Problem with iptables version 1.2.3
|
||||
on RH7.2</a></font></b></li>
|
||||
<li> <b><a
|
||||
href="#Debug">Problems with kernels >= 2.4.18 and RedHat
|
||||
iptables</a></b></li>
|
||||
<li><b><a href="#SuSE">Problems installing/upgrading
|
||||
<li> <b><a
|
||||
href="#Debug">Problems with kernels >= 2.4.18 and
|
||||
RedHat iptables</a></b></li>
|
||||
<li><b><a href="#SuSE">Problems installing/upgrading
|
||||
RPM on SuSE</a></b></li>
|
||||
<li><b><a href="#Multiport">Problems with
|
||||
<li><b><a href="#Multiport">Problems with
|
||||
iptables version 1.2.7 and MULTIPORT=Yes</a></b></li>
|
||||
<li><b><a href="#NAT">Problems with RH Kernel 2.4.18-10
|
||||
<li><b><a href="#NAT">Problems with RH Kernel 2.4.18-10
|
||||
and NAT</a></b><br>
|
||||
</li>
|
||||
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<hr>
|
||||
|
||||
<hr>
|
||||
<h2 align="left"><a name="V1.4"></a>Problems in Version 1.4</h2>
|
||||
|
||||
|
||||
<h3></h3>
|
||||
|
||||
|
||||
<h3>1.4.4-1.4.4a</h3>
|
||||
<ul>
|
||||
<li>Log messages are being displayed on the system console even though
|
||||
the log level for the console is set properly according to <a
|
||||
href="FAQ.htm#faq16">FAQ 16</a>. This problem may be corrected by installing
|
||||
<a
|
||||
href="ftp://ftp1.shorewall.net/pub/shorewall/errata/1.4.4a/firewall"
|
||||
target="_top">this firewall script</a> in /usr/share/shorewall/firewall
|
||||
as described above.<br>
|
||||
</li>
|
||||
</ul>
|
||||
<h3>1.4.4<br>
|
||||
</h3>
|
||||
</h3>
|
||||
|
||||
<ul>
|
||||
<li> If you have zone names that are 5 characters long, you may experience
|
||||
problems starting Shorewall because the --log-prefix in a logging rule is
|
||||
<li> If you have zone names that are 5 characters long, you may experience
|
||||
problems starting Shorewall because the --log-prefix in a logging rule is
|
||||
too long. Upgrade to Version 1.4.4a to fix this problem..</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3>1.4.3</h3>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>The LOGMARKER variable introduced in version 1.4.3 was intended to
|
||||
allow integration of Shorewall with Fireparse (http://www.firewparse.com).
|
||||
Unfortunately, LOGMARKER only solved part of the integration problem. I have
|
||||
implimented a new LOGFORMAT variable which will replace LOGMARKER which has
|
||||
completely solved this problem and is currently in production with fireparse
|
||||
here at shorewall.net. The updated files may be found at <a
|
||||
<li>The LOGMARKER variable introduced in version 1.4.3 was intended to
|
||||
allow integration of Shorewall with Fireparse (http://www.firewparse.com).
|
||||
Unfortunately, LOGMARKER only solved part of the integration problem. I
|
||||
have implimented a new LOGFORMAT variable which will replace LOGMARKER which
|
||||
has completely solved this problem and is currently in production with fireparse
|
||||
here at shorewall.net. The updated files may be found at <a
|
||||
href="ftp://ftp1.shorewall.net/pub/shorewall/errata/1.4.3/fireparse/"
|
||||
target="_top">ftp://ftp1.shorewall.net/pub/shorewall/errata/1.4.3/fireparse/</a>.
|
||||
See the 0README.txt file for details.<br>
|
||||
</li>
|
||||
|
||||
target="_top">ftp://ftp1.shorewall.net/pub/shorewall/errata/1.4.3/fireparse/</a>.
|
||||
See the 0README.txt file for details.<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<h3>1.4.2</h3>
|
||||
|
||||
<ul>
|
||||
<li>When an 'add' or 'delete' command is executed, a temporary directory
|
||||
created in /tmp is not being removed. This problem may be corrected by installing
|
||||
<a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.2/firewall"
|
||||
target="_top">this firewall script</a> in /usr/share/shorewall/firewall as
|
||||
described ablve. <br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3>1.4.1a, 1.4.1 and 1.4.0</h3>
|
||||
|
||||
<ul>
|
||||
<li>Some TCP requests are rejected in the 'common' chain with an ICMP
|
||||
port-unreachable response rather than the more appropriate TCP RST response.
|
||||
This problem is corrected in <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.1a/common.def"
|
||||
target="_top">this updated common.def file</a> which may be installed in
|
||||
/etc/shorewall/common.def.<br>
|
||||
<li>When an 'add' or 'delete' command is executed, a temporary directory
|
||||
created in /tmp is not being removed. This problem may be corrected by
|
||||
installing <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.2/firewall"
|
||||
target="_top">this firewall script</a> in /usr/share/shorewall/firewall
|
||||
as described above. <br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3>1.4.1</h3>
|
||||
<h3>1.4.1a, 1.4.1 and 1.4.0</h3>
|
||||
|
||||
<ul>
|
||||
<li>When a "shorewall check" command is executed, each "rule" produces
|
||||
the harmless additional message:<br>
|
||||
<br>
|
||||
/usr/share/shorewall/firewall: line 2174: [: =: unary operator
|
||||
expected<br>
|
||||
<br>
|
||||
You may correct the problem by installing <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.1/firewall"
|
||||
target="_top">this corrected script</a> in /usr/share/shorewall/firewall
|
||||
as described above.<br>
|
||||
<li>Some TCP requests are rejected in the 'common' chain with an ICMP
|
||||
port-unreachable response rather than the more appropriate TCP RST response.
|
||||
This problem is corrected in <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.1a/common.def"
|
||||
target="_top">this updated common.def file</a> which may be installed in
|
||||
/etc/shorewall/common.def.<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3>1.4.0</h3>
|
||||
<h3>1.4.1</h3>
|
||||
|
||||
<ul>
|
||||
<li>When running under certain shells Shorewall will attempt to create
|
||||
ECN rules even when /etc/shorewall/ecn is empty. You may either just remove
|
||||
/etc/shorewall/ecn or you can install <a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.4.0/firewall">this
|
||||
correct script</a> in /usr/share/shorewall/firewall as described above.<br>
|
||||
<li>When a "shorewall check" command is executed, each "rule" produces
|
||||
the harmless additional message:<br>
|
||||
<br>
|
||||
/usr/share/shorewall/firewall: line 2174: [: =: unary operator
|
||||
expected<br>
|
||||
<br>
|
||||
You may correct the problem by installing <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.1/firewall"
|
||||
target="_top">this corrected script</a> in /usr/share/shorewall/firewall
|
||||
as described above.<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<hr width="100%" size="2">
|
||||
<h2 align="left"><a name="Upgrade"></a>Upgrade Issues</h2>
|
||||
|
||||
<p align="left">The upgrade issues have moved to <a
|
||||
href="upgrade_issues.htm">a separate page</a>.</p>
|
||||
|
||||
<hr>
|
||||
<h3 align="left"><a name="iptables"></a><font color="#660066"> Problem with
|
||||
iptables version 1.2.3</font></h3>
|
||||
|
||||
<blockquote>
|
||||
<p align="left">There are a couple of serious bugs in iptables 1.2.3 that
|
||||
prevent it from working with Shorewall. Regrettably,
|
||||
RedHat released this buggy iptables in RedHat 7.2. </p>
|
||||
|
||||
<p align="left"> I have built a <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3-3.i386.rpm">
|
||||
corrected 1.2.3 rpm which you can download here</a> and I
|
||||
have also built an <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/iptables-1.2.4-1.i386.rpm">
|
||||
iptables-1.2.4 rpm which you can download here</a>. If you are currently
|
||||
running RedHat 7.1, you can install either of these RPMs
|
||||
<b><u>before</u> </b>you upgrade to RedHat 7.2.</p>
|
||||
|
||||
<p align="left"><font color="#ff6633"><b>Update 11/9/2001: </b></font>RedHat
|
||||
has released an iptables-1.2.4 RPM of their own which you
|
||||
can download from<font color="#ff6633"> <a
|
||||
href="http://www.redhat.com/support/errata/RHSA-2001-144.html">http://www.redhat.com/support/errata/RHSA-2001-144.html</a>.
|
||||
</font>I have installed this RPM on my firewall and it
|
||||
works fine.</p>
|
||||
|
||||
<p align="left">If you would like to patch iptables 1.2.3 yourself,
|
||||
the patches are available for download. This <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/loglevel.patch">patch</a>
|
||||
which corrects a problem with parsing of the --log-level
|
||||
specification while this <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/tos.patch">patch</a>
|
||||
corrects a problem in handling the TOS target.</p>
|
||||
|
||||
<p align="left">To install one of the above patches:</p>
|
||||
|
||||
<ul>
|
||||
<li>cd iptables-1.2.3/extensions</li>
|
||||
<li>patch -p0 < <i>the-patch-file</i></li>
|
||||
|
||||
</ul>
|
||||
</blockquote>
|
||||
|
||||
<h3><a name="Debug"></a>Problems with kernels >= 2.4.18 and
|
||||
RedHat iptables</h3>
|
||||
|
||||
<blockquote>
|
||||
<p>Users who use RedHat iptables RPMs and who upgrade to kernel 2.4.18/19
|
||||
may experience the following:</p>
|
||||
|
||||
<blockquote>
|
||||
<pre># shorewall start<br>Processing /etc/shorewall/shorewall.conf ...<br>Processing /etc/shorewall/params ...<br>Starting Shorewall...<br>Loading Modules...<br>Initializing...<br>Determining Zones...<br>Zones: net<br>Validating interfaces file...<br>Validating hosts file...<br>Determining Hosts in Zones...<br>Net Zone: eth0:0.0.0.0/0<br>iptables: libiptc/libip4tc.c:380: do_check: Assertion<br>`h->info.valid_hooks == (1 << 0 | 1 << 3)' failed.<br>Aborted (core dumped)<br>iptables: libiptc/libip4tc.c:380: do_check: Assertion<br>`h->info.valid_hooks == (1 << 0 | 1 << 3)' failed.<br>Aborted (core dumped)<br></pre>
|
||||
</blockquote>
|
||||
|
||||
<p>The RedHat iptables RPM is compiled with debugging enabled but the
|
||||
user-space debugging code was not updated to reflect recent changes in
|
||||
the Netfilter 'mangle' table. You can correct the problem by
|
||||
installing <a
|
||||
href="http://www.shorewall.net/pub/shorewall/iptables-1.2.5-1.i386.rpm">
|
||||
this iptables RPM</a>. If you are already running a 1.2.5
|
||||
version of iptables, you will need to specify the --oldpackage
|
||||
option to rpm (e.g., "iptables -Uvh --oldpackage iptables-1.2.5-1.i386.rpm").</p>
|
||||
</blockquote>
|
||||
|
||||
<h3><a name="SuSE"></a>Problems installing/upgrading
|
||||
RPM on SuSE</h3>
|
||||
|
||||
<p>If you find that rpm complains about a conflict with kernel <=
|
||||
2.2 yet you have a 2.4 kernel installed, simply use the "--nodeps"
|
||||
option to rpm.</p>
|
||||
|
||||
<p>Installing: rpm -ivh --nodeps <i><shorewall rpm></i></p>
|
||||
|
||||
<p>Upgrading: rpm -Uvh --nodeps <i><shorewall rpm></i></p>
|
||||
|
||||
<h3><a name="Multiport"></a><b>Problems with iptables version 1.2.7 and
|
||||
MULTIPORT=Yes</b></h3>
|
||||
|
||||
<p>The iptables 1.2.7 release of iptables has made an incompatible
|
||||
change to the syntax used to specify multiport match rules; as
|
||||
a consequence, if you install iptables 1.2.7 you must
|
||||
be running Shorewall 1.3.7a or later or:</p>
|
||||
<h3>1.4.0</h3>
|
||||
|
||||
<ul>
|
||||
<li>set MULTIPORT=No
|
||||
in /etc/shorewall/shorewall.conf; or
|
||||
</li>
|
||||
<li>if you are
|
||||
running Shorewall 1.3.6 you may
|
||||
install <a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.3.6/firewall">
|
||||
this firewall script</a> in /var/lib/shorewall/firewall
|
||||
as described above.</li>
|
||||
|
||||
<li>When running under certain shells Shorewall will attempt to
|
||||
create ECN rules even when /etc/shorewall/ecn is empty. You may either
|
||||
just remove /etc/shorewall/ecn or you can install <a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.4.0/firewall">this
|
||||
correct script</a> in /usr/share/shorewall/firewall as described above.<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<hr width="100%" size="2">
|
||||
<h2 align="left"><a name="Upgrade"></a>Upgrade Issues</h2>
|
||||
|
||||
<p align="left">The upgrade issues have moved to <a
|
||||
href="upgrade_issues.htm">a separate page</a>.</p>
|
||||
|
||||
<hr>
|
||||
<h3 align="left"><a name="iptables"></a><font color="#660066"> Problem with
|
||||
iptables version 1.2.3</font></h3>
|
||||
|
||||
<blockquote>
|
||||
<p align="left">There are a couple of serious bugs in iptables 1.2.3 that
|
||||
prevent it from working with Shorewall. Regrettably,
|
||||
RedHat released this buggy iptables in RedHat 7.2. </p>
|
||||
|
||||
<p align="left"> I have built a <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3-3.i386.rpm">
|
||||
corrected 1.2.3 rpm which you can download here</a> and I
|
||||
have also built an <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/iptables-1.2.4-1.i386.rpm">
|
||||
iptables-1.2.4 rpm which you can download here</a>. If you are currently
|
||||
running RedHat 7.1, you can install either of these RPMs
|
||||
<b><u>before</u> </b>you upgrade to RedHat 7.2.</p>
|
||||
|
||||
<p align="left"><font color="#ff6633"><b>Update 11/9/2001: </b></font>RedHat
|
||||
has released an iptables-1.2.4 RPM of their own which you can
|
||||
download from<font color="#ff6633"> <a
|
||||
href="http://www.redhat.com/support/errata/RHSA-2001-144.html">http://www.redhat.com/support/errata/RHSA-2001-144.html</a>.
