mirror of
https://gitlab.com/shorewall/code.git
synced 2025-06-25 12:13:29 +02:00
Some post-1.2.12 documentation cleanup
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@389 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
4710fc7bdb
commit
2565081ff9
@ -755,7 +755,7 @@ in both the SOURCE and DEST columns.</li>
|
||||
<li> <b> LOG LEVEL</b> - Optional.
|
||||
If left empty, no log message is generated when the policy is applied.
|
||||
Otherwise, this column should contain an integer or name indicating
|
||||
a <a href="configuration_file_basics.htm#Levels">syslog level</a>.</li>
|
||||
a <a href="shorewall_logging.html">syslog level</a>.</li>
|
||||
|
||||
<li> <b>LIMIT:BURST </b>- Optional.
|
||||
If left empty, TCP connection requests from the <b>SOURCE</b> zone
|
||||
@ -1251,7 +1251,7 @@ here as in the policy file above.</li>
|
||||
</ul>
|
||||
|
||||
<p>The ACTION may optionally be followed by ":" and a <a
|
||||
href="file:///home/teastep/Shorewall-docs/configuration_file_basics.htm#Levels">syslog
|
||||
href="shorewall_logging.html">syslog
|
||||
level</a> (example: REJECT:info). This causes the packet to be logged
|
||||
at the specified level prior to being processed according to the specified
|
||||
ACTION.<br>
|
||||
@ -2243,7 +2243,7 @@ is assumed.<br>
|
||||
This parameter determines the level at which packets logged under the <a
|
||||
href="file:///home/teastep/Shorewall-docs/Documentation.htm#rfc1918">'norfc1918'
|
||||
mechanism </a> are logged. The value must be a valid <a
|
||||
href="file:///home/teastep/Shorewall-docs/configuration_file_basics.htm#Levels">syslog
|
||||
href="shorewall_logging.html">syslog
|
||||
level</a> and if no level is given, then info is assumed. Prior to Shorewall
|
||||
version 1.3.12, these packets are always logged at the info level.</li>
|
||||
<li><b>TCP_FLAGS_DISPOSITION - </b>Added in Version 1.3.11<br>
|
||||
@ -2254,7 +2254,7 @@ DROP (ignore the packet). If not set or if set to the empty value (e.g.,
|
||||
TCP_FLAGS_DISPOSITION="") then TCP_FLAGS_DISPOSITION=DROP is assumed.</li>
|
||||
<li><b>TCP_FLAGS_LOG_LEVEL - </b>Added in Version 1.3.11<br>
|
||||
Determines the <a
|
||||
href="file:///home/teastep/Shorewall-docs/configuration_file_basics.htm#Levels">syslog
|
||||
href="shorewall_logging.html">syslog
|
||||
level</a> for logging packets that fail the checks enabled by the <a
|
||||
href="#Interfaces">tcpflags</a> interface option.The value must be a valid
|
||||
syslogd log level. If you don't want to log these packets, set to the empty
|
||||
@ -2268,7 +2268,7 @@ or DROP (ignore the connection request). If not set or if set to the empty
|
||||
value (e.g., MACLIST_DISPOSITION="") then MACLIST_DISPOSITION=REJECT is assumed.</li>
|
||||
<li><b>MACLIST_LOG_LEVEL </b>- Added in Version 1.3.10<br>
|
||||
Determines the <a
|
||||
href="file:///home/teastep/Shorewall-docs/configuration_file_basics.htm#Levels">syslog
|
||||
href="shorewall_logging.html">syslog
|
||||
level</a> for logging connection requests that fail <a
|
||||
href="MAC_Validation.html">MAC Verification</a>. The value must be a valid
|
||||
syslogd log level. If you don't want to log these connection requests, set
|
||||
@ -2295,7 +2295,7 @@ unless they are handled by an explicit entry in the <a
|
||||
Beginning with version 1.3.6, Shorewall drops non-SYN TCP
|
||||
packets that are not part of an existing connection. If you would
|
||||
like to log these packets, set LOGNEWNOTSYN to the <a
|
||||
href="file:///home/teastep/Shorewall-docs/configuration_file_basics.htm#Levels">syslog
|
||||
href="shorewall_logging.html">syslog
|
||||
level</a> at which you want the packets logged. Example: LOGNEWNOTSYN=ULOG|<br>
|
||||
<br>
|
||||
<b>Note: </b>Packets logged under this option are usually
|
||||
@ -2612,7 +2612,7 @@ assumed.</li>
|
||||
at. Its
|
||||
value
|
||||
is a <a
|
||||
href="file:///home/teastep/Shorewall-docs/configuration_file_basics.htm#Levels">syslog
|
||||
href="shorewall_logging.html">syslog
|
||||
level</a>
|
||||
(Example:
|
||||
BLACKLIST_LOGLEVEL=debug).
|
||||
|
||||
@ -616,7 +616,7 @@ see "man syslog") in your <a href="Documentation.htm#Policy">policies</a>
|
||||
|
||||
<div align="left">
|
||||
<pre align="left"> LOGLIMIT=""<br> LOGBURST=""<br><br>Beginning with Shorewall version 1.3.12, you can <a
|
||||
href="configuration_file_basics.htm#Levels">set up Shorewall to log all of its messages to a separate file</a>.<br></pre>
|
||||
href="shorewall_logging.html">set up Shorewall to log all of its messages to a separate file</a>.<br></pre>
|
||||
</div>
|
||||
|
||||
<h4 align="left"><a name="faq6a"></a>6a. Are there any log parsers that work
|
||||
|
||||
@ -13,99 +13,98 @@
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber4"
|
||||
bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<h1 align="center"><font color="#ffffff">MAC Verification</font><br>
|
||||
</h1>
|
||||
<br>
|
||||
</td>
|
||||
</tr>
|
||||
</h1>
|
||||
<br>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
Beginning with Shorewall version 1.3.10, all traffic from an interface
|
||||
<br>
|
||||
Beginning with Shorewall version 1.3.10, all traffic from an interface
|
||||
or from a subnet on an interface can be verified to originate from a defined
|
||||
set of MAC addresses. Furthermore, each MAC address may be optionally associated
|
||||
with one or more IP addresses. <br>
|
||||
<br>
|
||||
<b>You must have the iproute package (ip utility) installed to use MAC Verification.</b><br>
|
||||
<br>
|
||||
There are four components to this facility.<br>
|
||||
<br>
|
||||
<b>You must have the iproute package (ip utility) installed to use MAC Verification
|
||||
and your kernel must include MAC match support (CONFIG_IP_NF_MATCH_MAC -
|
||||
module name ipt_mac.o).</b><br>
|
||||
<br>
|
||||
There are four components to this facility.<br>
|
||||
|
||||
<ol>
|
||||
<li>The <b>maclist</b> interface option in <a
|
||||
href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>. When
|
||||
this option is specified, all traffic arriving on the interface is subjet
|
||||
to MAC verification.</li>
|
||||
<li>The <b>maclist </b>option in <a href="Documentation.htm#Hosts">/etc/shorewall/hosts</a>.