|
||||
</font>I have installed this RPM on my firewall and it works
|
||||
fine.</p>
|
||||
|
||||
<p align="left">If you would like to patch iptables 1.2.3 yourself,
|
||||
the patches are available for download. This <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/loglevel.patch">patch</a>
|
||||
which corrects a problem with parsing of the --log-level
|
||||
specification while this <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/tos.patch">patch</a>
|
||||
corrects a problem in handling the TOS target.</p>
|
||||
|
||||
<p align="left">To install one of the above patches:</p>
|
||||
|
||||
<ul>
|
||||
<li>cd iptables-1.2.3/extensions</li>
|
||||
<li>patch -p0 < <i>the-patch-file</i></li>
|
||||
|
||||
</ul>
|
||||
</blockquote>
|
||||
|
||||
<h3><a name="Debug"></a>Problems with kernels >= 2.4.18
|
||||
and RedHat iptables</h3>
|
||||
|
||||
<blockquote>
|
||||
<p>Users who use RedHat iptables RPMs and who upgrade to kernel 2.4.18/19
|
||||
may experience the following:</p>
|
||||
|
||||
<blockquote>
|
||||
<pre># shorewall start<br>Processing /etc/shorewall/shorewall.conf ...<br>Processing /etc/shorewall/params ...<br>Starting Shorewall...<br>Loading Modules...<br>Initializing...<br>Determining Zones...<br>Zones: net<br>Validating interfaces file...<br>Validating hosts file...<br>Determining Hosts in Zones...<br>Net Zone: eth0:0.0.0.0/0<br>iptables: libiptc/libip4tc.c:380: do_check: Assertion<br>`h->info.valid_hooks == (1 << 0 | 1 << 3)' failed.<br>Aborted (core dumped)<br>iptables: libiptc/libip4tc.c:380: do_check: Assertion<br>`h->info.valid_hooks == (1 << 0 | 1 << 3)' failed.<br>Aborted (core dumped)<br></pre>
|
||||
</blockquote>
|
||||
|
||||
<p>The RedHat iptables RPM is compiled with debugging enabled but the
|
||||
user-space debugging code was not updated to reflect recent changes in
|
||||
the Netfilter 'mangle' table. You can correct the problem by
|
||||
installing <a
|
||||
href="http://www.shorewall.net/pub/shorewall/iptables-1.2.5-1.i386.rpm">
|
||||
this iptables RPM</a>. If you are already running a 1.2.5
|
||||
version of iptables, you will need to specify the --oldpackage
|
||||
option to rpm (e.g., "iptables -Uvh --oldpackage iptables-1.2.5-1.i386.rpm").</p>
|
||||
</blockquote>
|
||||
|
||||
<h3><a name="SuSE"></a>Problems installing/upgrading
|
||||
RPM on SuSE</h3>
|
||||
|
||||
<p>If you find that rpm complains about a conflict with kernel <=
|
||||
2.2 yet you have a 2.4 kernel installed, simply use the
|
||||
"--nodeps" option to rpm.</p>
|
||||
|
||||
<p>Installing: rpm -ivh --nodeps <i><shorewall rpm></i></p>
|
||||
|
||||
<p>Upgrading: rpm -Uvh --nodeps <i><shorewall rpm></i></p>
|
||||
|
||||
<h3><a name="Multiport"></a><b>Problems with iptables version 1.2.7 and
|
||||
MULTIPORT=Yes</b></h3>
|
||||
|
||||
<p>The iptables 1.2.7 release of iptables has made an incompatible
|
||||
change to the syntax used to specify multiport match rules;
|
||||
as a consequence, if you install iptables 1.2.7 you must
|
||||
be running Shorewall 1.3.7a or later or:</p>
|
||||
|
||||
<ul>
|
||||
<li>set MULTIPORT=No
|
||||
in /etc/shorewall/shorewall.conf; or
|
||||
</li>
|
||||
<li>if you are
|
||||
running Shorewall 1.3.6 you may
|
||||
install <a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.3.6/firewall">
|
||||
this firewall script</a> in /var/lib/shorewall/firewall
|
||||
as described above.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3><a name="NAT"></a>Problems with RH Kernel 2.4.18-10 and NAT<br>
|
||||
</h3>
|
||||
/etc/shorewall/nat entries of the following form will
|
||||
result in Shorewall being unable to start:<br>
|
||||
<br>
|
||||
|
||||
</h3>
|
||||
/etc/shorewall/nat entries of the following form
|
||||
will result in Shorewall being unable to start:<br>
|
||||
<br>
|
||||
|
||||
<pre>#EXTERNAL INTERFACE INTERNAL ALL INTERFACES LOCAL<br>192.0.2.22 eth0 192.168.9.22 yes yes<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
||||
Error message is:<br>
|
||||
|
||||
Error message is:<br>
|
||||
|
||||
<pre>Setting up NAT...<br>iptables: Invalid argument<br>Terminated<br><br></pre>
|
||||
The solution is to put "no" in the LOCAL column. Kernel
|
||||
support for LOCAL=yes has never worked properly and 2.4.18-10
|
||||
has disabled it. The 2.4.19 kernel contains corrected support under
|
||||
The solution is to put "no" in the LOCAL column.
|
||||
Kernel support for LOCAL=yes has never worked properly and 2.4.18-10
|
||||
has disabled it. The 2.4.19 kernel contains corrected support under
|
||||
a new kernel configuraiton option; see <a
|
||||
href="Documentation.htm#NAT">http://www.shorewall.net/Documentation.htm#NAT</a><br>
|
||||
|
||||
<p><font size="2"> Last updated 5/27/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
</p>
|
||||
|
||||
|
||||
<p><font size="2"> Last updated 5/29/2003 - <a href="support.htm">Tom
|
||||
Eastep</a></font> </p>
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
||||
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||
</p>
|
||||
</p>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
@ -1,140 +1,144 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
<title>Shorewall Mailing Lists</title>
|
||||
|
||||
|
||||
<meta name="Microsoft Theme" content="none">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table height="90" bgcolor="#400169" id="AutoNumber1" width="100%"
|
||||
style="border-collapse: collapse;" cellspacing="0" cellpadding="0"
|
||||
border="0">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="33%" valign="middle"
|
||||
align="left">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="33%" valign="middle"
|
||||
align="left">
|
||||
<h1 align="center"><a
|
||||
href="http://www.centralcommand.com/linux_products.html"><img
|
||||
src="images/Vexira_Antivirus_Logo.gif" alt="Vexira Logo" width="78"
|
||||
height="79" align="left">
|
||||
</a></h1>
|
||||
<a
|
||||
</a></h1>
|
||||
<a
|
||||
href="http://www.gnu.org/software/mailman/mailman.html"> <img
|
||||
border="0" src="images/logo-sm.jpg" align="left" hspace="5" width="110"
|
||||
height="35" alt="">
|
||||
</a>
|
||||
</a>
|
||||
|
||||
<p align="right"><font color="#ffffff"><b> </b></font> </p>
|
||||
</td>
|
||||
<td valign="middle" width="34%" align="center">
|
||||
|
||||
</td>
|
||||
<td valign="middle" width="34%" align="center">
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Shorewall Mailing Lists</font></h1>
|
||||
</td>
|
||||
<td valign="middle" width="33%"> <a
|
||||
href="http://www.postfix.org/"> <img
|
||||
</td>
|
||||
<td valign="middle" width="33%">
|
||||
<a href="http://www.postfix.org/"> <img
|
||||
src="images/postfix-white.gif" align="right" border="0" width="124"
|
||||
height="66" alt="(Postfix Logo)">
|
||||
</a><br>
|
||||
|
||||
</a><br>
|
||||
|
||||
<div align="left"><a href="http://www.spamassassin.org"><img
|
||||
src="images/ninjalogo.png" alt="" width="110" height="42" align="right"
|
||||
border="0">
|
||||
</a> </div>
|
||||
<br>
|
||||
|
||||
</a> </div>
|
||||
<br>
|
||||
|
||||
<div align="right"><br>
|
||||
<b><font color="#ffffff"><br>
|
||||
</font></b><br>
|
||||
</div>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
<b><font color="#ffffff"><br>
|
||||
</font></b><br>
|
||||
</div>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<h1>REPORTING A PROBLEM OR ASKING FOR HELP? If you haven't already, please
|
||||
read the <a href="http://www.shorewall.net/support.htm">Shorewall Support
|
||||
Guide</a>.<br>
|
||||
</h1>
|
||||
|
||||
<h1>REPORTING A PROBLEM OR ASKING FOR HELP? If you haven't already, please
|
||||
read the <a href="http://www.shorewall.net/support.htm">Shorewall Support
|
||||
Guide</a>.<br>
|
||||
</h1>
|
||||
|
||||
<p align="left">If you experience problems with any of these lists, please
|
||||
let <a href="mailto:postmaster@shorewall.net">me</a> know</p>
|
||||
|
||||
<p align="left">If you experience problems with any of these lists, please
|
||||
let <a href="mailto:postmaster@shorewall.net">me</a> know</p>
|
||||
|
||||
<h2 align="left">Not able to Post Mail to shorewall.net?</h2>
|
||||
|
||||
<p align="left">You can report such problems by sending mail to tmeastep
|
||||
at hotmail dot com.</p>
|
||||
|
||||
|
||||
<p align="left">You can report such problems by sending mail to tmeastep at
|
||||
hotmail dot com.</p>
|
||||
|
||||
<h2>A Word about the SPAM Filters at Shorewall.net <a
|
||||
href="http://osirusoft.com/"> </a></h2>
|
||||
|
||||
<p>Please note that the mail server at shorewall.net
|
||||
checks incoming mail:<br>
|
||||
</p>
|
||||
|
||||
|
||||
<p>Please note that the mail server at shorewall.net checks
|
||||
incoming mail:<br>
|
||||
</p>
|
||||
|
||||
<ol>
|
||||
<li>against <a href="http://spamassassin.org">Spamassassin</a>
|
||||
(including <a href="http://razor.sourceforge.net/">Vipul's Razor</a>).<br>
|
||||
</li>
|
||||
<li>to ensure that the sender address is fully qualified.</li>
|
||||
<li>to verify that the sender's domain has an A
|
||||
<li>against <a href="http://spamassassin.org">Spamassassin</a>
|
||||
(including <a href="http://razor.sourceforge.net/">Vipul's Razor</a>).<br>
|
||||
</li>
|
||||
<li>to ensure that the sender address is fully
|
||||
qualified.</li>
|
||||
<li>to verify that the sender's domain has an A
|
||||
or MX record in DNS.</li>
|
||||
<li>to ensure that the host name in the HELO/EHLO
|
||||
<li>to ensure that the host name in the HELO/EHLO
|
||||
command is a valid fully-qualified DNS name that resolves.</li>
|
||||
|
||||
<li>to ensure that the client system has a valid PTR record in DNS.<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
|
||||
|
||||
<h2>Please post in plain text</h2>
|
||||
A growing number of MTAs serving list subscribers are rejecting
|
||||
all HTML traffic. At least one MTA has gone so far as to blacklist
|
||||
shorewall.net "for continuous abuse" because it has been my policy to
|
||||
allow HTML in list posts!!<br>
|
||||
<br>
|
||||
I think that blocking all HTML is a Draconian way to control
|
||||
spam and that the ultimate losers here are not the spammers but the
|
||||
list subscribers whose MTAs are bouncing all shorewall.net mail. As
|
||||
one list subscriber wrote to me privately "These e-mail admin's need to
|
||||
get a <i>(explitive deleted)</i> life instead of trying to rid the planet
|
||||
of HTML based e-mail". Nevertheless, to allow subscribers to receive list
|
||||
posts as must as possible, I have now configured the list server at shorewall.net
|
||||
to strip all HTML from outgoing posts. This means that HTML-only posts
|
||||
will be bounced by the list server.<br>
|
||||
|
||||
A growing number of MTAs serving list subscribers are rejecting
|
||||
all HTML traffic. At least one MTA has gone so far as to blacklist
|
||||
shorewall.net "for continuous abuse" because it has been my policy
|
||||
to allow HTML in list posts!!<br>
|
||||
<br>
|
||||
I think that blocking all HTML is a Draconian way to control
|
||||
spam and that the ultimate losers here are not the spammers but the
|
||||
list subscribers whose MTAs are bouncing all shorewall.net mail. As
|
||||
one list subscriber wrote to me privately "These e-mail admin's need
|
||||
to get a <i>(explitive deleted)</i> life instead of trying to rid the
|
||||
planet of HTML based e-mail". Nevertheless, to allow subscribers to receive
|
||||
list posts as must as possible, I have now configured the list server
|
||||
at shorewall.net to strip all HTML from outgoing posts. This means that
|
||||
HTML-only posts will be bounced by the list server.<br>
|
||||
|
||||
<p align="left"> <b>Note: </b>The list server limits posts to 120kb.<br>
|
||||
</p>
|
||||
|
||||
</p>
|
||||
|
||||
<h2>Other Mail Delivery Problems</h2>
|
||||
If you find that you are missing an occasional list post,
|
||||
your e-mail admin may be blocking mail whose <i>Received:</i> headers
|
||||
contain the names of certain ISPs. Again, I believe that such policies
|
||||
hurt more than they help but I'm not prepared to go so far as to start
|
||||
If you find that you are missing an occasional list post,
|
||||
your e-mail admin may be blocking mail whose <i>Received:</i> headers
|
||||
contain the names of certain ISPs. Again, I believe that such policies
|
||||
hurt more than they help but I'm not prepared to go so far as to start
|
||||
stripping <i>Received:</i> headers to circumvent those policies.<br>
|
||||
|
||||
|
||||
<h2 align="left">Mailing Lists Archive Search</h2>
|
||||
|
||||
<form method="post" action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||
|
||||
<p> <font size="-1"> Match:
|
||||
|
||||
<form method="post" action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||
|
||||
<p> <font size="-1"> Match:
|
||||
<select name="method">
|
||||
<option value="and">All </option>
|
||||
<option value="or">Any </option>
|
||||
<option value="boolean">Boolean </option>
|
||||
</select>
|
||||
Format:
|
||||
Format:
|
||||
<select name="format">
|
||||
<option value="builtin-long">Long </option>
|
||||
<option value="builtin-short">Short </option>
|
||||
</select>
|
||||
Sort by:
|
||||
Sort by:
|
||||
<select name="sort">
|
||||
<option value="score">Score </option>
|
||||
<option value="time">Time </option>
|
||||
@ -143,146 +147,148 @@ stripping <i>Received:</i> headers to circumvent those policies.<br>
|
||||
<option value="revtime">Reverse Time </option>
|
||||
<option value="revtitle">Reverse Title </option>
|
||||
</select>
|
||||
</font> <input type="hidden" name="config"
|
||||
</font> <input type="hidden" name="config"
|
||||
value="htdig"> <input type="hidden" name="restrict"
|
||||
value="[http://lists.shorewall.net/pipermail/.*]"> <input type="hidden"
|
||||
name="exclude" value=""> <br>
|
||||
Search: <input type="text" size="30"
|
||||
Search: <input type="text" size="30"
|
||||
name="words" value=""> <input type="submit" value="Search"> </p>
|
||||
</form>
|
||||
|
||||
<h2 align="left"><font color="#ff0000">Please do not try to download the
|
||||
entire Archive -- it is 75MB (and growing daily) and my slow DSL line simply
|
||||
won't stand the traffic. If I catch you, you will be blacklisted.<br>
|
||||
</font></h2>
|
||||
|
||||
</form>
|
||||
|
||||
<h2 align="left"><font color="#ff0000">Please do not try to download the entire
|
||||
Archive -- it is 75MB (and growing daily) and my slow DSL line simply won't
|
||||
stand the traffic. If I catch you, you will be blacklisted.<br>
|
||||
</font></h2>
|
||||
|
||||
<h2 align="left">Shorewall CA Certificate</h2>
|
||||
If you want to trust X.509 certificates issued by
|
||||
Shoreline Firewall (such as the one used on my web site), you
|
||||
may <a href="Shorewall_CA_html.html">download and install my CA certificate</a>
|
||||
in your browser. If you don't wish to trust my certificates then
|
||||
you can either use unencrypted access when subscribing to Shorewall
|
||||
mailing lists or you can use secure access (SSL) and accept the server's
|
||||
certificate when prompted by your browser.<br>
|
||||
|
||||
If you want to trust X.509 certificates issued
|
||||
by Shoreline Firewall (such as the one used on my web site), you
|
||||
may <a href="Shorewall_CA_html.html">download and install my CA certificate</a>
|
||||
in your browser. If you don't wish to trust my certificates
|
||||
then you can either use unencrypted access when subscribing to
|
||||
Shorewall mailing lists or you can use secure access (SSL) and
|
||||
accept the server's certificate when prompted by your browser.<br>
|
||||
|
||||
<h2 align="left">Shorewall Users Mailing List</h2>
|
||||
|
||||
<p align="left">The Shorewall Users Mailing list provides a way for users
|
||||
to get answers to questions and to report problems. Information
|
||||
of general interest to the Shorewall user community is also posted
|
||||
to this list.</p>
|
||||
|
||||
<p align="left"><b>Before posting a problem report to this list, please see
|
||||
the <a href="http://www.shorewall.net/support.htm">problem reporting
|
||||
guidelines</a>.</b></p>
|
||||
|
||||
<p align="left">To subscribe to the mailing list:<br>
|
||||
</p>
|
||||
|
||||
<ul>
|
||||
<li><b>Insecure: </b><a
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-users">http://lists.shorewall.net/mailman/listinfo/shorewall-users</a></li>
|
||||
<li><b>SSL:</b> <a
|
||||
href="https://lists.shorewall.net/mailman/listinfo/shorewall-users"
|
||||
target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-users</a></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p align="left">To post to the list, post to <a
|
||||
href="mailto:shorewall-users@lists.shorewall.net">shorewall-users@lists.shorewall.net</a>.</p>
|
||||
|
||||
<p align="left">The list archives are at <a
|
||||
href="http://lists.shorewall.net/pipermail/shorewall-users/index.html">http://lists.shorewall.net/pipermail/shorewall-users</a>.</p>
|
||||
|
||||
<p align="left">Note that prior to 1/1/2002, the mailing list was hosted at
|
||||
<a href="http://sourceforge.net">Sourceforge</a>. The archives from that list
|
||||
may be found at <a
|
||||
href="http://www.geocrawler.com/lists/3/Sourceforge/9327/0/">www.geocrawler.com/lists/3/Sourceforge/9327/0/</a>.</p>
|
||||
|
||||
<h2 align="left">Shorewall Announce Mailing List</h2>
|
||||
|
||||
<p align="left">This list is for announcements of general interest to the
|
||||
Shorewall community. To subscribe:<br>
|
||||
</p>
|
||||
|
||||
<p align="left"></p>
|
||||
|
||||
<ul>
|
||||
<li><b>Insecure:</b> <a
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-announce">http://lists.shorewall.net/mailman/listinfo/shorewall-announce</a></li>
|
||||
<li><b>SSL</b>: <a
|
||||
href="https://lists.shorewall.net/mailman/listinfo/shorewall-announce"
|
||||
target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-announce.</a></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p align="left"><br>
|
||||
The list archives are at <a
|
||||
href="http://lists.shorewall.net/pipermail/shorewall-announce">http://lists.shorewall.net/pipermail/shorewall-announce</a>.</p>
|
||||
|
||||
<h2 align="left">Shorewall Development Mailing List</h2>
|
||||
|
||||
<p align="left">The Shorewall Development Mailing list provides a forum for
|
||||
the exchange of ideas about the future of Shorewall and for coordinating
|
||||
ongoing Shorewall Development.</p>
|
||||
|
||||
|
||||
<p align="left">The Shorewall Users Mailing list provides a way for users
|
||||
to get answers to questions and to report problems. Information
|
||||
of general interest to the Shorewall user community is also posted
|
||||
to this list.</p>
|
||||
|
||||
<p align="left"><b>Before posting a problem report to this list, please see
|
||||
the <a href="http://www.shorewall.net/support.htm">problem
|
||||
reporting guidelines</a>.</b></p>
|
||||
|
||||
<p align="left">To subscribe to the mailing list:<br>
|
||||
</p>
|
||||
|
||||
|
||||
<ul>
|
||||
<li><b>Insecure: </b><a
|
||||
<li><b>Insecure: </b><a
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-users">http://lists.shorewall.net/mailman/listinfo/shorewall-users</a></li>
|
||||
<li><b>SSL:</b> <a
|
||||
href="https://lists.shorewall.net/mailman/listinfo/shorewall-users"
|
||||
target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-users</a></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p align="left">To post to the list, post to <a
|
||||
href="mailto:shorewall-users@lists.shorewall.net">shorewall-users@lists.shorewall.net</a>.</p>
|
||||
|
||||
<p align="left">The list archives are at <a
|
||||
href="http://lists.shorewall.net/pipermail/shorewall-users/index.html">http://lists.shorewall.net/pipermail/shorewall-users</a>.</p>
|
||||
|
||||
<p align="left">Note that prior to 1/1/2002, the mailing list was hosted
|
||||
at <a href="http://sourceforge.net">Sourceforge</a>. The archives from that
|
||||
list may be found at <a
|
||||
href="http://www.geocrawler.com/lists/3/Sourceforge/9327/0/">www.geocrawler.com/lists/3/Sourceforge/9327/0/</a>.</p>
|
||||
|
||||
<h2 align="left">Shorewall Announce Mailing List</h2>
|
||||
|
||||
<p align="left">This list is for announcements of general interest to the
|
||||
Shorewall community. To subscribe:<br>
|
||||
</p>
|
||||
|
||||
<p align="left"></p>
|
||||
|
||||
<ul>
|
||||
<li><b>Insecure:</b> <a
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-announce">http://lists.shorewall.net/mailman/listinfo/shorewall-announce</a></li>
|
||||
<li><b>SSL</b>: <a
|
||||
href="https://lists.shorewall.net/mailman/listinfo/shorewall-announce"
|
||||
target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-announce.</a></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p align="left"><br>
|
||||
The list archives are at <a
|
||||
href="http://lists.shorewall.net/pipermail/shorewall-announce">http://lists.shorewall.net/pipermail/shorewall-announce</a>.</p>
|
||||
|
||||
<h2 align="left">Shorewall Development Mailing List</h2>
|
||||
|
||||
<p align="left">The Shorewall Development Mailing list provides a forum for
|
||||
the exchange of ideas about the future of Shorewall and for
|
||||
coordinating ongoing Shorewall Development.</p>
|
||||
|
||||
<p align="left">To subscribe to the mailing list:<br>
|
||||
</p>
|
||||
|
||||
<ul>
|
||||
<li><b>Insecure: </b><a
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-devel">http://lists.shorewall.net/mailman/listinfo/shorewall-devel</a></li>
|
||||
<li><b>SSL:</b> <a
|
||||
<li><b>SSL:</b> <a
|
||||
href="https://lists.shorewall.net/mailman/listinfo/shorewall-devel"
|
||||
target="_top">https//lists.shorewall.net/mailman/listinfo/shorewall-devel.</a></li>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<p align="left"> To post to the list, post to <a
|
||||
href="mailto:shorewall-devel@lists.shorewall.net">shorewall-devel@lists.shorewall.net</a>. </p>
|
||||
|
||||
|
||||
<p align="left">The list archives are at <a
|
||||
href="http://lists.shorewall.net/pipermail/shorewall-devel">http://lists.shorewall.net/pipermail/shorewall-devel</a>.</p>
|
||||
|
||||
<h2 align="left"><a name="Unsubscribe"></a>How to Unsubscribe from one of
|
||||
the Mailing Lists</h2>
|
||||
|
||||
<p align="left">There seems to be near-universal confusion about unsubscribing
|
||||
from Mailman-managed lists although Mailman 2.1 has attempted
|
||||
to make this less confusing. To unsubscribe:</p>
|
||||
|
||||
|
||||
<h2 align="left"><a name="Unsubscribe"></a>How to Unsubscribe from one of
|
||||
the Mailing Lists</h2>
|
||||
|
||||
<p align="left">There seems to be near-universal confusion about unsubscribing
|
||||
from Mailman-managed lists although Mailman 2.1 has attempted
|
||||
to make this less confusing. To unsubscribe:</p>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<p align="left">Follow the same link above that you used to subscribe
|
||||
to the list.</p>
|
||||
</li>
|
||||
<li>
|
||||
<p align="left">Down at the bottom of that page is the following text:
|
||||
" To <b>unsubscribe</b> from <i><list name></i>, get a
|
||||
password reminder, or change your subscription options enter
|
||||
your subscription email address:". Enter your email address
|
||||
in the box and click on the "<b>Unsubscribe</b> or edit options" button.</p>
|
||||
</li>
|
||||
<li>
|
||||
<p align="left">There will now be a box where you can enter your password
|
||||
and click on "Unsubscribe"; if you have forgotten your password,
|
||||
there is another button that will cause your password to be emailed
|
||||
to you.</p>
|
||||
</li>
|
||||
|
||||
<li>
|
||||
<p align="left">Follow the same link above that you used to subscribe
|
||||
to the list.</p>
|
||||
</li>
|
||||
<li>
|
||||
<p align="left">Down at the bottom of that page is the following text:
|
||||
" To <b>unsubscribe</b> from <i><list name></i>, get
|
||||
a password reminder, or change your subscription options enter
|
||||
your subscription email address:". Enter your email address
|
||||
in the box and click on the "<b>Unsubscribe</b> or edit options"
|
||||
button.</p>
|
||||
</li>
|
||||
<li>
|
||||
<p align="left">There will now be a box where you can enter your password
|
||||
and click on "Unsubscribe"; if you have forgotten your password,
|
||||
there is another button that will cause your password to be
|
||||
emailed to you.</p>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<hr>
|
||||
|
||||
<hr>
|
||||
<h2 align="left">Frustrated by having to Rebuild Mailman to use it with Postfix?</h2>
|
||||
|
||||
|
||||
<p align="left"><a href="gnu_mailman.htm">Check out these instructions</a></p>
|
||||
|
||||
<p align="left"><font size="2">Last updated 3/24/2003 - <a
|
||||
|
||||
<p align="left"><font size="2">Last updated 5/29/2003 - <a
|
||||
href="http://www.shorewall.net/support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
<p align="left"><a href="copyright.htm"> <font size="2">Copyright</font>
|
||||
© <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||
</p>
|
||||
|
||||
<p align="left"><a href="copyright.htm"> <font size="2">Copyright</font> ©
|
||||
<font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
|
File diff suppressed because one or more lines are too long
@ -2,117 +2,119 @@
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shoreline Firewall (Shorewall) 1.4</title>
|
||||
|
||||
<base
|
||||
<base
|
||||
target="_self">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="4"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber3"
|
||||
bgcolor="#4b017c">
|
||||
|
||||
<tbody>
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<tr>
|
||||
|
||||
<td width="100%" height="90">
|
||||
<td width="100%" height="90">
|
||||
|
||||
|
||||
|
||||
|
||||
<h1 align="center"> <font size="4"><i> <a
|
||||
href="http://www.cityofshoreline.com"> <img vspace="4" hspace="4"
|
||||
alt="Shorwall Logo" height="70" width="85" align="left"
|
||||
src="images/washington.jpg" border="0">
|
||||
|
||||
</a></i></font><a href="http://www.shorewall.net"
|
||||
</a></i></font><a href="http://www.shorewall.net"
|
||||
target="_top"><img border="1" src="images/shorewall.jpg" width="119"
|
||||
height="38" hspace="4" alt="(Shorewall Logo)" align="right" vspace="4">
|
||||
</a></h1>
|
||||
<small><small><small><small><a
|
||||
href="http://www.shorewall.net" target="_top"> </a></small></small></small></small>
|
||||
|
||||
</a></h1>
|
||||
<small><small><small><small><a
|
||||
href="http://www.shorewall.net" target="_top"> </a></small></small></small></small>
|
||||
|
||||
|
||||
<div align="center">
|
||||
|
||||
|
||||
|
||||
<div align="center">
|
||||
|
||||
|
||||
|
||||
<h1><font color="#ffffff"> Shorewall 1.4</font><i><font
|
||||
color="#ffffff"> <small><small><small>"iptables made easy"</small></small></small></font></i><a
|
||||
href="1.3" target="_top"><font color="#ffffff"><br>
|
||||
</font></a><br>
|
||||
</font></a><br>
|
||||
|
||||
|
||||
</h1>
|
||||
</div>
|
||||
</h1>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><a href="http://www.shorewall.net" target="_top"> </a> </p>
|
||||
</td>
|
||||
</tr>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<div align="center">
|
||||
<center>
|
||||
|
||||
<div align="center">
|
||||
<center>
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
||||
|
||||
<tbody>
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<tr>
|
||||
|
||||
<td width="90%">
|
||||
<td width="90%">
|
||||
|
||||
|
||||
|
||||
|
||||
<h2 align="left">What is it?</h2>
|
||||
|
||||
|
||||
|
||||
|
||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is a
|
||||
<a href="http://www.netfilter.org">Netfilter</a> (iptables) based firewall
|
||||
that can be used on a dedicated firewall system, a multi-function
|
||||
gateway/router/server or on a standalone GNU/Linux system.</p>
|
||||
|
||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
||||
a <a href="http://www.netfilter.org">Netfilter</a> (iptables) based
|
||||
firewall that can be used on a dedicated firewall system, a multi-function
|
||||
gateway/router/server or on a standalone GNU/Linux system.</p>
|
||||
|
||||
|
||||
|
||||
|
||||
<p>This program is free software; you can redistribute it and/or modify
|
||||
it
|
||||
under the terms of <a
|
||||
href="http://www.gnu.org/licenses/gpl.html">Version 2 of the GNU
|
||||
General Public License</a> as published by the Free Software
|
||||
Foundation.<br>
|
||||
|
||||
<p>This program is free software; you can redistribute it and/or modify
|
||||
it
|
||||
under the terms of <a
|
||||
href="http://www.gnu.org/licenses/gpl.html">Version 2 of the
|
||||
GNU General Public License</a> as published by the Free Software
|
||||
Foundation.<br>
|
||||
|
||||
<br>
|
||||
<br>
|
||||
|
||||
This program is distributed in the hope
|
||||
that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty
|
||||
of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License
|
||||
for more details.<br>
|
||||
This program is distributed in the hope
|
||||
that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty
|
||||
of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License
|
||||
for more details.<br>
|
||||
|
||||
<br>
|
||||
<br>
|
||||
|
||||
You should have received a copy of the
|
||||
GNU General Public License along
|
||||
with this program; if not, write to the Free
|
||||
Software Foundation, Inc., 675 Mass
|
||||
Ave, Cambridge, MA 02139, USA</p>
|
||||
You should have received a copy of the
|
||||
GNU General Public License along
|
||||
with this program; if not, write to the Free
|
||||
Software Foundation, Inc., 675 Mass
|
||||
Ave, Cambridge, MA 02139, USA</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M. Eastep</a></p>
|
||||
|
||||
|
||||
@ -121,287 +123,303 @@ General Public License</a> as published by the Free Software
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2>Running Shorewall on Mandrake with a two-interface setup?</h2>
|
||||
If so, almost <b>NOTHING </b>on this site will apply directly to
|
||||
your setup. If you want to use the documentation that you find here, it
|
||||
is best if you uninstall what you have and install a setup that matches
|
||||
the documentation on this site. See the <a href="two-interface.htm">Two-interface
|
||||
QuickStart Guide</a> for details.<br>
|
||||
|
||||
If so, almost <b>NOTHING </b>on this site will apply directly to
|
||||
your setup. If you want to use the documentation that you find here, it
|
||||
is best if you uninstall what you have and install a setup that matches
|
||||
the documentation on this site. See the <a href="two-interface.htm">Two-interface
|
||||
QuickStart Guide</a> for details.<br>
|
||||
|
||||
<h2> Getting Started with Shorewall</h2>
|
||||
New to Shorewall? Start by selecting the <a
|
||||
href="shorewall_quickstart_guide.htm">QuickStart Guide</a> that most closely
|
||||
match your environment and follow the step by step instructions.<br>
|
||||
New to Shorewall? Start by selecting the <a
|
||||
href="shorewall_quickstart_guide.htm">QuickStart Guide</a> that most closely
|
||||
match your environment and follow the step by step instructions.<br>
|
||||
|
||||
|
||||
|
||||
<h2>News</h2>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><b>5/29/2003 - Shorewall-1.4.4b</b><b> </b><b><img border="0"
|
||||
src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b></p>
|
||||
|
||||
<p>Groan -- This version corrects a problem whereby the --log-level
|
||||
was not being set when logging via syslog. The most commonly reported symptom
|
||||
was that Shorewall messages were being written to the console even though
|
||||
console logging was correctly configured per <a href="FAQ.htm#faq16">FAQ
|
||||
16</a>.<br>
|
||||
</p>
|
||||
|
||||
<p><b>5/27/2003 - Shorewall-1.4.4a</b><b> </b><b><img border="0"
|
||||
src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b></p>
|
||||
The Fireparse --log-prefix fiasco continues. Tuomo Soini has pointed out
|
||||
that the code in 1.4.4 restricts the length of short zone names to 4 characters.