|
||||
When this option is specified for a subnet, all traffic from that subnet
|
||||
is subject to MAC verification.</li>
|
||||
<li>The /etc/shorewall/maclist file. This file is used to associate
|
||||
MAC addresses with interfaces and to optionally associate IP addresses with
|
||||
MAC addresses.</li>
|
||||
<li>The <b>MACLIST_DISPOSITION </b>and <b>MACLIST_LOG_LEVEL </b>variables
|
||||
in <a href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf.</a>
|
||||
The MACLIST_DISPOSITION variable has the value DROP, REJECT or ACCEPT and
|
||||
determines the disposition of connection requests that fail MAC verification.
|
||||
The MACLIST_LOG_LEVEL variable gives the syslogd level at which connection
|
||||
requests that fail verification are to be logged. If set the the empty value
|
||||
(e.g., MACLIST_LOG_LEVEL="") then failing connection requests are not logged.<br>
|
||||
</li>
|
||||
<li>The <b>maclist</b> interface option in <a
|
||||
href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>. When this
|
||||
option is specified, all traffic arriving on the interface is subjet to MAC
|
||||
verification.</li>
|
||||
<li>The <b>maclist </b>option in <a
|
||||
href="Documentation.htm#Hosts">/etc/shorewall/hosts</a>. When this option
|
||||
is specified for a subnet, all traffic from that subnet is subject to MAC
|
||||
verification.</li>
|
||||
<li>The /etc/shorewall/maclist file. This file is used to associate
|
||||
MAC addresses with interfaces and to optionally associate IP addresses
|
||||
with MAC addresses.</li>
|
||||
<li>The <b>MACLIST_DISPOSITION </b>and <b>MACLIST_LOG_LEVEL </b>variables
|
||||
in <a href="Documentation.htm#Conf">/etc/shorewall/shorewall.conf.</a> The
|
||||
MACLIST_DISPOSITION variable has the value DROP, REJECT or ACCEPT and determines
|
||||
the disposition of connection requests that fail MAC verification. The
|
||||
MACLIST_LOG_LEVEL variable gives the syslogd level at which connection requests
|
||||
that fail verification are to be logged. If set the the empty value (e.g.,
|
||||
MACLIST_LOG_LEVEL="") then failing connection requests are not logged.<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
The columns in /etc/shorewall/maclist are:<br>
|
||||
The columns in /etc/shorewall/maclist are:<br>
|
||||
|
||||
<ul>
|
||||
<li>INTERFACE - The name of an ethernet interface on the Shorewall
|
||||
<li>INTERFACE - The name of an ethernet interface on the Shorewall
|
||||
system.</li>
|
||||
<li>MAC - The MAC address of a device on the ethernet segment connected
|
||||
<li>MAC - The MAC address of a device on the ethernet segment connected
|
||||
by INTERFACE. It is not necessary to use the Shorewall MAC format in this
|
||||
column although you may use that format if you so choose.</li>
|
||||
<li>IP Address - An optional comma-separated list of IP addresses for
|
||||
the device whose MAC is listed in the MAC column.</li>
|
||||
<li>IP Address - An optional comma-separated list of IP addresses
|
||||
for the device whose MAC is listed in the MAC column.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3>Example 1: Here are my files:</h3>
|
||||
<b>/etc/shorewall/shorewall.conf:<br>
|
||||
</b>
|
||||
<b>/etc/shorewall/shorewall.conf:<br>
|
||||
</b>
|
||||
<pre> MACLIST_DISPOSITION=REJECT<br> MACLIST_LOG_LEVEL=info<br></pre>
|
||||
<b>/etc/shorewall/interfaces:</b><br>
|
||||
<b>/etc/shorewall/interfaces:</b><br>
|
||||
|
||||
<pre> #ZONE INTERFACE BROADCAST OPTIONS<br> net eth0 206.124.146.255 norfc1918,filterping,dhcp,blacklist<br> loc eth2 192.168.1.255 dhcp,filterping,maclist<br> dmz eth1 192.168.2.255 filterping<br> net eth3 206.124.146.255 filterping,blacklist<br> - texas 192.168.9.255 filterping<br> loc ppp+ - filterping<br></pre>
|
||||
<b>/etc/shorewall/maclist:</b><br>
|
||||
<b>/etc/shorewall/maclist:</b><br>
|
||||
|
||||
<pre> #INTERFACE MAC IP ADDRESSES (Optional)<br> eth2 00:A0:CC:63:66:89 192.168.1.3 #Wookie<br> eth2 00:10:B5:EC:FD:0B 192.168.1.4 #Tarry<br> eth2 00:A0:CC:DB:31:C4 192.168.1.5 #Ursa<br> eth2 00:06:25:aa:a8:0f 192.168.1.7 #Eastept1 (Wireless)<br> eth2 00:04:5A:0E:85:B9 192.168.1.250 #Wap<br></pre>
|
||||
As shown above, I use MAC Verification on <a href="myfiles.htm">my local
|
||||
As shown above, I use MAC Verification on <a href="myfiles.htm">my local
|
||||
zone</a>.<br>
|
||||
|
||||
<h3>Example 2: Router in Local Zone</h3>
|
||||
Suppose now that I add a second ethernet segment to my local zone and
|
||||
gateway that segment via a router with MAC address 00:06:43:45:C6:15 and
|
||||
IP address 192.168.1.253. Hosts in the second segment have IP addresses in
|
||||
the subnet 192.168.2.0/24. I would add the following entry to my /etc/shorewall/maclist
|
||||
Suppose now that I add a second ethernet segment to my local zone and
|
||||
gateway that segment via a router with MAC address 00:06:43:45:C6:15 and
|
||||
IP address 192.168.1.253. Hosts in the second segment have IP addresses
|
||||
in the subnet 192.168.2.0/24. I would add the following entry to my /etc/shorewall/maclist
|
||||
file:<br>
|
||||
|
||||
<pre> eth2 00:06:43:45:C6:15 192.168.1.253,192.168.2.0/24<br></pre>
|
||||
This entry accomodates traffic from the router itself (192.168.1.253)
|
||||
and from the second LAN segment (192.168.2.0/24). Remember that all traffic
|
||||
This entry accomodates traffic from the router itself (192.168.1.253)
|
||||
and from the second LAN segment (192.168.2.0/24). Remember that all traffic
|
||||
being sent to my firewall from the 192.168.2.0/24 segment will be forwarded
|
||||
by the router so that traffic's MAC address will be that of the router (00:06:43:45:C6:15)
|
||||
and not that of the host sending the traffic.