|
||||
I've produced version 1.4.4a that restores the previous 5-character limit
|
||||
by conditionally omitting the log rule number when the LOGFORMAT doesn't
|
||||
contain '%d'.
|
||||
</b></p>
|
||||
The Fireparse --log-prefix fiasco continues. Tuomo Soini has pointed out
|
||||
that the code in 1.4.4 restricts the length of short zone names to 4 characters.
|
||||
I've produced version 1.4.4a that restores the previous 5-character limit
|
||||
by conditionally omitting the log rule number when the LOGFORMAT doesn't
|
||||
contain '%d'.
|
||||
<p><b>5/23/2003 - Shorewall-1.4.4</b><b> </b><b><img border="0"
|
||||
src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b><b> </b></p>
|
||||
I apologize for the rapid-fire releases but since there is a potential
|
||||
configuration change required to go from 1.4.3a to 1.4.4, I decided to make
|
||||
it a full release rather than just a bug-fix release. <br>
|
||||
<br>
|
||||
<b> Problems corrected:</b><br>
|
||||
|
||||
</b><b> </b></p>
|
||||
I apologize for the rapid-fire releases but since there is a potential
|
||||
configuration change required to go from 1.4.3a to 1.4.4, I decided to
|
||||
make it a full release rather than just a bug-fix release. <br>
|
||||
<br>
|
||||
<b> Problems corrected:</b><br>
|
||||
|
||||
<blockquote>None.<br>
|
||||
</blockquote>
|
||||
<b> New Features:<br>
|
||||
</b>
|
||||
</blockquote>
|
||||
<b> New Features:<br>
|
||||
</b>
|
||||
<ol>
|
||||
<li>A REDIRECT- rule target has been added. This target behaves
|
||||
for REDIRECT in the same way as DNAT- does for DNAT in that the Netfilter
|
||||
nat table REDIRECT rule is added but not the companion filter table ACCEPT
|
||||
<li>A REDIRECT- rule target has been added. This target behaves
|
||||
for REDIRECT in the same way as DNAT- does for DNAT in that the Netfilter
|
||||
nat table REDIRECT rule is added but not the companion filter table ACCEPT
|
||||
rule.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>The LOGMARKER variable has been renamed LOGFORMAT and has
|
||||
been changed to a 'printf' formatting template which accepts three arguments
|
||||
(the chain name, logging rule number and the disposition). To use LOGFORMAT
|
||||
with fireparse (<a href="http://www.fireparse.com">http://www.fireparse.com</a>),
|
||||
set it as:<br>
|
||||
<br>
|
||||
LOGFORMAT="fp=%s:%d a=%s "<br>
|
||||
<br>
|
||||
<b>CAUTION: </b>/sbin/shorewall uses the leading part of the LOGFORMAT
|
||||
string (up to but not including the first '%') to find log messages in
|
||||
the 'show log', 'status' and 'hits' commands. This part should not be omitted
|
||||
(the LOGFORMAT should not begin with "%") and the leading part should be
|
||||
<br>
|
||||
</li>
|
||||
<li>The LOGMARKER variable has been renamed LOGFORMAT and has
|
||||
been changed to a 'printf' formatting template which accepts three arguments
|
||||
(the chain name, logging rule number and the disposition). To use LOGFORMAT
|
||||
with fireparse (<a href="http://www.fireparse.com">http://www.fireparse.com</a>),
|
||||
set it as:<br>
|
||||
<br>
|
||||
LOGFORMAT="fp=%s:%d a=%s "<br>
|
||||
<br>
|
||||
<b>CAUTION: </b>/sbin/shorewall uses the leading part of the LOGFORMAT
|
||||
string (up to but not including the first '%') to find log messages in the
|
||||
'show log', 'status' and 'hits' commands. This part should not be omitted
|
||||
(the LOGFORMAT should not begin with "%") and the leading part should be
|
||||
sufficiently unique for /sbin/shorewall to identify Shorewall messages.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>When logging is specified on a DNAT[-] or REDIRECT[-] rule,
|
||||
the logging now takes place in the nat table rather than in the filter table.
|
||||
This way, only those connections that actually undergo DNAT or redirection
|
||||
will be logged.<br>
|
||||
</li>
|
||||
|
||||
<br>
|
||||
</li>
|
||||
<li>When logging is specified on a DNAT[-] or REDIRECT[-] rule,
|
||||
the logging now takes place in the nat table rather than in the filter table.
|
||||
This way, only those connections that actually undergo DNAT or redirection
|
||||
will be logged.<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
|
||||
|
||||
<p><b>5/20/2003 - Shorewall-1.4.3a</b><br>
|
||||
</p>
|
||||
This version primarily corrects the documentation included in the .tgz
|
||||
and in the .rpm. In addition: <br>
|
||||
|
||||
</p>
|
||||
This version primarily corrects the documentation included in the .tgz
|
||||
and in the .rpm. In addition: <br>
|
||||
|
||||
<ol>
|
||||
<li>(This change is in 1.4.3 but is not documented) If you are
|
||||
running iptables 1.2.7a and kernel 2.4.20, then Shorewall will return reject
|
||||
replies as follows:<br>
|
||||
a) tcp - RST<br>
|
||||
b) udp - ICMP port unreachable<br>
|
||||
c) icmp - ICMP host unreachable<br>
|
||||
d) Otherwise - ICMP host prohibited<br>
|
||||
If you are running earlier software, Shorewall will follow it's traditional
|
||||
convention:<br>
|
||||
a) tcp - RST<br>
|
||||
b) Otherwise - ICMP port unreachable</li>
|
||||
<li>UDP port 135 is now silently dropped in the common.def chain.
|
||||
Remember that this chain is traversed just before a DROP or REJECT policy
|
||||
is enforced.<br>
|
||||
</li>
|
||||
|
||||
<li>(This change is in 1.4.3 but is not documented) If you
|
||||
are running iptables 1.2.7a and kernel 2.4.20, then Shorewall will return
|
||||
reject replies as follows:<br>
|
||||
a) tcp - RST<br>
|
||||
b) udp - ICMP port unreachable<br>
|
||||
c) icmp - ICMP host unreachable<br>
|
||||
d) Otherwise - ICMP host prohibited<br>
|
||||
If you are running earlier software, Shorewall will follow it's traditional
|
||||
convention:<br>
|
||||
a) tcp - RST<br>
|
||||
b) Otherwise - ICMP port unreachable</li>
|
||||
<li>UDP port 135 is now silently dropped in the common.def
|
||||
chain. Remember that this chain is traversed just before a DROP or REJECT
|
||||
policy is enforced.<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
|
||||
|
||||
<p><b>5/18/2003 - Shorewall 1.4.3</b><br>
|
||||
</p>
|
||||
<b>Problems Corrected:<br>
|
||||
</b>
|
||||
</p>
|
||||
<b>Problems Corrected:<br>
|
||||
</b>
|
||||
|
||||
<ol>
|
||||
<li>There were several cases where Shorewall would fail to
|
||||
remove a temporary directory from /tmp. These cases have been corrected.</li>
|
||||
<li>The rules for allowing all traffic via the loopback interface
|
||||
have been moved to before the rule that drops status=INVALID packets.
|
||||
This insures that all loopback traffic is allowed even if Netfilter connection
|
||||
<li>There were several cases where Shorewall would fail to
|
||||
remove a temporary directory from /tmp. These cases have been corrected.</li>
|
||||
<li>The rules for allowing all traffic via the loopback interface
|
||||
have been moved to before the rule that drops status=INVALID packets.
|
||||
This insures that all loopback traffic is allowed even if Netfilter connection
|
||||
tracking is confused.</li>
|
||||
|
||||
|
||||
</ol>
|
||||
<b>New Features:<br>
|
||||
</b>
|
||||
<b>New Features:<br>
|
||||
</b>
|
||||
|
||||
<ol>
|
||||
<li> <a href="6to4.htm">IPV6-IPV4 (6to4) tunnels are</a> now
|
||||
supported in the /etc/shorewall/tunnels file.</li>
|
||||
<li>You may now change the leading portion of the --log-prefix
|
||||
used by Shorewall using the LOGMARKER variable in shorewall.conf. By default,
|
||||
<li> <a href="6to4.htm">IPV6-IPV4 (6to4) tunnels are</a>
|
||||
now supported in the /etc/shorewall/tunnels file.</li>
|
||||
<li>You may now change the leading portion of the --log-prefix
|
||||
used by Shorewall using the LOGMARKER variable in shorewall.conf. By default,
|
||||
"Shorewall:" is used.<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p><b>5/10/2003 - Shorewall Mirror in Asia</b><b> </b><br>
|
||||
</p>
|
||||
Ed Greshko has established a mirror in Taiwan -- Thanks Ed!
|
||||
</li>
|
||||
|
||||
|
||||
|
||||
</ol>
|
||||
|
||||
<p><b>5/10/2003 - Shorewall Mirror in Asia</b><b> </b><br>
|
||||
</p>
|
||||
Ed Greshko has established a mirror in Taiwan -- Thanks Ed!
|
||||
|
||||
|
||||
<p><b>5/8/2003 - Shorewall Mirror in Chile</b><b> </b></p>
|
||||
|
||||
|
||||
|
||||
<p>Thanks to Darcy Ganga, there is now an HTTP mirror in Santiago Chile.<br>
|
||||
</p>
|
||||
</p>
|
||||
|
||||
|
||||
|
||||
<p><b>4/26/2003 - lists.shorewall.net Downtime</b><b> </b></p>
|
||||
|
||||
|
||||
|
||||
<p>The list server will be down this morning for upgrade to RH9.0.<br>
|
||||
</p>
|
||||
</p>
|
||||
|
||||
|
||||
<p><b>4/21/2003 - Samples updated for Shorewall version 1.4.2</b><b>
|
||||
</b></p>
|
||||
|
||||
|
||||
|
||||
<p>Thanks to Francesca Smith, the sample configurations are now upgraded
|
||||
to Shorewall version 1.4.2.</p>
|
||||
|
||||
|
||||
|
||||
<p><b>4/12/2002 - Greater Seattle Linux Users Group Presentation</b><b>
|
||||
|
||||
<p><b>4/21/2003 - Samples updated for Shorewall version 1.4.2</b><b>
|
||||
</b></p>
|
||||
|
||||
|
||||
|
||||
<blockquote>This morning, I gave <a href="GSLUG.htm" target="_top">a
|
||||
Shorewall presentation to GSLUG</a>. The presentation is
|
||||
in HTML format but was generated from Microsoft PowerPoint and is best
|
||||
viewed using Internet Explorer (although Konqueror also seems to work
|
||||
reasonably well as does Opera 7.1.0). Neither Opera 6 nor Netscape
|
||||
work well to view the presentation.<br>
|
||||
</blockquote>
|
||||
|
||||
<p>Thanks to Francesca Smith, the sample configurations are now upgraded
|
||||
to Shorewall version 1.4.2.</p>
|
||||
|
||||
|
||||
|
||||
|
||||
<p><b>4/12/2002 - Greater Seattle Linux Users Group Presentation</b><b>
|
||||
</b></p>
|
||||
|
||||
|
||||
|
||||
<blockquote>This morning, I gave <a href="GSLUG.htm" target="_top">a
|
||||
Shorewall presentation to GSLUG</a>. The presentation
|
||||
is in HTML format but was generated from Microsoft PowerPoint and
|
||||
is best viewed using Internet Explorer (although Konqueror also seems
|
||||
to work reasonably well as does Opera 7.1.0). Neither Opera 6 nor
|
||||
Netscape work well to view the presentation.<br>
|
||||
</blockquote>
|
||||
|
||||
|
||||
|
||||
<p><b></b></p>
|
||||
|
||||
<blockquote>
|
||||
|
||||
|
||||
<blockquote>
|
||||
|
||||
<ol>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</ol>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><a href="News.htm">More News</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
||||
border="0" src="images/leaflogo.gif" width="49" height="36"
|
||||
alt="(Leaf Logo)">
|
||||
|
||||
</a>Jacques Nilo and Eric Wolzak have
|
||||
a LEAF (router/firewall/gateway on a floppy,
|
||||
CD or compact flash) distribution called
|
||||
<i>Bering</i> that features Shorewall-1.3.14
|
||||
and Kernel-2.4.20. You can find their
|
||||
work at: <a
|
||||
</a>Jacques Nilo and Eric Wolzak have
|
||||
a LEAF (router/firewall/gateway on a floppy,
|
||||
CD or compact flash) distribution called
|
||||
<i>Bering</i> that features Shorewall-1.3.14
|
||||
and Kernel-2.4.20. You can find their
|
||||
work at: <a
|
||||
href="http://leaf.sourceforge.net/devel/jnilo"> http://leaf.sourceforge.net/devel/jnilo<br>
|
||||
|
||||
</a></p>
|
||||
</a></p>
|
||||
|
||||
|
||||
<b>Congratulations to Jacques and Eric on the recent release
|
||||
of Bering 1.2!!! </b><br>
|
||||
|
||||
<b>Congratulations to Jacques and Eric on the recent release
|
||||
of Bering 1.2!!! </b><br>
|
||||
|
||||
|
||||
<h2><a name="Donations"></a>Donations</h2>
|
||||
</td>
|
||||
</td>
|
||||
|
||||
<td width="88" bgcolor="#4b017c" valign="top"
|
||||
align="center">
|
||||
|
||||
<td width="88" bgcolor="#4b017c" valign="top"
|
||||
align="center">
|
||||
|
||||
<form method="post"
|
||||
action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||
<strong><br>
|
||||
<font color="#ffffff"><b>Note:
|
||||
</b></font></strong><font color="#ffffff">Search is unavailable
|
||||
Daily 0200-0330 GMT.</font><br>
|
||||
<strong></strong>
|
||||
action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||
<strong><br>
|
||||
<font color="#ffffff"><b>Note:
|
||||
</b></font></strong><font color="#ffffff">Search is unavailable
|
||||
Daily 0200-0330 GMT.</font><br>
|
||||
<strong></strong>
|
||||
|
||||
|
||||
|
||||
<p><font color="#ffffff"><strong>Quick Search</strong></font><br>
|
||||
<font
|
||||
<font
|
||||
face="Arial" size="-1"> <input type="text" name="words"
|
||||
size="15"></font><font size="-1"> </font> <font face="Arial"
|
||||
size="-1"> <input type="hidden" name="format" value="long"> <input
|
||||
type="hidden" name="method" value="and"> <input type="hidden"
|
||||
name="config" value="htdig"> <input type="submit" value="Search"></font>
|
||||
name="config" value="htdig"> <input type="submit" value="Search"></font>
|
||||
</p>
|
||||
<font
|
||||
<font
|
||||
face="Arial"> <input type="hidden" name="exclude"
|
||||
value="[http://lists.shorewall.net/pipermail/*]"> </font> </form>
|
||||
|
||||
|
||||
|
||||
<p><font color="#ffffff"><b><a
|
||||
href="http://lists.shorewall.net/htdig/search.html"><font
|
||||
color="#ffffff">Extended Search</font></a></b></font></p>
|
||||
<br>
|
||||
</td>
|
||||
<br>
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
</center>
|
||||
</div>
|
||||
|
||||
</center>
|
||||
|
||||
</div>
|
||||
|
||||
<table border="0" cellpadding="5" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber2"
|
||||
bgcolor="#4b017c">
|
||||
<tbody>
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<tr>
|
||||
|
||||
<td width="100%" style="margin-top: 1px;">
|
||||
<td width="100%" style="margin-top: 1px;">
|
||||
|
||||
|
||||
|
||||
|
||||
<p align="center"><a href="http://www.starlight.org"> <img
|
||||
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
||||
hspace="10">
|
||||
|
||||
</a></p>
|
||||
</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
<p align="center"><font size="4" color="#ffffff">Shorewall is free but
|
||||
if you try it and find it useful, please consider making a donation
|
||||
to
|
||||
<a href="http://www.starlight.org"><font color="#ffffff">Starlight
|
||||
Children's Foundation.</font></a> Thanks!</font></p>
|
||||
|
||||
<p align="center"><font size="4" color="#ffffff">Shorewall is free
|
||||
but if you try it and find it useful, please consider making a donation
|
||||
to
|
||||
<a href="http://www.starlight.org"><font color="#ffffff">Starlight
|
||||
Children's Foundation.</font></a> Thanks!</font></p>
|
||||
|
||||
</td>
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<p><font size="2">Updated 5/27/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
<br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
<p><font size="2">Updated 5/29/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
<br>
|
||||
</p>
|
||||
</body>
|
||||
</html>
|
||||
|
@ -1,135 +1,136 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>About the Shorewall Author</title>
|
||||
|
||||
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
|
||||
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
|
||||
|
||||
<meta name="Microsoft Theme" content="none">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Tom Eastep</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<p align="center"> <img border="3" src="images/TomNTarry.png"
|
||||
alt="Tom on the PCT - 1991" width="316" height="392">
|
||||
</p>
|
||||
|
||||
</p>
|
||||
|
||||
<p align="center">Tarry & Tom -- August 2002<br>
|
||||
<br>
|
||||
</p>
|
||||
|
||||
<br>
|
||||
</p>
|
||||
|
||||
<ul>
|
||||
<li>Born 1945 in <a
|
||||
<li>Born 1945 in <a
|
||||
href="http://www.experiencewashington.com">Washington State</a> .</li>
|
||||
<li>BA Mathematics from <a
|
||||
<li>BA Mathematics from <a
|
||||
href="http://www.wsu.edu">Washington State University</a> 1967</li>
|
||||
<li>MA Mathematics from <a
|
||||
<li>MA Mathematics from <a
|
||||
href="http://www.washington.edu">University of Washington</a> 1969</li>
|
||||
<li>Burroughs Corporation (now <a
|
||||
<li>Burroughs Corporation (now <a
|
||||
href="http://www.unisys.com">Unisys</a> ) 1969 - 1980</li>
|
||||
<li><a href="http://www.tandem.com">Tandem Computers,
|
||||
Incorporated</a> (now part of the <a href="http://www.hp.com">The
|
||||
New HP</a>) 1980 - present</li>
|
||||
<li>Married 1969 - no children.</li>
|
||||
|
||||
<li><a href="http://www.tandem.com">Tandem Computers,
|
||||
Incorporated</a> (now part of the <a href="http://www.hp.com">The
|
||||
New HP</a>) 1980 - present</li>
|
||||
<li>Married 1969 - no children.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p>I am currently a member of the design team for the next-generation operating
|
||||
system from the NonStop Enterprise Division of HP. </p>
|
||||
|
||||
<p>I became interested in Internet Security when I established a home office
|
||||
in 1999 and had DSL service installed in our home. I investigated
|
||||
ipchains and developed the scripts which are now collectively known
|
||||
as <a href="http://seawall.sourceforge.net"> Seattle Firewall</a>.
|
||||
Expanding on what I learned from Seattle Firewall, I then designed
|
||||
and wrote Shorewall. </p>
|
||||
|
||||
|
||||
<p>I am currently a member of the design team for the next-generation operating
|
||||
system from the NonStop Enterprise Division of HP. </p>
|
||||
|
||||
<p>I became interested in Internet Security when I established a home office
|
||||
in 1999 and had DSL service installed in our home. I investigated
|
||||
ipchains and developed the scripts which are now collectively known
|
||||
as <a href="http://seawall.sourceforge.net"> Seattle Firewall</a>.
|
||||
Expanding on what I learned from Seattle Firewall, I then
|
||||
designed and wrote Shorewall. </p>
|
||||
|
||||
<p>I telework from our <a
|
||||
href="http://lists.shorewall.net/SeattleInTheSpring.html">home</a> in <a
|
||||
href="http://www.cityofshoreline.com">Shoreline, Washington</a> where
|
||||
I live with my wife Tarry. </p>
|
||||
|
||||
href="http://www.cityofshoreline.com">Shoreline, Washington</a>
|
||||
where I live with my wife Tarry. </p>
|
||||
|
||||
<p>Our current home network consists of: </p>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>1.2Gz Athlon, Windows XP Pro, 320MB RAM, 40GB
|
||||
& 20GB IDE HDs and LNE100TX (Tulip) NIC - My personal Windows
|
||||
<li>1.2Gz Athlon, Windows XP Pro, 320MB RAM, 40GB
|
||||
& 20GB IDE HDs and LNE100TX (Tulip) NIC - My personal Windows
|
||||
system. Serves as a PPTP server for Road Warrior access. Dual boots <a
|
||||
href="http://www.mandrakelinux.com">Mandrake</a> 9.0.</li>
|
||||
<li>Celeron 1.4Gz, RH8.0, 384MB RAM, 60GB HD, LNE100TX(Tulip)
|
||||
NIC - My personal Linux System which runs Samba configured
|
||||
as a WINS server. This system also has <a
|
||||
href="http://www.vmware.com/">VMware</a> installed and can run both
|
||||
<a href="http://www.debian.org">Debian Woody</a> and <a
|
||||
<li>Celeron 1.4Gz, RH8.0, 384MB RAM, 60GB HD, LNE100TX(Tulip)
|
||||
NIC - My personal Linux System which runs Samba configured as
|
||||
a WINS server. This system also has <a
|
||||
href="http://www.vmware.com/">VMware</a> installed and can run
|
||||
both <a href="http://www.debian.org">Debian Woody</a> and <a
|
||||
href="http://www.suse.com">SuSE 8.1</a> in virtual machines.</li>
|
||||
<li>K6-2/350, RH8.0, 384MB RAM, 8GB IDE HD, EEPRO100
|
||||
NIC - Email (Postfix, Courier-IMAP and Mailman), HTTP (Apache), FTP
|
||||
<li>K6-2/350, RH8.0, 384MB RAM, 8GB IDE HD, EEPRO100
|
||||
NIC - Email (Postfix, Courier-IMAP and Mailman), HTTP (Apache), FTP
|
||||
(Pure_ftpd), DNS server (Bind 9).</li>
|
||||
<li>PII/233, RH8.0, 256MB MB RAM, 2GB SCSI HD -
|
||||
3 LNE100TX (Tulip) and 1 TLAN NICs - Firewall running Shorewall
|
||||
1.4.2 and a DHCP server.</li>
|
||||
<li>Duron 750, Win ME, 192MB RAM, 20GB HD, RTL8139
|
||||
<li>PII/233, RH8.0, 256MB MB RAM, 2GB SCSI HD -
|
||||
3 LNE100TX (Tulip) and 1 TLAN NICs - Firewall running Shorewall
|
||||
1.4.4a and a DHCP server.</li>
|
||||
<li>Duron 750, Win ME, 192MB RAM, 20GB HD, RTL8139
|
||||
NIC - My wife's personal system.</li>
|
||||
<li>PII/400 Laptop, WinXP SP1, 224MB RAM, 12GB HD,
|
||||
built-in EEPRO100, EEPRO100 in expansion base and LinkSys WAC11 - My
|
||||
work system.</li>
|
||||
<li>XP 2200 Laptop, WinXP SP1, 512MB RAM, 40GB HD, built-in NIC and LinkSys
|
||||
WAC11 - Our Laptop.<br>
|
||||
</li>
|
||||
|
||||
<li>PII/400 Laptop, WinXP SP1, 224MB RAM, 12GB HD,
|
||||
built-in EEPRO100, EEPRO100 in expansion base and LinkSys WAC11 - My
|
||||
work system.</li>
|
||||
<li>XP 2200 Laptop, WinXP SP1, 512MB RAM, 40GB HD, built-in NIC and LinkSys
|
||||
WET11 - Our Laptop.<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<p>For more about our network see <a href="myfiles.htm">my Shorewall Configuration</a>.</p>
|
||||
|
||||
|
||||
<p>All of our other systems are made by <a
|
||||
href="http://www.compaq.com">Compaq</a> (part of the new <a
|
||||
href="http://www.hp.com/">HP</a>).. All of our Tulip NICs are <a
|
||||
href="http://www.netgear.com">Netgear</a> FA310TXs.</p>
|
||||
|
||||
|
||||
<p><a href="http://www.redhat.com"><img border="0"
|
||||
src="images/poweredby.png" width="88" height="31">
|
||||
</a><a href="http://www.compaq.com"><img border="0"
|
||||
</a><a href="http://www.compaq.com"><img border="0"
|
||||
src="images/poweredbycompaqlog0.gif" hspace="3" width="83" height="25">
|
||||
</a><a href="http://www.pureftpd.org"><img border="0"
|
||||
src="images/pure.jpg" width="88" height="31">
|
||||
</a><font size="4"><a href="http://www.apache.org"><img
|
||||
</a><a href="http://www.pureftpd.org"><img
|
||||
border="0" src="images/pure.jpg" width="88" height="31">
|
||||
</a><font size="4"><a href="http://www.apache.org"><img
|
||||
border="0" src="images/apache_pb1.gif" hspace="2" width="170"
|
||||
height="20">
|
||||
</a><a href="http://www.mandrakelinux.com"><img
|
||||
</a><a href="http://www.mandrakelinux.com"><img
|
||||
src="images/medbutton.png" alt="Powered by Mandrake" width="90"
|
||||
height="32">
|
||||
</a><img src="images/shorewall.jpg"
|
||||
</a><img src="images/shorewall.jpg"
|
||||
alt="Protected by Shorewall" width="125" height="40" hspace="4">
|
||||
<a href="http://www.opera.com"><img src="images/opera.png"
|
||||
<a href="http://www.opera.com"><img src="images/opera.png"
|
||||
alt="(Opera Logo)" width="102" height="39" border="0">
|
||||
</a> <a href="http://www.hp.com"><img
|
||||
</a> <a href="http://www.hp.com"><img
|
||||
src="images/penquin_in_blue_racer_sm2.gif" alt="" width="120"
|
||||
height="75" border="0">
|
||||
</a><a href="http://www.opera.com"> </a> </font></p>
|
||||
|
||||
</a><a href="http://www.opera.com"> </a> </font></p>
|
||||
|
||||
<p><font size="2">Last updated 5/8/2003 - </font><font size="2"> <a
|
||||
href="support.htm">Tom Eastep</a></font> </p>
|
||||
<font face="Trebuchet MS"><a href="copyright.htm"><font
|
||||
size="2">Copyright</font> © <font size="2">2001, 2002, 2003 Thomas
|
||||
<font face="Trebuchet MS"><a href="copyright.htm"><font
|
||||
size="2">Copyright</font> © <font size="2">2001, 2002, 2003 Thomas
|
||||
M. Eastep.</font></a></font><br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
|
@ -2,420 +2,430 @@
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shoreline Firewall (Shorewall) 1.3</title>
|
||||
|
||||
<base
|
||||
target="_self">
|
||||
|
||||
<base target="_self">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="4"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber3"
|
||||
bgcolor="#4b017c">
|
||||
|
||||
<tbody>
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<tr>
|
||||
|
||||
<td width="100%" height="90">
|
||||
<td width="100%" height="90">
|
||||
|
||||
|
||||
|
||||
|
||||
<h1 align="center"> <font size="4"><i> <a
|
||||
href="http://www.cityofshoreline.com"> <img vspace="4" hspace="4"
|
||||
alt="Shorwall Logo" height="70" width="85" align="left"
|
||||
src="images/washington.jpg" border="0">
|
||||
|
||||
</a></i></font><font color="#ffffff">Shorewall 1.4
|
||||
- <font size="4">"<i>iptables made
|
||||
easy"</i></font></font><br>
|
||||
<a target="_top" href="1.3/index.html"><font
|
||||
</a></i></font><font color="#ffffff">Shorewall 1.4
|
||||
- <font size="4">"<i>iptables made easy"</i></font></font><br>
|
||||
<a target="_top" href="1.3/index.html"><font
|
||||
color="#ffffff"> </font></a><a target="_top"
|
||||
href="http://www1.shorewall.net/1.2/index.htm"><font color="#ffffff"><small><small><small><br>
|
||||
</small></small></small></font></a>
|
||||
</small></small></small></font></a>
|
||||
|
||||
</h1>
|
||||
</td>
|
||||
</tr>
|
||||
</h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<div align="center">
|
||||
<center>
|
||||
|
||||
<div align="center">
|
||||
<center>
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber4">
|
||||
|
||||
<tbody>
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<tr>
|
||||
|
||||
<td width="90%">
|
||||
<td width="90%">
|
||||
|
||||
|
||||
|
||||
|
||||
<h2 align="left">What is it?</h2>
|
||||
|
||||
|
||||
|
||||
|
||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
||||
a <a href="http://www.netfilter.org">Netfilter</a>
|
||||
(iptables) based firewall that can be used
|
||||
on a dedicated firewall system, a multi-function
|
||||
gateway/router/server or on a standalone GNU/Linux system.</p>
|
||||
|
||||
<p>The Shoreline Firewall, more commonly known as "Shorewall", is
|
||||
a <a href="http://www.netfilter.org">Netfilter</a>
|
||||
(iptables) based firewall that can be used
|
||||
on a dedicated firewall system, a multi-function
|
||||
gateway/router/server or on a standalone GNU/Linux system.</p>
|
||||
|
||||
|
||||
|
||||
|
||||
<p>This program is free software; you can redistribute it and/or modify
|
||||
it
|
||||
under the terms of <a
|
||||
href="http://www.gnu.org/licenses/gpl.html">Version 2 of the GNU
|
||||
General Public License</a> as published by the Free Software
|
||||
Foundation.<br>
|
||||
|
||||
<p>This program is free software; you can redistribute it and/or modify
|
||||
it
|
||||
under the terms of <a
|
||||
href="http://www.gnu.org/licenses/gpl.html">Version 2 of the
|
||||
GNU General Public License</a> as published by the Free Software
|
||||
Foundation.<br>
|
||||
|
||||
<br>
|
||||
<br>
|
||||
|
||||
This program is distributed in the hope
|
||||
that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty
|
||||
of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License
|
||||
for more details.<br>
|
||||
This program is distributed in the hope
|
||||
that it will be useful, but WITHOUT ANY
|
||||
WARRANTY; without even the implied warranty
|
||||
of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
PURPOSE. See the GNU General Public License
|
||||
for more details.<br>
|
||||
|
||||
<br>
|
||||
<br>
|
||||
|
||||
You should have received a copy of the
|
||||
GNU General Public License along
|
||||
with this program; if not, write to the Free
|
||||
Software Foundation, Inc., 675 Mass
|
||||
Ave, Cambridge, MA 02139, USA</p>
|
||||
You should have received a copy of the
|
||||
GNU General Public License along
|
||||
with this program; if not, write to the
|
||||
Free Software Foundation, Inc., 675
|
||||
Mass Ave, Cambridge, MA 02139, USA</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p><a href="copyright.htm">Copyright 2001, 2002, 2003 Thomas M. Eastep</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<h2>Running Shorewall on Mandrake with a two-interface setup?</h2>
|
||||
If so, almost <b>NOTHING </b>on this site will apply directly to
|
||||
your setup. If you want to use the documentation that you find here, it
|
||||
is best if you uninstall what you have and install a setup that matches
|
||||
the documentation on this site. See the <a href="two-interface.htm">Two-interface
|
||||
QuickStart Guide</a> for details.<br>
|
||||
|
||||
If so, almost <b>NOTHING </b>on this site will apply directly to
|
||||
your setup. If you want to use the documentation that you find here, it
|
||||
is best if you uninstall what you have and install a setup that matches
|
||||
the documentation on this site. See the <a href="two-interface.htm">Two-interface
|
||||
QuickStart Guide</a> for details.<br>
|
||||
|
||||
<h2>Getting Started with Shorewall</h2>
|
||||
New to Shorewall? Start by selecting the <a
|
||||
href="shorewall_quickstart_guide.htm">QuickStart Guide</a> that most closely
|
||||
New to Shorewall? Start by selecting the <a
|
||||
href="shorewall_quickstart_guide.htm">QuickStart Guide</a> that most closely
|
||||
match your environment and follow the step by step instructions.<br>
|
||||
|
||||
|
||||
|
||||
<h2><b>News</b></h2>
|
||||
<b> </b>
|
||||
<b> </b>
|
||||
|
||||
|
||||
|
||||
|
||||
<p><b>5/29/2003 - Shorewall-1.4.4b</b><b> </b><b><img border="0"
|
||||
src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b></p>
|
||||
|
||||
<p>Groan -- This version corrects a problem whereby the --log-level
|
||||
was not being set when logging via syslog. The most commonly reported symptom
|
||||
was that Shorewall messages were being written to the console even though
|
||||
console logging was correctly configured per <a href="FAQ.htm#faq16">FAQ
|
||||
16</a>.<br>
|
||||
</p>
|
||||
|
||||
<p><b>5/27/2003 - Shorewall-1.4.4a</b><b> </b><b><img border="0"
|
||||
src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b></p>
|
||||
The Fireparse --log-prefix fiasco continues. Tuomo Soini has pointed out
|
||||
that the code in 1.4.4 restricts the length of short zone names to 4 characters.