|
||||
<p><font size="2"> Updated 12/22/2002 - <a href="support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
<p><font size="2"> Updated 12/29/2002 - <a href="support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
|
||||
|
||||
|
||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||
© <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font></p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
|
||||
@ -52,7 +52,7 @@ the current packet classification filters. The output from this command is
|
||||
the LOG target. This allows you to run ulogd (available from <a
|
||||
href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
||||
and log all Shorewall messages <a
|
||||
href="configuration_file_basics.htm#Levels">to a separate log file</a>.</li>
|
||||
href="shorewall_logging.html">to a separate log file</a>.</li>
|
||||
<li>If you are running a kernel that has a FORWARD chain in the mangle
|
||||
table ("shorewall show mangle" will show you the chains in the mangle table),
|
||||
you can set MARK_IN_FORWARD_CHAIN=Yes in <a
|
||||
@ -98,7 +98,7 @@ is also added as a separate page in "shorewall monitor"</li>
|
||||
than the LOG target. This allows you to run ulogd (available from <a
|
||||
href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
||||
and log all Shorewall messages <a
|
||||
href="configuration_file_basics.htm#Levels">to a separate log file</a>.</li>
|
||||
href="shorewall_logging.html">to a separate log file</a>.</li>
|
||||
<li>If you are running a kernel that has a FORWARD chain in the mangle
|
||||
table ("shorewall show mangle" will show you the chains in the mangle table),
|
||||
you can set MARK_IN_FORWARD_CHAIN=Yes in shorewall.conf. This allows for
|
||||
|
||||
@ -17,73 +17,73 @@
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Configuration Files</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<p><b><font color="#ff0000">Warning: </font>If you copy or edit your
|
||||
configuration files on a system running Microsoft Windows, you <u>must</u>
|
||||
run them through <a
|
||||
configuration files on a system running Microsoft Windows, you <u>must</u>
|
||||
run them through <a
|
||||
href="http://www.megaloman.com/%7Ehany/software/hd2u/"> dos2unix</a>
|
||||
before you use them with Shorewall.</b></p>
|
||||
before you use them with Shorewall.</b></p>
|
||||
|
||||
<h2>Files</h2>
|
||||
<h2><a name="Files"></a>Files</h2>
|
||||
|
||||
<p>Shorewall's configuration files are in the directory /etc/shorewall.</p>
|
||||
|
||||
<ul>
|
||||
<li>/etc/shorewall/shorewall.conf - used to set several
|
||||
firewall parameters.</li>
|
||||
<li>/etc/shorewall/params - use this file to set shell
|
||||
<li>/etc/shorewall/shorewall.conf - used to set several
|
||||
firewall parameters.</li>
|
||||
<li>/etc/shorewall/params - use this file to set shell
|
||||
variables that you will expand in other files.</li>
|
||||
<li>/etc/shorewall/zones - partition the firewall's
|
||||
view of the world into <i>zones.</i></li>
|
||||
<li>/etc/shorewall/policy - establishes firewall high-level
|
||||
policy.</li>
|
||||
<li>/etc/shorewall/interfaces - describes the interfaces
|
||||
<li>/etc/shorewall/zones - partition the firewall's
|
||||
view of the world into <i>zones.</i></li>
|
||||
<li>/etc/shorewall/policy - establishes firewall high-level
|
||||
policy.</li>
|
||||
<li>/etc/shorewall/interfaces - describes the interfaces
|
||||
on the firewall system.</li>
|
||||
<li>/etc/shorewall/hosts - allows defining zones in
|
||||
terms of individual hosts and subnetworks.</li>
|
||||
<li>/etc/shorewall/masq - directs the firewall where
|
||||
<li>/etc/shorewall/hosts - allows defining zones in
|
||||
terms of individual hosts and subnetworks.</li>
|
||||
<li>/etc/shorewall/masq - directs the firewall where
|
||||
to use many-to-one (dynamic) Network Address Translation (a.k.a.
|
||||
Masquerading) and Source Network Address Translation (SNAT).</li>
|
||||
<li>/etc/shorewall/modules - directs the firewall to
|
||||
load kernel modules.</li>
|
||||
<li>/etc/shorewall/rules - defines rules that are exceptions
|
||||
to the overall policies established in /etc/shorewall/policy.</li>
|
||||
<li>/etc/shorewall/nat - defines static NAT rules.</li>
|
||||
<li>/etc/shorewall/proxyarp - defines use of Proxy
|
||||
Masquerading) and Source Network Address Translation (SNAT).</li>
|
||||
<li>/etc/shorewall/modules - directs the firewall
|
||||
to load kernel modules.</li>
|
||||
<li>/etc/shorewall/rules - defines rules that are
|
||||
exceptions to the overall policies established in /etc/shorewall/policy.</li>
|
||||
<li>/etc/shorewall/nat - defines static NAT rules.</li>
|
||||
<li>/etc/shorewall/proxyarp - defines use of Proxy
|
||||
ARP.</li>
|
||||
<li>/etc/shorewall/routestopped (Shorewall 1.3.4 and
|
||||
<li>/etc/shorewall/routestopped (Shorewall 1.3.4 and
|
||||
later) - defines hosts accessible when Shorewall is stopped.</li>
|
||||
<li>/etc/shorewall/tcrules - defines marking of packets
|
||||
for later use by traffic control/shaping or policy routing.</li>
|
||||
<li>/etc/shorewall/tos - defines rules for setting
|
||||
<li>/etc/shorewall/tcrules - defines marking of packets
|
||||
for later use by traffic control/shaping or policy routing.</li>
|
||||
<li>/etc/shorewall/tos - defines rules for setting
|
||||
the TOS field in packet headers.</li>
|
||||
<li>/etc/shorewall/tunnels - defines IPSEC, GRE and
|
||||
IPIP tunnels with end-points on the firewall system.</li>
|
||||
<li>/etc/shorewall/blacklist - lists blacklisted IP/subnet/MAC
|
||||
<li>/etc/shorewall/tunnels - defines IPSEC, GRE and
|
||||
IPIP tunnels with end-points on the firewall system.</li>
|
||||
<li>/etc/shorewall/blacklist - lists blacklisted IP/subnet/MAC
|
||||
addresses.</li>
|
||||
<li>/etc/shorewall/init - commands that you wish to execute at the beginning
|
||||
of a "shorewall start" or "shorewall restart".</li>
|
||||
<li>/etc/shorewall/start - commands that you wish to execute at the completion
|
||||
of a "shorewall start" or "shorewall restart"</li>
|
||||
<li>/etc/shorewall/stop - commands that you wish to execute at the beginning
|
||||
of a "shorewall stop".</li>
|
||||
<li>/etc/shorewall/stopped - commands that you wish to execute at the
|
||||
<li>/etc/shorewall/init - commands that you wish to execute at the beginning
|
||||
of a "shorewall start" or "shorewall restart".</li>
|
||||
<li>/etc/shorewall/start - commands that you wish to execute at the completion
|
||||
of a "shorewall start" or "shorewall restart"</li>
|
||||
<li>/etc/shorewall/stop - commands that you wish to execute at the beginning
|
||||
of a "shorewall stop".</li>
|
||||
<li>/etc/shorewall/stopped - commands that you wish to execute at the
|
||||
completion of a "shorewall stop".<br>
|
||||
</li>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h2>Comments</h2>
|
||||
<h2><a name="Comments"></a>Comments</h2>
|
||||
|
||||
<p>You may place comments in configuration files by making the first non-whitespace
|
||||
character a pound sign ("#"). You may also place comments at
|
||||
@ -96,10 +96,10 @@ of the line with a pound sign.</p>
|
||||
|
||||
<pre>ACCEPT net fw tcp www #This is an end-of-line comment</pre>
|
||||
|
||||
<h2>Line Continuation</h2>
|
||||
<h2><a name="Continuation"></a>Line Continuation</h2>
|
||||
|
||||
<p>You may continue lines in the configuration files using the usual backslash
|
||||
("\") followed immediately by a new line character.</p>
|
||||
("\") followed immediately by a new line character.</p>
|
||||
|
||||
<p>Example:</p>
|
||||
|
||||
@ -114,322 +114,227 @@ of the line with a pound sign.</p>
|
||||
and you are called out of bed at 2:00AM because Shorewall won't start
|
||||
as a result of DNS problems then don't say that you were not forewarned.
|
||||
<br>
|
||||
</b></p>
|
||||
</b></p>
|
||||
|
||||
<p align="left"><b> -Tom<br>
|
||||
</b></p>
|
||||
</b></p>
|
||||
|
||||
<p align="left">Beginning with Shorwall 1.3.9, Host addresses in Shorewall
|
||||
configuration files may be specified as either IP addresses or DNS
|
||||
Names.<br>
|
||||
<br>
|
||||
DNS names in iptables rules aren't nearly as useful as they
|
||||
first appear. When a DNS name appears in a rule, the iptables utility
|
||||
resolves the name to one or more IP addresses and inserts those addresses
|
||||
into the rule. So changes in the DNS->IP address relationship that
|
||||
occur after the firewall has started have absolutely no effect on the
|
||||
firewall's ruleset. </p>
|
||||
configuration files may be specified as either IP addresses or DNS
|
||||
Names.<br>
|
||||
<br>
|
||||
DNS names in iptables rules aren't nearly as useful as they
|
||||
first appear. When a DNS name appears in a rule, the iptables utility
|
||||
resolves the name to one or more IP addresses and inserts those addresses
|
||||
into the rule. So changes in the DNS->IP address relationship that
|
||||
occur after the firewall has started have absolutely no effect on the
|
||||
firewall's ruleset. </p>
|
||||
|
||||
<p align="left"> If your firewall rules include DNS names then:</p>
|
||||
|
||||
<ul>
|
||||
<li>If your /etc/resolv.conf is wrong then your firewall won't
|
||||
start.</li>
|
||||
<li>If your /etc/nsswitch.conf is wrong then your firewall
|
||||
<li>If your /etc/resolv.conf is wrong then your firewall
|
||||
won't start.</li>
|
||||
<li>If your Name Server(s) is(are) down then your firewall
|
||||
won't start.</li>
|
||||
<li>If your startup scripts try to start your firewall before
|
||||
<li>If your /etc/nsswitch.conf is wrong then your firewall
|
||||
won't start.</li>
|
||||
<li>If your Name Server(s) is(are) down then your firewall
|
||||
won't start.</li>
|
||||
<li>If your startup scripts try to start your firewall before
|
||||
starting your DNS server then your firewall won't start.<br>
|
||||
</li>
|
||||
<li>Factors totally outside your control (your ISP's router
|
||||
</li>
|
||||
<li>Factors totally outside your control (your ISP's router
|
||||
is down for example), can prevent your firewall from starting.</li>
|
||||
<li>You must bring up your network interfaces prior to starting
|
||||
your firewall.<br>
|
||||
</li>
|
||||
<li>You must bring up your network interfaces prior to starting
|
||||
your firewall.<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p align="left"> Each DNS name much be fully qualified and include a minumum
|
||||
of two periods (although one may be trailing). This restriction is imposed
|
||||
by Shorewall to insure backward compatibility with existing configuration
|
||||
files.<br>
|
||||
<br>
|
||||
Examples of valid DNS names:<br>
|
||||
</p>
|
||||
of two periods (although one may be trailing). This restriction is
|
||||
imposed by Shorewall to insure backward compatibility with existing
|
||||
configuration files.<br>
|
||||
<br>
|
||||
Examples of valid DNS names:<br>
|
||||
</p>
|
||||
|
||||
<ul>
|
||||
<li>mail.shorewall.net</li>
|
||||
<li>shorewall.net. (note the trailing period).</li>
|
||||
<li>mail.shorewall.net</li>
|
||||
<li>shorewall.net. (note the trailing period).</li>
|
||||
|
||||
</ul>
|
||||
Examples of invalid DNS names:<br>
|
||||
Examples of invalid DNS names:<br>
|
||||
|
||||
<ul>
|
||||
<li>mail (not fully qualified)</li>
|
||||
<li>shorewall.net (only one period)</li>
|
||||
<li>mail (not fully qualified)</li>
|
||||
<li>shorewall.net (only one period)</li>
|
||||
|
||||
</ul>
|
||||
DNS names may not be used as:<br>
|
||||
DNS names may not be used as:<br>
|
||||
|
||||
<ul>
|
||||
<li>The server address in a DNAT rule (/etc/shorewall/rules
|
||||
<li>The server address in a DNAT rule (/etc/shorewall/rules
|
||||
file)</li>
|
||||
<li>In the ADDRESS column of an entry in /etc/shorewall/masq.</li>
|
||||
<li>In the /etc/shorewall/nat file.</li>
|
||||
<li>In the ADDRESS column of an entry in /etc/shorewall/masq.</li>
|
||||
<li>In the /etc/shorewall/nat file.</li>
|
||||
|
||||
</ul>
|
||||
These restrictions are not imposed by Shorewall simply for
|
||||
These restrictions are not imposed by Shorewall simply for
|
||||
your inconvenience but are rather limitations of iptables.<br>
|
||||
|
||||
<h2>Complementing an Address or Subnet</h2>
|
||||
<h2><a name="Compliment"></a>Complementing an Address or Subnet</h2>
|
||||
|
||||
<p>Where specifying an IP address, a subnet or an interface, you can
|
||||
precede the item with "!" to specify the complement of the item. For
|
||||
example, !192.168.1.4 means "any host but 192.168.1.4". There must be
|
||||
no white space following the "!".</p>
|
||||
precede the item with "!" to specify the complement of the item. For
|
||||
example, !192.168.1.4 means "any host but 192.168.1.4". There must
|
||||
be no white space following the "!".</p>
|
||||
|
||||
<h2>Comma-separated Lists</h2>
|
||||
<h2><a name="Lists"></a>Comma-separated Lists</h2>
|
||||
|
||||
<p>Comma-separated lists are allowed in a number of contexts within the
|
||||
configuration files. A comma separated list:</p>
|
||||
configuration files. A comma separated list:</p>
|
||||
|
||||
<ul>
|
||||
<li>Must not have any embedded white space.<br>
|
||||
Valid: routestopped,dhcp,norfc1918<br>
|
||||
Invalid: routestopped, dhcp, norfc1818</li>
|
||||
<li>If you use line continuation to break a comma-separated
|
||||
list, the continuation line(s) must begin in column 1 (or there
|
||||
would be embedded white space)</li>
|
||||
<li>Entries in a comma-separated list may appear in
|
||||
any order.</li>
|
||||
<li>Must not have any embedded white space.<br>
|
||||
Valid: routestopped,dhcp,norfc1918<br>
|
||||
Invalid: routestopped, dhcp, norfc1818</li>
|
||||
<li>If you use line continuation to break a comma-separated
|
||||
list, the continuation line(s) must begin in column 1 (or
|
||||
there would be embedded white space)</li>
|
||||
<li>Entries in a comma-separated list may appear in
|
||||
any order.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h2>Port Numbers/Service Names</h2>
|
||||