|
||||
I've produced version 1.4.4a that restores the previous 5-character limit
|
||||
by conditionally omitting the log rule number when the LOGFORMAT doesn't
|
||||
contain '%d'.
|
||||
</b></p>
|
||||
The Fireparse --log-prefix fiasco continues. Tuomo Soini has pointed
|
||||
out that the code in 1.4.4 restricts the length of short zone names to 4
|
||||
characters. I've produced version 1.4.4a that restores the previous 5-character
|
||||
limit by conditionally omitting the log rule number when the LOGFORMAT doesn't
|
||||
contain '%d'.
|
||||
<p><b>5/23/2003 - Shorewall-1.4.4</b><b> </b><b><img border="0"
|
||||
src="images/new10.gif" width="28" height="12" alt="(New)">
|
||||
</b><b> </b></p>
|
||||
I apologize for the rapid-fire releases but since there is a potential
|
||||
configuration change required to go from 1.4.3a to 1.4.4, I decided to make
|
||||
</b><b> </b></p>
|
||||
I apologize for the rapid-fire releases but since there is a potential
|
||||
configuration change required to go from 1.4.3a to 1.4.4, I decided to make
|
||||
it a full release rather than just a bug-fix release. <br>
|
||||
<br>
|
||||
<b> Problems corrected:</b><br>
|
||||
|
||||
<br>
|
||||
<b> Problems corrected:</b><br>
|
||||
|
||||
<blockquote>None.<br>
|
||||
</blockquote>
|
||||
<b> New Features:<br>
|
||||
</b>
|
||||
</blockquote>
|
||||
<b> New Features:<br>
|
||||
</b>
|
||||
<ol>
|
||||
<li>A REDIRECT- rule target has been added. This target behaves
|
||||
for REDIRECT in the same way as DNAT- does for DNAT in that the Netfilter
|
||||
nat table REDIRECT rule is added but not the companion filter table ACCEPT
|
||||
<li>A REDIRECT- rule target has been added. This target behaves
|
||||
for REDIRECT in the same way as DNAT- does for DNAT in that the Netfilter
|
||||
nat table REDIRECT rule is added but not the companion filter table ACCEPT
|
||||
rule.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>The LOGMARKER variable has been renamed LOGFORMAT and has
|
||||
been changed to a 'printf' formatting template which accepts three arguments
|
||||
(the chain name, logging rule number and the disposition). To use LOGFORMAT
|
||||
with fireparse (<a href="http://www.fireparse.com">http://www.fireparse.com</a>),
|
||||
set it as:<br>
|
||||
<br>
|
||||
LOGFORMAT="fp=%s:%d a=%s "<br>
|
||||
<br>
|
||||
<b>CAUTION: </b>/sbin/shorewall uses the leading part of the LOGFORMAT
|
||||
string (up to but not including the first '%') to find log messages in
|
||||
the 'show log', 'status' and 'hits' commands. This part should not be omitted
|
||||
(the LOGFORMAT should not begin with "%") and the leading part should be
|
||||
sufficiently unique for /sbin/shorewall to identify Shorewall messages.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>When logging is specified on a DNAT[-] or REDIRECT[-] rule,
|
||||
the logging now takes place in the nat table rather than in the filter table.
|
||||
This way, only those connections that actually undergo DNAT or redirection
|
||||
will be logged.</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p><b>5/20/2003 - Shorewall-1.4.3a</b><b> </b><b>
|
||||
</b><br>
|
||||
</p>
|
||||
This version primarily corrects the documentation included in the .tgz
|
||||
and in the .rpm. In addition: <br>
|
||||
|
||||
<ol>
|
||||
<li>(This change is in 1.4.3 but is not documented) If you are
|
||||
running iptables 1.2.7a and kernel 2.4.20, then Shorewall will return reject
|
||||
replies as follows:<br>
|
||||
a) tcp - RST<br>
|
||||
b) udp - ICMP port unreachable<br>
|
||||
c) icmp - ICMP host unreachable<br>
|
||||
d) Otherwise - ICMP host prohibited<br>
|
||||
If you are running earlier software, Shorewall will follow it's traditional
|
||||
convention:<br>
|
||||
a) tcp - RST<br>
|
||||
b) Otherwise - ICMP port unreachable</li>
|
||||
<li>UDP port 135 is now silently dropped in the common.def chain.
|
||||
Remember that this chain is traversed just before a DROP or REJECT policy
|
||||
is enforced.<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p><b>5/18/2003 - Shorewall 1.4.3</b><br>
|
||||
</p>
|
||||
<b>Problems Corrected:<br>
|
||||
</b>
|
||||
<ol>
|
||||
<li>There were several cases where Shorewall would fail to
|
||||
remove a temporary directory from /tmp. These cases have been corrected.</li>
|
||||
<li>The rules for allowing all traffic via the loopback interface
|
||||
have been moved to before the rule that drops status=INVALID packets.
|
||||
This insures that all loopback traffic is allowed even if Netfilter connection
|
||||
tracking is confused.</li>
|
||||
|
||||
</ol>
|
||||
<b>New Features:<br>
|
||||
</b>
|
||||
<ol>
|
||||
<li><a href="6to4.htm"> </a><a href="6to4.htm">IPV6-IPV4 (6to4)
|
||||
tunnels </a>are now supported in the /etc/shorewall/tunnels file.</li>
|
||||
<li value="2">You may now change the leading portion of the
|
||||
--log-prefix used by Shorewall using the LOGMARKER variable in shorewall.conf.
|
||||
By default, "Shorewall:" is used.<br>
|
||||
<br>
|
||||
</li>
|
||||
|
||||
<li>The LOGMARKER variable has been renamed LOGFORMAT and has
|
||||
been changed to a 'printf' formatting template which accepts three arguments
|
||||
(the chain name, logging rule number and the disposition). To use LOGFORMAT
|
||||
with fireparse (<a href="http://www.fireparse.com">http://www.fireparse.com</a>),
|
||||
set it as:<br>
|
||||
<br>
|
||||
LOGFORMAT="fp=%s:%d a=%s "<br>
|
||||
<br>
|
||||
<b>CAUTION: </b>/sbin/shorewall uses the leading part of the LOGFORMAT
|
||||
string (up to but not including the first '%') to find log messages in the
|
||||
'show log', 'status' and 'hits' commands. This part should not be omitted
|
||||
(the LOGFORMAT should not begin with "%") and the leading part should be
|
||||
sufficiently unique for /sbin/shorewall to identify Shorewall messages.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>When logging is specified on a DNAT[-] or REDIRECT[-] rule,
|
||||
the logging now takes place in the nat table rather than in the filter table.
|
||||
This way, only those connections that actually undergo DNAT or redirection
|
||||
will be logged.</li>
|
||||
|
||||
</ol>
|
||||
|
||||
|
||||
<p><b>5/20/2003 - Shorewall-1.4.3a</b><b> </b><b>
|
||||
</b><br>
|
||||
</p>
|
||||
This version primarily corrects the documentation included in the .tgz
|
||||
and in the .rpm. In addition: <br>
|
||||
|
||||
<ol>
|
||||
<li>(This change is in 1.4.3 but is not documented) If you
|
||||
are running iptables 1.2.7a and kernel 2.4.20, then Shorewall will return
|
||||
reject replies as follows:<br>
|
||||
a) tcp - RST<br>
|
||||
b) udp - ICMP port unreachable<br>
|
||||
c) icmp - ICMP host unreachable<br>
|
||||
d) Otherwise - ICMP host prohibited<br>
|
||||
If you are running earlier software, Shorewall will follow it's traditional
|
||||
convention:<br>
|
||||
a) tcp - RST<br>
|
||||
b) Otherwise - ICMP port unreachable</li>
|
||||
<li>UDP port 135 is now silently dropped in the common.def
|
||||
chain. Remember that this chain is traversed just before a DROP or REJECT
|
||||
policy is enforced.<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p><b>5/18/2003 - Shorewall 1.4.3</b><br>
|
||||
</p>
|
||||
<b>Problems Corrected:<br>
|
||||
</b>
|
||||
|
||||
<ol>
|
||||
<li>There were several cases where Shorewall would fail to
|
||||
remove a temporary directory from /tmp. These cases have been corrected.</li>
|
||||
<li>The rules for allowing all traffic via the loopback interface
|
||||
have been moved to before the rule that drops status=INVALID packets.
|
||||
This insures that all loopback traffic is allowed even if Netfilter connection
|
||||
tracking is confused.</li>
|
||||
|
||||
</ol>
|
||||
<b>New Features:<br>
|
||||
</b>
|
||||
|
||||
<ol>
|
||||
<li><a href="6to4.htm"> </a><a href="6to4.htm">IPV6-IPV4
|
||||
(6to4) tunnels </a>are now supported in the /etc/shorewall/tunnels file.</li>
|
||||
<li value="2">You may now change the leading portion of the
|
||||
--log-prefix used by Shorewall using the LOGMARKER variable in shorewall.conf.
|
||||
By default, "Shorewall:" is used.<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<p><b>5/10/2003 - Shorewall Mirror in Asia</b><b> </b><br>
|
||||
</p>
|
||||
Ed Greshko has established a mirror in Taiwan -- Thanks Ed!
|
||||
|
||||
|
||||
</p>
|
||||
Ed Greshko has established a mirror in Taiwan -- Thanks Ed!