<h2><a name="Ports"></a>Port Numbers/Service Names</h2>
|
||||
|
||||
<p>Unless otherwise specified, when giving a port number you can use
|
||||
either an integer or a service name from /etc/services. </p>
|
||||
either an integer or a service name from /etc/services. </p>
|
||||
|
||||
<h2>Port Ranges</h2>
|
||||
<h2><a name="Ranges"></a>Port Ranges</h2>
|
||||
|
||||
<p>If you need to specify a range of ports, the proper syntax is <<i>low
|
||||
port number</i>>:<<i>high port number</i>>. For example,
|
||||
if you want to forward the range of tcp ports 4000 through 4100 to local
|
||||
host 192.168.1.3, the entry in /etc/shorewall/rules is:<br>
|
||||
</p>
|
||||
port number</i>>:<<i>high port number</i>>. For example,
|
||||
if you want to forward the range of tcp ports 4000 through 4100 to
|
||||
local host 192.168.1.3, the entry in /etc/shorewall/rules is:<br>
|
||||
</p>
|
||||
|
||||
<pre> DNAT net loc:192.168.1.3 tcp 4000:4100<br></pre>
|
||||
|
||||
<h2>Using Shell Variables</h2>
|
||||
<h2><a name="Variables"></a>Using Shell Variables</h2>
|
||||
|
||||
<p>You may use the /etc/shorewall/params file to set shell variables
|
||||
that you can then use in some of the other configuration files.</p>
|
||||
that you can then use in some of the other configuration files.</p>
|
||||
|
||||
<p>It is suggested that variable names begin with an upper case letter<font
|
||||
size="1"> </font>to distinguish them from variables used internally
|
||||
within the Shorewall programs</p>
|
||||
within the Shorewall programs</p>
|
||||
|
||||
<p>Example:</p>
|
||||
|
||||
<blockquote>
|
||||
|
||||
<pre>NET_IF=eth0<br>NET_BCAST=130.252.100.255<br>NET_OPTIONS=noping,norfc1918</pre>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<p><br>
|
||||
Example (/etc/shorewall/interfaces record):</p>
|
||||
<font
|
||||
Example (/etc/shorewall/interfaces record):</p>
|
||||
<font
|
||||
face="Century Gothic, Arial, Helvetica">
|
||||
|
||||
<blockquote>
|
||||
|
||||
<pre><font face="Courier">net $NET_IF $NET_BCAST $NET_OPTIONS</font></pre>
|
||||
</blockquote>
|
||||
</font>
|
||||
</blockquote>
|
||||
</font>
|
||||
|
||||
<p>The result will be the same as if the record had been written</p>
|
||||
<font
|
||||
<font
|
||||
face="Century Gothic, Arial, Helvetica">
|
||||
|
||||
<blockquote>
|
||||
|
||||
<pre>net eth0 130.252.100.255 noping,norfc1918</pre>
|
||||
</blockquote>
|
||||
</font>
|
||||
</blockquote>
|
||||
</font>
|
||||
|
||||
<p>Variables may be used anywhere in the other configuration
|
||||
files.</p>
|
||||
files.</p>
|
||||
|
||||
<h2>Using MAC Addresses</h2>
|
||||
<h2><a name="MAC"></a>Using MAC Addresses</h2>
|
||||
|
||||
<p>Media Access Control (MAC) addresses can be used to specify packet
|
||||
source in several of the configuration files. To use this feature,
|
||||
your kernel must have MAC Address Match support (CONFIG_IP_NF_MATCH_MAC)
|
||||
included.</p>
|
||||
source in several of the configuration files. To use this feature,
|
||||
your kernel must have MAC Address Match support (CONFIG_IP_NF_MATCH_MAC)
|
||||
included.</p>
|
||||
|
||||
<p>MAC addresses are 48 bits wide and each Ethernet Controller has a
|
||||
unique MAC address.<br>
|
||||
<br>
|
||||
In GNU/Linux, MAC addresses are usually written as a
|
||||
unique MAC address.<br>
|
||||
<br>
|
||||
In GNU/Linux, MAC addresses are usually written as a
|
||||
series of 6 hex numbers separated by colons. Example:<br>
|
||||
<br>
|
||||
[root@gateway root]# ifconfig eth0<br>
|
||||
eth0 Link encap:Ethernet HWaddr <b><u>02:00:08:E3:FA:55</u></b><br>
|
||||
inet addr:206.124.146.176 Bcast:206.124.146.255
|
||||
Mask:255.255.255.0<br>
|
||||
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br>
|
||||
RX packets:2398102 errors:0 dropped:0 overruns:0
|
||||
frame:0<br>
|
||||
TX packets:3044698 errors:0 dropped:0 overruns:0
|
||||
carrier:0<br>
|
||||
collisions:30394 txqueuelen:100<br>
|
||||
RX bytes:419871805 (400.4 Mb) TX bytes:1659782221
|
||||
(1582.8 Mb)<br>
|
||||
Interrupt:11 Base address:0x1800<br>
|
||||
<br>
|
||||
Because Shorewall uses colons as a separator for address
|
||||
<br>
|
||||
[root@gateway root]# ifconfig eth0<br>
|
||||
eth0 Link encap:Ethernet HWaddr <b><u>02:00:08:E3:FA:55</u></b><br>
|
||||
inet addr:206.124.146.176 Bcast:206.124.146.255
|
||||
Mask:255.255.255.0<br>
|
||||
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br>
|
||||
RX packets:2398102 errors:0 dropped:0 overruns:0
|
||||
frame:0<br>
|
||||
TX packets:3044698 errors:0 dropped:0 overruns:0
|
||||
carrier:0<br>
|
||||
collisions:30394 txqueuelen:100<br>
|
||||
RX bytes:419871805 (400.4 Mb) TX bytes:1659782221
|
||||
(1582.8 Mb)<br>
|
||||
Interrupt:11 Base address:0x1800<br>
|
||||
<br>
|
||||
Because Shorewall uses colons as a separator for address
|
||||
fields, Shorewall requires MAC addresses to be written in another
|
||||
way. In Shorewall, MAC addresses begin with a tilde ("~") and
|
||||
consist of 6 hex numbers separated by hyphens. In Shorewall, the
|
||||
MAC address in the example above would be written "~02-00-08-E3-FA-55".<br>
|
||||
</p>
|
||||
way. In Shorewall, MAC addresses begin with a tilde ("~") and consist
|
||||
of 6 hex numbers separated by hyphens. In Shorewall, the MAC address
|
||||
in the example above would be written "~02-00-08-E3-FA-55".<br>
|
||||
</p>
|
||||
|
||||
<p><b>Note: </b>It is not necessary to use the special Shorewall notation
|
||||
in the <a href="MAC_Validation.html">/etc/shorewall/maclist</a> file.<br>
|
||||
</p>
|
||||
in the <a href="MAC_Validation.html">/etc/shorewall/maclist</a> file.<br>
|
||||
</p>
|
||||
|
||||
<h2><a name="Levels"></a>Logging</h2>
|
||||
By default, Shorewall directs NetFilter to log using syslog (8). Syslog
|
||||
classifies log messages by a <i>facility</i> and a <i>priority</i> (using
|
||||
the notation <i>facility.priority</i>). <br>
|
||||
<br>
|
||||
The facilities defined by syslog are <i>auth, authpriv, cron, daemon,
|
||||
kern, lpr, mail, mark, news, syslog, user, uucp</i> and <i>local0</i> through
|
||||
<i>local7</i>.<br>
|
||||
<br>
|
||||
Throughout the Shorewall documentation, I will use the term <i>level</i>
|
||||
rather than <i>priority</i> since <i>level</i> is the term used by NetFilter.
|
||||
The syslog documentation uses the term <i>priority</i>.<br>
|
||||
|
||||
<h3>Syslog Levels<br>
|
||||
</h3>
|
||||
Syslog levels are a method of describing to syslog (8) the importance
|
||||
of a message and a number of Shorewall parameters have a syslog level
|
||||
as their value.<br>
|
||||
<br>
|
||||
Valid levels are:<br>
|
||||
<br>
|
||||
7 debug<br>
|
||||
6 info<br>
|
||||
5 notice<br>
|
||||
4 warning<br>
|
||||
3 err<br>
|
||||
2 crit<br>
|
||||
1 alert<br>
|
||||
0 emerg<br>
|
||||
<br>
|
||||
For most Shorewall logging, a level of 6 (info) is appropriate. Shorewall
|
||||
log messages are generated by NetFilter and are logged using the <i>kern</i>
|
||||
facility and the level that you specify. If you are unsure of the level
|
||||
to choose, 6 (info) is a safe bet. You may specify levels by name or by
|
||||
number.<br>
|
||||
<br>
|
||||
Syslogd writes log messages to files (typically in /var/log/*) based
|
||||
on their facility and level. The mapping of these facility/level pairs to
|
||||
log files is done in /etc/syslog.conf (5). If you make changes to this file,
|
||||
you must restart syslogd before the changes can take effect.<br>
|
||||
|
||||
<h3>Configuring a Separate Log for Shorewall Messages</h3>
|
||||
There are a couple of limitations to syslogd-based logging:<br>
|
||||
|
||||
<ol>
|
||||
<li>If you give, for example, kern.info it's own log destination then
|
||||
that destination will also receive all kernel messages of levels 5 (notice)
|
||||
through 0 (emerg).</li>
|
||||
<li>All kernel.info messages will go to that destination and not just
|
||||
those from NetFilter.<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
Beginning with Shorewall version 1.3.12, if your kernel has ULOG target
|
||||
support (and most vendor-supplied kernels do), you may also specify a log
|
||||
level of ULOG (must be all caps). When ULOG is used, Shorewall will direct
|
||||
netfilter to log the related messages via the ULOG target which will send
|
||||
them to a process called 'ulogd'. The ulogd program is available from http://www.gnumonks.org/projects/ulogd
|
||||
and can be configured to log all Shorewall message to their own log file.<br>
|
||||
<br>
|
||||
Download the ulod tar file and:<br>
|
||||
|
||||
<ol>
|
||||
<li>cd /usr/local/src (or wherever you do your builds)</li>
|
||||
<li>tar -zxf <i>source-tarball-that-you-downloaded</i></li>
|
||||
<li>cd ulogd-<i>version</i><br>
|
||||
</li>
|
||||
<li>./configure</li>
|
||||
<li>make</li>
|
||||
<li>make install<br>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
If you are like me and don't have a development environment on your firewall,
|
||||
you can do the first five steps on another system then either NFS mount your
|
||||
/usr/local/src directory or tar up the /usr/local/src/ulogd-<i>version</i>
|
||||
directory and move it to your firewall system.<br>
|
||||
<br>
|
||||
Now on the firewall system, edit /usr/local/etc/ulogd.conf and set:<br>
|
||||
|
||||
<ol>
|
||||
<li>syslogfile <i><file that you wish to log to></i></li>
|
||||
<li>syslogsync 1</li>
|
||||
|
||||
</ol>
|
||||
I also copied the file /usr/local/src/ulogd-<i>version</i>/ulogd.init to
|
||||
/etc/init.d/ulogd. I had to edit the line that read "daemon /usr/local/sbin/ulogd"
|
||||
to read daemon /usr/local/sbin/ulogd -d". On a RedHat system, a simple "chkconfig
|
||||
--level 3 ulogd on" starts ulogd during boot up. Your init system may need
|
||||
something else done to activate the script.<br>
|
||||
<br>
|
||||
Finally edit /etc/shorewall/shorewall.conf and set LOGFILE=<i><file that
|
||||
you wish to log to></i>. This tells the /sbin/shorewall program where to
|
||||
look for the log when processing its "show log", "logwatch" and "monitor"
|
||||
commands.<br>
|
||||
|
||||
<h2><a name="Configs"></a>Shorewall Configurations</h2>
|
||||
<h2><a name="Levels"></a>Shorewall Configurations</h2>
|
||||
|
||||
<p> Shorewall allows you to have configuration directories other than /etc/shorewall.
|
||||
The <a href="starting_and_stopping_shorewall.htm">shorewall start and
|
||||
restart</a> commands allow you to specify an alternate configuration
|
||||
directory and Shorewall will use the files in the alternate directory
|
||||
rather than the corresponding files in /etc/shorewall. The alternate directory
|
||||
need not contain a complete configuration; those files not in the alternate
|
||||
directory will be read from /etc/shorewall.</p>
|
||||
The <a href="starting_and_stopping_shorewall.htm">shorewall start
|
||||
and restart</a> commands allow you to specify an alternate configuration
|
||||
directory and Shorewall will use the files in the alternate directory
|
||||
rather than the corresponding files in /etc/shorewall. The alternate
|
||||
directory need not contain a complete configuration; those files not
|
||||
in the alternate directory will be read from /etc/shorewall.</p>
|
||||
|
||||
<p> This facility permits you to easily create a test or temporary configuration
|
||||
by:</p>
|
||||
by:</p>
|
||||
|
||||
<ol>
|
||||
<li> copying the files that need modification from
|
||||
/etc/shorewall to a separate directory;</li>
|
||||
<li> modify those files in the separate directory;
|
||||
and</li>
|
||||
<li> specifying the separate directory in a shorewall
|
||||
<li> copying the files that need modification from
|
||||
/etc/shorewall to a separate directory;</li>
|
||||
<li> modify those files in the separate directory;
|
||||
and</li>
|
||||
<li> specifying the separate directory in a shorewall
|
||||
start or shorewall restart command (e.g., <i><b>shorewall -c /etc/testconfig
|
||||
restart</b></i> ).</li>
|
||||
restart</b></i> ).</li>
|
||||
|
||||
</ol>
|
||||
|
||||
|
||||
|
||||
|
||||
<p><font size="2"> Updated 12/20/2002 - <a href="support.htm">Tom Eastep</a>
|
||||
<p><font size="2"> Updated 12/29/2002 - <a href="support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
|
||||
|
||||
|
||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||
© <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font><br>
|
||||
</p>
|
||||
© <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font><br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
|
||||
@ -18,13 +18,13 @@
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Shorewall Errata/Upgrade Issues</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
@ -32,105 +32,115 @@
|
||||
<p align="center"> <b><u>IMPORTANT</u></b></p>
|
||||
|
||||
<ol>
|
||||
<li>
|
||||
<li>
|
||||
|
||||
<p align="left"> <b><u>I</u>f you use a Windows system to download
|
||||
a corrected script, be sure to run the script through <u>
|
||||
<a href="http://www.megaloman.com/%7Ehany/software/hd2u/"
|
||||
<a href="http://www.megaloman.com/%7Ehany/software/hd2u/"
|
||||
style="text-decoration: none;"> dos2unix</a></u> after you have moved
|
||||
it to your Linux system.</b></p>
|
||||
</li>
|
||||
<li>
|
||||
</li>
|
||||
<li>
|
||||
|
||||
<p align="left"> <b>If you are installing Shorewall for the
|
||||
first time and plan to use the .tgz and install.sh script, you can
|
||||
untar the archive, replace the 'firewall' script in the untarred directory
|
||||
<p align="left"> <b>If you are installing Shorewall for the first
|
||||
time and plan to use the .tgz and install.sh script, you can untar
|
||||
the archive, replace the 'firewall' script in the untarred directory
|
||||
with the one you downloaded below, and then run install.sh.</b></p>
|
||||
</li>
|
||||
<li>
|
||||
</li>
|
||||
<li>
|
||||
|
||||
<p align="left"> <b>When the instructions say to install a corrected
|
||||
firewall script in /etc/shorewall/firewall, /usr/lib/shorewall/firewall
|
||||
or /var/lib/shorewall/firewall, use the 'cp' (or 'scp') utility to
|
||||
overwrite the existing file. DO NOT REMOVE OR RENAME THE OLD
|
||||
/etc/shorewall/firewall or /var/lib/shorewall/firewall before
|
||||
you do that. /etc/shorewall/firewall and /var/lib/shorewall/firewall
|
||||
are symbolic links that point to the 'shorewall' file used by your
|
||||
system initialization scripts to start Shorewall during boot.