|
||||
|
||||
|
||||
<p><b>5/8/2003 - Shorewall Mirror in Chile</b><b> </b></p>
|
||||
|
||||
|
||||
|
||||
<p>Thanks to Darcy Ganga, there is now an HTTP mirror in Santiago Chile.<br>
|
||||
</p>
|
||||
</p>
|
||||
|
||||
|
||||
|
||||
<p><b>4/26/2003 - lists.shorewall.net Downtime</b><b> </b></p>
|
||||
|
||||
|
||||
|
||||
<p>The list server will be down this morning for upgrade to RH9.0.<br>
|
||||
</p>
|
||||
</p>
|
||||
|
||||
|
||||
<p><b>4/21/2003 - Samples updated for Shorewall version 1.4.2</b><b>
|
||||
|
||||
<p><b>4/21/2003 - Samples updated for Shorewall version 1.4.2</b><b>
|
||||
</b></p>
|
||||
|
||||
|
||||
<p>Thanks to Francesca Smith, the sample configurations are now upgraded
|
||||
to Shorewall version 1.4.2.</p>
|
||||
|
||||
|
||||
<p><b>4/12/2002 - Greater Seattle Linux Users Group Presentation</b><b>
|
||||
<p>Thanks to Francesca Smith, the sample configurations are now upgraded
|
||||
to Shorewall version 1.4.2.</p>
|
||||
|
||||
|
||||
<p><b>4/12/2002 - Greater Seattle Linux Users Group Presentation</b><b>
|
||||
</b></p>
|
||||
|
||||
|
||||
|
||||
|
||||
<blockquote> This morning, I gave <a href="GSLUG.htm"
|
||||
target="_top">a Shorewall presentation to GSLUG</a>. The presentation
|
||||
is in HTML format but was generated from Microsoft PowerPoint and
|
||||
is best viewed using Internet Explorer (although Konqueror also seems
|
||||
to work reasonably well as does Opera 7.1.0). Neither Opera 6 nor Netscape
|
||||
work well to view the presentation.</blockquote>
|
||||
target="_top">a Shorewall presentation to GSLUG</a>. The presentation
|
||||
is in HTML format but was generated from Microsoft PowerPoint and
|
||||
is best viewed using Internet Explorer (although Konqueror also seems
|
||||
to work reasonably well as does Opera 7.1.0). Neither Opera 6 nor
|
||||
Netscape work well to view the presentation.</blockquote>
|
||||
|
||||
|
||||
|
||||
|
||||
<p><b></b></p>
|
||||
|
||||
<blockquote>
|
||||
|
||||
|
||||
<blockquote>
|
||||
|
||||
<ol>
|
||||
|
||||
|
||||
|
||||
|
||||
</ol>
|
||||
</blockquote>
|
||||
|
||||
|
||||
|
||||
<p><a href="file:///Z:/Shorewall-docs/News.htm"></a></p>
|
||||
<b> </b>
|
||||
|
||||
|
||||
|
||||
</ol>
|
||||
</blockquote>
|
||||
|
||||
|
||||
|
||||
<p><a href="file:///Z:/Shorewall-docs/News.htm"></a></p>
|
||||
<b> </b>
|
||||
|
||||
|
||||
|
||||
<p><b><a href="News.htm">More News</a></b></p>
|
||||
<b> </b>
|
||||
<b> </b>
|
||||
|
||||
|
||||
|
||||
|
||||
<h2><b> </b></h2>
|
||||
<b> </b>
|
||||
<b> </b>
|
||||
|
||||
|
||||
|
||||
|
||||
<p> <a href="http://leaf.sourceforge.net" target="_top"><img
|
||||
border="0" src="images/leaflogo.gif" width="49" height="36"
|
||||
alt="(Leaf Logo)">
|
||||
|
||||
</a>Jacques Nilo and Eric Wolzak have
|
||||
a LEAF (router/firewall/gateway on a floppy,
|
||||
CD or compact flash) distribution called
|
||||
<i>Bering</i> that features
|
||||
Shorewall-1.3.14 and Kernel-2.4.20. You can find
|
||||
their work at: <a
|
||||
</a>Jacques Nilo and Eric Wolzak
|
||||
have a LEAF (router/firewall/gateway on
|
||||
a floppy, CD or compact flash) distribution
|
||||
called <i>Bering</i> that features
|
||||
Shorewall-1.3.14 and Kernel-2.4.20. You
|
||||
can find their work at: <a
|
||||
href="http://leaf.sourceforge.net/devel/jnilo"> http://leaf.sourceforge.net/devel/jnilo</a></p>
|
||||
|
||||
<b>Congratulations to Jacques and Eric
|
||||
on the recent release of Bering 1.2!!! </b><br>
|
||||
|
||||
<b>Congratulations to Jacques and Eric
|
||||
on the recent release of Bering 1.2!!! </b><br>
|
||||
|
||||
|
||||
<h1 align="center"><b><a href="http://www.sf.net"><img
|
||||
align="left" alt="SourceForge Logo"
|
||||
src="http://sourceforge.net/sflogo.php?group_id=22587&type=3">
|
||||
|
||||
</a></b></h1>
|
||||
<b> </b>
|
||||
</a></b></h1>
|
||||
<b> </b>
|
||||
|
||||
|
||||
|
||||
|
||||
<h4><b> </b></h4>
|
||||
<b> </b>
|
||||
<b> </b>
|
||||
|
||||
|
||||
|
||||
|
||||
<h2><b>This site is hosted by the generous folks at <a
|
||||
href="http://www.sf.net">SourceForge.net</a> </b></h2>
|
||||
<b> </b>
|
||||
<b> </b>
|
||||
|
||||
|
||||
|
||||
|
||||
<h2><b><a name="Donations"></a>Donations</b></h2>
|
||||
<b> </b></td>
|
||||
<b> </b></td>
|
||||
|
||||
<td width="88" bgcolor="#4b017c" valign="top"
|
||||
align="center">
|
||||
|
||||
<td width="88" bgcolor="#4b017c" valign="top"
|
||||
align="center">
|
||||
|
||||
<form method="post"
|
||||
action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||
action="http://lists.shorewall.net/cgi-bin/htsearch">
|
||||
|
||||
|
||||
|
||||
<p><strong><br>
|
||||
<font color="#ffffff"><b>Note: </b></font></strong>
|
||||
<font color="#ffffff">Search is unavailable Daily 0200-0330
|
||||
GMT.</font><br>
|
||||
</p>
|
||||
<font color="#ffffff"><b>Note: </b></font></strong>
|
||||
<font color="#ffffff">Search is unavailable Daily 0200-0330
|
||||
GMT.</font><br>
|
||||
</p>
|
||||
|
||||
|
||||
|
||||
<p><font color="#ffffff"><strong>Quick Search</strong></font><br>
|
||||
<font face="Arial" size="-1"> <input
|
||||
<font face="Arial" size="-1"> <input
|
||||
type="text" name="words" size="15"></font><font size="-1"> </font><font
|
||||
face="Arial" size="-1"> <input type="hidden" name="format"
|
||||
value="long"> <input type="hidden" name="method" value="and">
|
||||
<input type="hidden" name="config" value="htdig"> <input
|
||||
value="long"> <input type="hidden" name="method" value="and">
|
||||
<input type="hidden" name="config" value="htdig"> <input
|
||||
type="submit" value="Search"></font> </p>
|
||||
<font face="Arial"> <input
|
||||
<font face="Arial"> <input
|
||||
type="hidden" name="exclude"
|
||||
value="[http://lists.shorewall.net/pipermail/*]"> </font>
|
||||
</form>
|
||||
value="[http://lists.shorewall.net/pipermail/*]"> </font>
|
||||
</form>
|
||||
|
||||
|
||||
|
||||
<p><font color="#ffffff"><b> <a
|
||||
href="http://lists.shorewall.net/htdig/search.html"> <font
|
||||
color="#ffffff">Extended Search</font></a></b></font></p>
|
||||
<a target="_top"
|
||||
href="file:///vfat/Shorewall-docs/1.3/index.html"><font color="#ffffff">
|
||||
</font></a><a target="_top"
|
||||
<a target="_top"
|
||||
href="file:///vfat/Shorewall-docs/1.3/index.html"><font color="#ffffff">
|
||||
</font></a><a target="_top"
|
||||
href="http://www1.shorewall.net/1.2/index.htm"><font color="#ffffff"><small><small><small></small></small></small></font></a><br>
|
||||
</td>
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
</center>
|
||||
</center>
|
||||
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
<table border="0" cellpadding="5" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber2"
|
||||
bgcolor="#4b017c">
|
||||
|
||||
<tbody>
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<tr>
|
||||
|
||||
<td width="100%" style="margin-top: 1px;">
|
||||
<td width="100%" style="margin-top: 1px;">
|
||||
|
||||
|
||||
|
||||
|
||||
<p align="center"><a href="http://www.starlight.org"> <img
|
||||
border="4" src="images/newlog.gif" width="57" height="100" align="left"
|
||||
hspace="10">
|
||||
|
||||
</a></p>
|
||||
</a></p>
|
||||
|
||||
|
||||
|
||||
|
||||
<p align="center"><font size="4" color="#ffffff">Shorewall is free but
|
||||
if you try it and find it useful, please consider making a donation
|
||||
to
|
||||
<a href="http://www.starlight.org"><font color="#ffffff">Starlight
|
||||
Children's Foundation.</font></a> Thanks!</font></p>
|
||||
|
||||
<p align="center"><font size="4" color="#ffffff">Shorewall is free
|
||||
but if you try it and find it useful, please consider making a donation
|
||||
to
|
||||
<a href="http://www.starlight.org"><font color="#ffffff">Starlight
|
||||
Children's Foundation.</font></a> Thanks!</font></p>
|
||||
|
||||
</td>
|
||||
</td>
|
||||
|
||||
</tr>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<p><font size="2">Updated 5/27/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
<br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
<p><font size="2">Updated 5/29/2003 - <a href="support.htm">Tom Eastep</a></font>
|
||||
<br>
|
||||
</p>
|
||||
</body>
|
||||
</html>
|
||||
|
@ -1,81 +1,81 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
|
||||
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
|
||||
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<title>Shorewall Support Guide</title>
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td
|
||||
width="100%">
|
||||
|
||||
<tbody>
|
||||
<tr>
|
||||
<td
|
||||
width="100%">
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Shorewall Support Guide<img
|
||||
src="images/obrasinf.gif" alt="" width="90" height="90" align="middle">
|
||||
</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
<h2>Before Reporting a Problem or Asking a Question<br>
|
||||
</h2>
|
||||
There
|
||||
are a number of sources of Shorewall information. Please try these
|
||||
before you post.
|
||||
</h2>
|
||||
There
|
||||
are a number of sources of Shorewall information. Please try these
|
||||
before you post.
|
||||
<ul>
|
||||
<li>Shorewall versions earlier
|
||||
that 1.3.0 are no longer supported.<br>
|
||||
</li>
|
||||
<li>More than half of the questions posted on the support
|
||||
list have answers directly accessible from the <a
|
||||
href="http://www.shorewall.net/shorewall_quickstart_guide.htm#Documentation">Documentation
|
||||
<li>Shorewall versions earlier
|
||||
that 1.3.0 are no longer supported.<br>
|
||||
</li>
|
||||
<li>More than half of the questions posted on the support
|
||||
list have answers directly accessible from the <a
|
||||
href="http://www.shorewall.net/shorewall_quickstart_guide.htm#Documentation">Documentation
|
||||
Index</a><br>
|
||||
</li>
|
||||
<li>
|
||||
The <a href="http://www.shorewall.net/FAQ.htm">FAQ</a> has
|
||||
solutions to more than 20 common problems. </li>
|
||||
</li>
|
||||
<li>
|
||||
The <a href="http://www.shorewall.net/FAQ.htm">FAQ</a> has
|
||||
solutions to more than 20 common problems. </li>
|
||||
<li> The
|
||||
<a href="http://www.shorewall.net/troubleshoot.htm">Troubleshooting</a>
|
||||
Information contains a number of tips to help
|
||||
you solve common problems. </li>
|
||||
<li> The
|
||||
<a href="http://www.shorewall.net/troubleshoot.htm">Troubleshooting</a>
|
||||
Information contains a number of tips to help
|
||||
you solve common problems. </li>
|
||||
<li> The
|
||||
<a href="http://www.shorewall.net/errata.htm"> Errata</a> has links
|
||||
<a href="http://www.shorewall.net/errata.htm"> Errata</a> has links
|
||||
to download updated components. </li>
|
||||
<li> The Site
|
||||
and Mailing List Archives search facility can locate documents
|
||||
and posts about similar problems: </li>
|
||||
|
||||
<li> The
|
||||
Site and Mailing List Archives search facility can locate
|
||||
documents and posts about similar problems: </li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<h2>Site and Mailing List Archive Search</h2>
|
||||
|
||||
<blockquote>
|
||||
|
||||
<blockquote>
|
||||
<form method="post"
|
||||
action="http://lists.shorewall.net/cgi-bin/htsearch"> <font size="-1"> Match:
|
||||
|
||||
action="http://lists.shorewall.net/cgi-bin/htsearch"> <font size="-1"> Match:
|
||||
|
||||
<select name="method">
|
||||
<option value="and">All </option>
|
||||
<option value="or">Any </option>
|
||||
<option value="boolean">Boolean </option>
|
||||
</select>
|
||||
Format:
|
||||
|
||||
Format:
|
||||
|
||||
<select name="format">
|
||||
<option value="builtin-long">Long </option>
|
||||
<option value="builtin-short">Short </option>
|
||||
</select>
|
||||
Sort by:
|
||||
|
||||
Sort by:
|
||||
|
||||
<select name="sort">
|
||||
<option value="score">Score </option>
|
||||
<option value="time">Time </option>
|
||||
@ -84,233 +84,235 @@ solutions to more than 20 common problems. </li>
|
||||
<option value="revtime">Reverse Time </option>
|
||||
<option value="revtitle">Reverse Title </option>
|
||||
</select>
|
||||
</font><input type="hidden" name="config"
|
||||
</font><input type="hidden" name="config"
|
||||
value="htdig"><input type="hidden" name="restrict" value=""><font
|
||||
size="-1"> Include Mailing List Archives:
|
||||
|
||||
size="-1"> Include Mailing List Archives:
|
||||
|
||||
<select size="1" name="exclude">
|
||||
<option value="">Yes</option>
|
||||
<option value="[http://lists.shorewall.net/pipermail/.*]">No</option>
|
||||
</select>
|
||||
</font><br>
|
||||
Search: <input type="text" size="30" name="words"
|
||||
</font><br>
|
||||
Search: <input type="text" size="30" name="words"
|
||||
value=""> <input type="submit" value="Search"><br>
|
||||
</form>
|
||||
</blockquote>
|
||||
|
||||
</form>
|
||||
</blockquote>
|
||||
|
||||
<h2>Problem Reporting Guidelines<br>
|
||||
</h2>
|
||||
|
||||
</h2>
|
||||
|
||||
<ul>
|
||||
<li>Please remember we only know what
|
||||
is posted in your message. Do not leave out any information
|
||||
that appears to be correct, or was mentioned in a previous post.
|
||||
There have been countless posts by people who were sure that
|
||||
some part of their configuration was correct when it actually
|
||||
contained a small error. We tend to be skeptics where detail is
|
||||
lacking.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Please keep in mind that you're
|
||||
asking for <strong>free</strong> technical support. Any
|
||||
help we offer is an act of generosity, not an obligation. Try
|
||||
to make it easy for us to help you. Follow good, courteous practices
|
||||
in writing and formatting your e-mail. Provide details that we need
|
||||
if you expect good answers. <em>Exact quoting </em> of error messages,
|
||||
log entries, command output, and other output is better than a paraphrase
|
||||
or summary.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>
|
||||
Please don't describe your environment and then ask us
|
||||
to send you custom configuration files. We're here
|
||||
to answer your questions but we can't do your
|
||||
job for you.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>When reporting a problem, <strong>ALWAYS</strong>
|
||||
<li>Please remember we only know what
|
||||
is posted in your message. Do not leave out any information
|
||||
that appears to be correct, or was mentioned in a previous
|
||||
post. There have been countless posts by people who were sure
|
||||
that some part of their configuration was correct when it actually
|
||||
contained a small error. We tend to be skeptics where detail
|
||||
is lacking.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Please keep in mind that you're
|
||||
asking for <strong>free</strong> technical support.
|
||||
Any help we offer is an act of generosity, not an obligation.