|
||||
It is that file that must be overwritten with the corrected
|
||||
script.</b></p>
|
||||
</li>
|
||||
<li>
|
||||
or /var/lib/shorewall/firewall, use the 'cp' (or 'scp') utility to overwrite
|
||||
the existing file. DO NOT REMOVE OR RENAME THE OLD /etc/shorewall/firewall
|
||||
or /var/lib/shorewall/firewall before you do that. /etc/shorewall/firewall
|
||||
and /var/lib/shorewall/firewall are symbolic links that point
|
||||
to the 'shorewall' file used by your system initialization scripts
|
||||
to start Shorewall during boot. It is that file that must be overwritten
|
||||
with the corrected script.</b></p>
|
||||
</li>
|
||||
<li>
|
||||
<p align="left"><b><font color="#ff0000">DO NOT INSTALL CORRECTED COMPONENTS
|
||||
ON A RELEASE EARLIER THAN THE ONE THAT THEY ARE LISTED UNDER BELOW. For
|
||||
example, do NOT install the 1.3.9a firewall script if you are running 1.3.7c.</font></b><br>
|
||||
</p>
|
||||
</li>
|
||||
</p>
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
|
||||
<ul>
|
||||
<li><b><a href="upgrade_issues.htm">Upgrade Issues</a></b></li>
|
||||
<li> <b><a href="#V1.3">Problems
|
||||
in Version 1.3</a></b></li>
|
||||
<li> <b><a
|
||||
<li><b><a href="upgrade_issues.htm">Upgrade Issues</a></b></li>
|
||||
<li> <b><a href="#V1.3">Problems
|
||||
in Version 1.3</a></b></li>
|
||||
<li> <b><a
|
||||
href="errata_2.htm">Problems in Version 1.2</a></b></li>
|
||||
<li> <b><font color="#660066">
|
||||
<a href="errata_1.htm">Problems in Version 1.1</a></font></b></li>
|
||||
<li> <b><font color="#660066"><a
|
||||
href="#iptables"> Problem with iptables version 1.2.3 on RH7.2</a></font></b></li>
|
||||
<li> <b><a href="#Debug">Problems
|
||||
<li> <b><font
|
||||
color="#660066"> <a href="errata_1.htm">Problems in Version 1.1</a></font></b></li>
|
||||
<li> <b><font
|
||||
color="#660066"><a href="#iptables"> Problem with iptables version 1.2.3
|
||||
on RH7.2</a></font></b></li>
|
||||
<li> <b><a href="#Debug">Problems
|
||||
with kernels >= 2.4.18 and RedHat iptables</a></b></li>
|
||||
<li><b><a href="#SuSE">Problems installing/upgrading RPM
|
||||
<li><b><a href="#SuSE">Problems installing/upgrading RPM
|
||||
on SuSE</a></b></li>
|
||||
<li><b><a href="#Multiport">Problems with iptables version
|
||||
<li><b><a href="#Multiport">Problems with iptables version
|
||||
1.2.7 and MULTIPORT=Yes</a></b></li>
|
||||
<li><b><a href="#NAT">Problems with RH Kernel 2.4.18-10 and NAT</a></b><br>
|
||||
</li>
|
||||
<li><b><a href="#NAT">Problems with RH Kernel 2.4.18-10 and NAT</a></b><br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<hr>
|
||||
<h2 align="left"><a name="V1.3"></a>Problems in Version 1.3</h2>
|
||||
|
||||
<h3>Version 1.3.11a</h3>
|
||||
|
||||
<h3>Version 1.3.12 LRP</h3>
|
||||
<ul>
|
||||
<li><a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.3.11/rfc1918">This
|
||||
copy of /etc/shorewall/rfc1918</a> reflects the recent allocation of 82.0.0.0/8.<br>
|
||||
<li>The .lrp was missing the /etc/shorewall/routestopped file -- a new
|
||||
lrp (shorwall-1.3.12a.lrp) has been released which corrects this problem.<br>
|
||||
</li>
|
||||
</ul>
|
||||
<h3>Version 1.3.11a</h3>
|
||||
|
||||
<ul>
|
||||
<li><a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.3.11/rfc1918">This
|
||||
copy of /etc/shorewall/rfc1918</a> reflects the recent allocation of 82.0.0.0/8.<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3>Version 1.3.11</h3>
|
||||
|
||||
<ul>
|
||||
<li>When installing/upgrading using the .rpm, you may receive the following
|
||||
warnings:<br>
|
||||
<br>
|
||||
user teastep does not exist - using root<br>
|
||||
group teastep does not exist - using root<br>
|
||||
<br>
|
||||
These warnings are harmless and may be ignored. Users downloading the
|
||||
<li>When installing/upgrading using the .rpm, you may receive the following
|
||||
warnings:<br>
|
||||
<br>
|
||||
user teastep does not exist - using root<br>
|
||||
group teastep does not exist - using root<br>
|
||||
<br>
|
||||
These warnings are harmless and may be ignored. Users downloading the
|
||||
.rpm from shorewall.net or mirrors should no longer see these warnings as
|
||||
the .rpm you will get from there has been corrected.</li>
|
||||
<li>DNAT rules that exclude a source subzone (SOURCE column contains
|
||||
! followed by a sub-zone list) result in an error message and Shorewall
|
||||
fails to start.<br>
|
||||
<br>
|
||||
Install <a
|
||||
<li>DNAT rules that exclude a source subzone (SOURCE column contains
|
||||
! followed by a sub-zone list) result in an error message and Shorewall fails
|
||||
to start.<br>
|
||||
<br>
|
||||
Install <a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.3.11/firewall">this
|
||||
corrected script</a> in /usr/lib/shorewall/firewall to correct this problem.