|
||||
Try to make it easy for us to help you. Follow good, courteous
|
||||
practices in writing and formatting your e-mail. Provide details that
|
||||
we need if you expect good answers. <em>Exact quoting </em> of
|
||||
error messages, log entries, command output, and other output is better
|
||||
than a paraphrase or summary.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>
|
||||
Please don't describe your environment and then ask
|
||||
us to send you custom configuration files. We're
|
||||
here to answer your questions but we can't do
|
||||
your job for you.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>When reporting a problem, <strong>ALWAYS</strong>
|
||||
include this information:</li>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<ul>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>the exact version of Shorewall
|
||||
<li>the exact version of Shorewall
|
||||
you are running.<br>
|
||||
<br>
|
||||
<b><font color="#009900">shorewall
|
||||
<br>
|
||||
<b><font color="#009900">shorewall
|
||||
version</font><br>
|
||||
</b> <br>
|
||||
</li>
|
||||
|
||||
</b> <br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>the exact kernel version you
|
||||
<li>the exact kernel version you
|
||||
are running<br>
|
||||
<br>
|
||||
<font color="#009900"><b>uname
|
||||
<br>
|
||||
<font color="#009900"><b>uname
|
||||
-a<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
|
||||
<br>
|
||||
</b></font></li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>the complete, exact output of<br>
|
||||
<br>
|
||||
<font color="#009900"><b>ip addr
|
||||
<li>the complete, exact output of<br>
|
||||
<br>
|
||||
<font color="#009900"><b>ip addr
|
||||
show<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
|
||||
<br>
|
||||
</b></font></li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>the complete, exact output of<br>
|
||||
<br>
|
||||
<font color="#009900"><b>ip route
|
||||
show<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
|
||||
<li>the complete, exact output of<br>
|
||||
<br>
|
||||
<font color="#009900"><b>ip route
|
||||
show<br>
|
||||
<br>
|
||||
</b></font></li>
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<ul>
|
||||
<li>If your kernel is modularized,
|
||||
<li>If your kernel is modularized,
|
||||
the exact output from<br>
|
||||
<br>
|
||||
<font color="#009900"><b>lsmod</b></font><br>
|
||||
</li>
|
||||
<br>
|
||||
<font color="#009900"><b>lsmod</b></font><br>
|
||||
</li>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<ul>
|
||||
|
||||
|
||||
<ul>
|
||||
<li><font color="#ff0000"><u><i><big><b>If you are having connection
|
||||
problems of any kind then:</b></big></i></u></font><br>
|
||||
<br>
|
||||
1. <b><font color="#009900">/sbin/shorewall/reset</font></b><br>
|
||||
<br>
|
||||
2. Try the connection that is failing.<br>
|
||||
<br>
|
||||
3.<b><font color="#009900"> /sbin/shorewall status
|
||||
> /tmp/status.txt</font></b><br>
|
||||
<br>
|
||||
4. Post the /tmp/status.txt file as an attachment.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>the exact wording of any <code
|
||||
style="color: green; font-weight: bold;">ping</code> failure responses<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>If you installed Shorewall using one of the QuickStart
|
||||
Guides, please indicate which one. <br>
|
||||
<br>
|
||||
</li>
|
||||
<li><b>If you are running Shorewall under Mandrake using
|
||||
the Mandrake installation of Shorewall, please say so.<br>
|
||||
<br>
|
||||
</b></li>
|
||||
|
||||
</ul>
|
||||
<li>As
|
||||
a general matter, please <strong>do not edit the diagnostic
|
||||
information</strong> in an attempt to conceal your IP address,
|
||||
netmask, nameserver addresses, domain name, etc. These aren't
|
||||
secrets, and concealing them often misleads us (and 80% of the time,
|
||||
a hacker could derive them anyway from information contained in
|
||||
the SMTP headers of your post).<br>
|
||||
<br>
|
||||
<strong></strong></li>
|
||||
<li>Do you see any "Shorewall" messages ("<b><font
|
||||
color="#009900">/sbin/shorewall show log</font></b>") when
|
||||
you exercise the function that is giving you problems? If
|
||||
so, include the message(s) in your post along with a copy of your
|
||||
/etc/shorewall/interfaces file.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Please include any of the Shorewall configuration
|
||||
files (especially the /etc/shorewall/hosts file
|
||||
if you have modified that file) that you think are
|
||||
relevant. If you include /etc/shorewall/rules, please include
|
||||
/etc/shorewall/policy as well (rules are meaningless unless
|
||||
one also knows the policies).<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>If an error occurs when you try to "<font
|
||||
color="#009900"><b>shorewall start</b></font>", include a trace
|
||||
(See the <a href="http://www.shorewall.net/troubleshoot.htm">Troubleshooting</a>
|
||||
section for instructions).<br>
|
||||
<br>
|
||||
</li>
|
||||
<li><b>The list server limits posts to 120kb so don't
|
||||
post GIFs of your network layout, etc.
|
||||
to the Mailing List -- your post will be rejected.</b></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote> The author gratefully acknowleges that the above list was
|
||||
heavily plagiarized from the excellent LEAF document by <i>Ray</i>
|
||||
<em>Olszewski</em> found at <a
|
||||
href="http://leaf-project.org/pub/doc/docmanager/docid_1891.html">http://leaf-project.org/pub/doc/docmanager/docid_1891.html</a>.<br>
|
||||
</blockquote>
|
||||
|
||||
<h2>When using the mailing list, please post in plain text</h2>
|
||||
|
||||
<blockquote> A growing number of MTAs serving list subscribers are rejecting
|
||||
all HTML traffic. At least one MTA has gone so far as to blacklist
|
||||
shorewall.net "for continuous abuse" because it has been my policy
|
||||
to allow HTML in list posts!!<br>
|
||||
<li><font color="#ff0000"><u><i><big><b>If you are having
|
||||
connection problems of any kind then:</b></big></i></u></font><br>
|
||||
<br>
|
||||
1. <b><font color="#009900">/sbin/shorewall reset</font></b><br>
|
||||
<br>
|
||||
2. Try the connection that is failing.<br>
|
||||
<br>
|
||||
3.<b><font color="#009900"> /sbin/shorewall status
|
||||
> /tmp/status.txt</font></b><br>
|
||||
<br>
|
||||
4. Post the /tmp/status.txt file as an attachment.<br>
|
||||
<br>
|
||||
I think that blocking all HTML is
|
||||
a Draconian way to control spam and that the ultimate losers
|
||||
here are not the spammers but the list subscribers whose
|
||||
MTAs are bouncing all shorewall.net mail. As one list subscriber
|
||||
wrote to me privately "These e-mail admin's need to get a <i>(expletive
|
||||
deleted)</i> life instead of trying to rid the planet of HTML
|
||||
based e-mail". Nevertheless, to allow subscribers to receive
|
||||
list posts as must as possible, I have now configured the list
|
||||
server at shorewall.net to strip all HTML from outgoing posts.<br>
|
||||
</li>
|
||||
<li>the exact wording of any <code
|
||||
style="color: green; font-weight: bold;">ping</code> failure responses<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>If you installed Shorewall using one of the QuickStart
|
||||
Guides, please indicate which one. <br>
|
||||
<br>
|
||||
</li>
|
||||
<li><b>If you are running Shorewall under Mandrake using
|
||||
the Mandrake installation of Shorewall, please say so.<br>
|
||||
<br>
|
||||
</b></li>
|
||||
|
||||
</ul>
|
||||
<li>As
|
||||
a general matter, please <strong>do not edit the diagnostic
|
||||
information</strong> in an attempt to conceal your IP address,
|
||||
netmask, nameserver addresses, domain name, etc. These aren't
|
||||
secrets, and concealing them often misleads us (and 80% of the time,
|
||||
a hacker could derive them anyway from information contained in
|
||||
the SMTP headers of your post).<br>
|
||||
<br>
|
||||
<strong></strong></li>
|
||||
<li>Do you see any "Shorewall" messages ("<b><font
|
||||
color="#009900">/sbin/shorewall show log</font></b>") when
|
||||
you exercise the function that is giving you problems? If so,
|
||||
include the message(s) in your post along with a copy of your /etc/shorewall/interfaces
|
||||
file.<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>Please include any of the Shorewall configuration
|
||||
files (especially the /etc/shorewall/hosts file
|
||||
if you have modified that file) that you think are
|
||||
relevant. If you include /etc/shorewall/rules, please include
|
||||
/etc/shorewall/policy as well (rules are meaningless unless one
|
||||
also knows the policies).<br>
|
||||
<br>
|
||||
</li>
|
||||
<li>If an error occurs when you try to "<font
|
||||
color="#009900"><b>shorewall start</b></font>", include a trace
|
||||
(See the <a href="http://www.shorewall.net/troubleshoot.htm">Troubleshooting</a>
|
||||
section for instructions).<br>
|
||||
<br>
|
||||
</li>
|
||||
<li><b>The list server limits posts to 120kb so don't
|
||||
post GIFs of your network layout, etc.
|
||||
to the Mailing List -- your post will be rejected.</b></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<blockquote> The author gratefully acknowleges that the above list was
|
||||
heavily plagiarized from the excellent LEAF document by <i>Ray</i>
|
||||
<em>Olszewski</em> found at <a
|
||||
href="http://leaf-project.org/pub/doc/docmanager/docid_1891.html">http://leaf-project.org/pub/doc/docmanager/docid_1891.html</a>.<br>
|
||||
</blockquote>
|
||||
|
||||
|
||||
<h2>When using the mailing list, please post in plain text</h2>
|
||||
|
||||
<blockquote> A growing number of MTAs serving list subscribers are
|
||||
rejecting all HTML traffic. At least one MTA has gone so far as to
|
||||
blacklist shorewall.net "for continuous abuse" because it has been
|
||||
my policy to allow HTML in list posts!!<br>
|
||||
<br>
|
||||
I think that blocking all HTML
|
||||
is a Draconian way to control spam and that the ultimate
|
||||
losers here are not the spammers but the list subscribers
|
||||
whose MTAs are bouncing all shorewall.net mail. As one list subscriber
|
||||
wrote to me privately "These e-mail admin's need to get a <i>(expletive
|
||||
deleted)</i> life instead of trying to rid the planet of HTML based
|
||||
e-mail". Nevertheless, to allow subscribers to receive list posts
|
||||
as must as possible, I have now configured the list server at
|
||||
shorewall.net to strip all HTML from outgoing posts.<br>
|
||||
</blockquote>
|
||||
|
||||
<h2>Where to Send your Problem Report or to Ask for Help</h2>
|
||||
|
||||
<blockquote>
|
||||
|
||||
<blockquote>
|
||||
<h4>If you run Shorewall under Bering -- <span
|
||||
style="font-weight: 400;">please post your question or problem
|
||||
style="font-weight: 400;">please post your question or problem
|
||||
to the <a
|
||||
href="mailto:leaf-user@lists.sourceforge.net">LEAF Users mailing
|
||||
href="mailto:leaf-user@lists.sourceforge.net">LEAF Users mailing
|
||||
list</a>.</span></h4>
|
||||
<b>If you run Shorewall under MandrakeSoft
|
||||
Multi Network Firewall (MNF) and you have not purchased
|
||||
an MNF license from MandrakeSoft then you can post non MNF-specific
|
||||
<b>If you run Shorewall under MandrakeSoft
|
||||
Multi Network Firewall (MNF) and you have not purchased
|
||||
an MNF license from MandrakeSoft then you can post non MNF-specific
|
||||
Shorewall questions to the </b><a
|
||||
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
||||
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
||||
list</a>. <b>Do not expect to get free MNF support on the list.</b><br>
|
||||
|
||||
|
||||
<p>Otherwise, please post your question or problem to the <a
|
||||
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
||||
href="mailto:shorewall-users@lists.shorewall.net">Shorewall users mailing
|
||||
list</a> .</p>
|
||||
|
||||
|
||||
<p> To Subscribe to the mailing list go to <a
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-users">http://lists.shorewall.net/mailman/listinfo/shorewall-users</a>
|
||||
href="http://lists.shorewall.net/mailman/listinfo/shorewall-users">http://lists.shorewall.net/mailman/listinfo/shorewall-users</a>
|
||||
.<br>
|
||||
</p>
|
||||
</blockquote>
|
||||
|
||||
</p>
|
||||
</blockquote>
|
||||
|
||||
<p>For information on other Shorewall mailing lists, go to <a
|
||||
href="http://lists.shorewall.net">http://lists.shorewall.net</a><br>
|
||||
</p>
|
||||
|
||||
<p align="left"><font size="2">Last Updated 5/19/2003 - Tom Eastep</font></p>
|
||||
|
||||
</p>
|
||||
|
||||
<p align="left"><font size="2">Last Updated 5/28/2003 - Tom Eastep</font></p>
|
||||
|
||||
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
||||
size="2">Copyright</font> © <font size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a></font><br>
|
||||
</p>
|
||||
</p>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
@ -28,7 +28,7 @@
|
||||
# shown below. Simply run this script to revert to your prior version of
|
||||
# Shoreline Firewall.
|
||||
|
||||
VERSION=1.4.4a
|
||||
VERSION=1.4.4b
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
|
@ -926,7 +926,7 @@ log_rule() # $1 = log level, $2 = chain, $3 = disposition , $... = predicates fo
|
||||
eval iptables -A $chain $@ -j ULOG $LOGPARMS --ulog-prefix '"`printf "$LOGFORMAT" $chain $rulenum $disposition`"'
|
||||
;;
|
||||
*)
|
||||
eval iptables -A $chain $@ -j LOG $LOGPARMS --log-prefix '"`printf "$LOGFORMAT" $chain $rulenum $disposition`"'
|
||||
eval iptables -A $chain $@ -j LOG $LOGPARMS --log-level $level --log-prefix '"`printf "$LOGFORMAT" $chain $rulenum $disposition`"'
|
||||
;;
|
||||
esac
|
||||
|
||||
@ -943,7 +943,7 @@ log_rule() # $1 = log level, $2 = chain, $3 = disposition , $... = predicates fo
|
||||
eval iptables -A $chain $@ -j ULOG $LOGPARMS --ulog-prefix '"`printf "$LOGFORMAT" $chain $disposition`"'
|
||||
;;
|
||||
*)
|
||||
eval iptables -A $chain $@ -j LOG $LOGPARMS --log-prefix '"`printf "$LOGFORMAT" $chain $disposition`"'
|
||||
eval iptables -A $chain $@ -j LOG $LOGPARMS --log-level $level --log-prefix '"`printf "$LOGFORMAT" $chain $disposition`"'
|
||||
;;
|
||||
esac
|
||||
|
||||
|
@ -54,7 +54,7 @@
|
||||
# /etc/rc.d/rc.local file is modified to start the firewall.
|
||||
#
|
||||
|
||||
VERSION=1.4.4a
|
||||
VERSION=1.4.4b
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
|
@ -1,5 +1,5 @@
|
||||
%define name shorewall
|
||||
%define version 1.4.4a
|
||||
%define version 1.4.4b
|
||||
%define release 1
|
||||
%define prefix /usr
|
||||
|
||||
@ -105,6 +105,8 @@ fi
|
||||
%doc COPYING INSTALL changelog.txt releasenotes.txt tunnel
|
||||
|
||||
%changelog
|
||||
* Thu May 29 2003 Tom Eastep <tom@shorewall.net>
|
||||
- Changed version to 1.4.4b-1
|
||||
* Tue May 27 2003 Tom Eastep <tom@shorewall.net>
|
||||
- Changed version to 1.4.4a-1
|
||||
* Thu May 22 2003 Tom Eastep <tom@shorewall.net>
|
||||
|
@ -26,7 +26,7 @@
|
||||
# You may only use this script to uninstall the version
|
||||
# shown below. Simply run this script to remove Seattle Firewall
|
||||
|
||||
VERSION=1.4.4a
|
||||
VERSION=1.4.4b
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
|
Loading…
Reference in New Issue
Block a user