|
||||
Thanks go to Roger Aich who analyzed this problem and provided a fix.<br>
|
||||
<br>
|
||||
This problem is corrected in version 1.3.11a.<br>
|
||||
</li>
|
||||
Thanks go to Roger Aich who analyzed this problem and provided a fix.<br>
|
||||
<br>
|
||||
This problem is corrected in version 1.3.11a.<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3>Version 1.3.10</h3>
|
||||
|
||||
<ul>
|
||||
<li>If you experience problems connecting to a PPTP server running
|
||||
on your firewall and you have a 'pptpserver' entry in /etc/shorewall/tunnels,
|
||||
<li>If you experience problems connecting to a PPTP server running
|
||||
on your firewall and you have a 'pptpserver' entry in /etc/shorewall/tunnels,
|
||||
<a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.3.10/firewall">this
|
||||
version of the firewall script</a> may help. Please report any cases where
|
||||
@ -138,15 +148,15 @@ on your firewall and you have a 'pptpserver' entry in /etc/shorewall/tunnels,
|
||||
problems. Beginning with version 1.3.10, it is safe to save the old version
|
||||
of /usr/lib/shorewall/firewall before copying in the new one since /usr/lib/shorewall/firewall
|
||||
is the real script now and not just a symbolic link to the real script.<br>
|
||||
</li>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3>Version 1.3.9a</h3>
|
||||
|
||||
<ul>
|
||||
<li> If entries are used in /etc/shorewall/hosts and MERGE_HOSTS=No
|
||||
then the following message appears during "shorewall [re]start":</li>
|
||||
<li> If entries are used in /etc/shorewall/hosts and MERGE_HOSTS=No
|
||||
then the following message appears during "shorewall [re]start":</li>
|
||||
|
||||
</ul>
|
||||
|
||||
@ -155,104 +165,105 @@ on your firewall and you have a 'pptpserver' entry in /etc/shorewall/tunnels,
|
||||
<blockquote> The updated firewall script at <a
|
||||
href="ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall"
|
||||
target="_top">ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall</a>
|
||||
corrects this problem.Copy the script to /usr/lib/shorewall/firewall as
|
||||
described above.<br>
|
||||
</blockquote>
|
||||
corrects this problem.Copy the script to /usr/lib/shorewall/firewall
|
||||
as described above.<br>
|
||||
</blockquote>
|
||||
|
||||
<blockquote> Alternatively, edit /usr/lob/shorewall/firewall and change the
|
||||
single occurence (line 483 in version 1.3.9a) of 'recalculate_interefacess'
|
||||
to 'recalculate_interface'. <br>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<ul>
|
||||
<li>The installer (install.sh) issues a misleading message "Common
|
||||
functions installed in /var/lib/shorewall/functions" whereas the file
|
||||
is installed in /usr/lib/shorewall/functions. The installer also performs
|
||||
incorrectly when updating old configurations that had the file /etc/shorewall/functions.
|
||||
<li>The installer (install.sh) issues a misleading message "Common
|
||||
functions installed in /var/lib/shorewall/functions" whereas the file is
|
||||
installed in /usr/lib/shorewall/functions. The installer also performs incorrectly
|
||||
when updating old configurations that had the file /etc/shorewall/functions.
|
||||
<a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.3.9/install.sh">Here
|
||||
is an updated version that corrects these problems.<br>
|
||||
</a></li>
|
||||
</a></li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3>Version 1.3.9</h3>
|
||||
<b>TUNNELS Broken in 1.3.9!!! </b>There is an updated firewall script
|
||||
at <a
|
||||
<b>TUNNELS Broken in 1.3.9!!! </b>There is an updated firewall
|
||||
script at <a
|
||||
href="ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall"
|
||||
target="_top">ftp://www.shorewall.net/pub/shorewall/errata/1.3.9/firewall</a>
|
||||
-- copy that file to /usr/lib/shorewall/firewall as described above.<br>
|
||||
<br>
|
||||
Version 1.3.8
|
||||
-- copy that file to /usr/lib/shorewall/firewall as described above.<br>
|
||||
<br>
|
||||
Version 1.3.8
|
||||
<ul>
|
||||
<li> Use of shell variables in the LOG LEVEL or SYNPARMS columns
|
||||
of the policy file doesn't work.</li>
|
||||
<li>A DNAT rule with the same original and new IP addresses
|
||||
<li> Use of shell variables in the LOG LEVEL or SYNPARMS columns
|
||||
of the policy file doesn't work.</li>
|
||||
<li>A DNAT rule with the same original and new IP addresses
|
||||
but with different port numbers doesn't work (e.g., "DNAT loc dmz:10.1.1.1:24
|
||||
tcp 25 - 10.1.1.1")<br>
|
||||
</li>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
Installing <a
|
||||
Installing <a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.3.8/firewall">
|
||||
this corrected firewall script</a> in /var/lib/shorewall/firewall
|
||||
this corrected firewall script</a> in /var/lib/shorewall/firewall
|
||||
as described above corrects these problems.
|
||||
|
||||
<h3>Version 1.3.7b</h3>
|
||||
|
||||
<p>DNAT rules where the source zone is 'fw' ($FW)
|
||||
result in an error message. Installing
|
||||
<a
|
||||
result in an error message. Installing
|
||||
<a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.3.7/firewall">
|
||||
this corrected firewall script</a> in /var/lib/shorewall/firewall
|
||||
this corrected firewall script</a> in /var/lib/shorewall/firewall
|
||||
as described above corrects this problem.</p>
|
||||
|
||||
<h3>Version 1.3.7a</h3>
|
||||
|
||||
<p>"shorewall refresh" is not creating the proper
|
||||
rule for FORWARDPING=Yes. Consequently, after
|
||||
"shorewall refresh", the firewall will not forward
|
||||
icmp echo-request (ping) packets. Installing
|
||||
<a
|
||||
rule for FORWARDPING=Yes. Consequently, after
|
||||
"shorewall refresh", the firewall will not forward
|
||||
icmp echo-request (ping) packets. Installing
|
||||
<a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.3.7/firewall">
|
||||
this corrected firewall script</a> in /var/lib/shorewall/firewall
|
||||
this corrected firewall script</a> in /var/lib/shorewall/firewall
|
||||
as described above corrects this problem.</p>
|
||||
|
||||
<h3>Version <= 1.3.7a</h3>
|
||||
|
||||
<p>If "norfc1918" and "dhcp" are both specified as
|
||||
options on a given interface then RFC 1918
|
||||
checking is occurring before DHCP checking. This
|
||||
means that if a DHCP client broadcasts using an
|
||||
RFC 1918 source address, then the firewall will
|
||||
reject the broadcast (usually logging it). This
|
||||
options on a given interface then RFC 1918
|
||||
checking is occurring before DHCP checking. This
|
||||
means that if a DHCP client broadcasts using an
|
||||
RFC 1918 source address, then the firewall will
|
||||
reject the broadcast (usually logging it). This
|
||||
has two problems:</p>
|
||||
|
||||
<ol>
|
||||
<li>If the firewall is running
|
||||
a DHCP server, the client won't be able
|
||||
to obtain an IP address lease from
|
||||
that server.</li>
|
||||
<li>With this order of checking,
|
||||
the "dhcp" option cannot be used as
|
||||
a noise-reduction measure where there
|
||||
are both dynamic and static clients on
|
||||
a LAN segment.</li>
|
||||
<li>If the firewall is running
|
||||
a DHCP server, the client won't be
|
||||
able to obtain an IP address lease
|
||||
from that server.</li>
|
||||
<li>With this order of checking,
|
||||
the "dhcp" option cannot be used as
|
||||
a noise-reduction measure where there
|
||||
are both dynamic and static clients
|
||||
on a LAN segment.</li>
|
||||
|
||||
</ol>
|
||||
|
||||
|
||||
<p> <a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.3.7/firewall">
|
||||
This version of the 1.3.7a firewall script </a>
|
||||
corrects the problem. It must be installed
|
||||
This version of the 1.3.7a firewall script </a>
|
||||
corrects the problem. It must be installed
|
||||
in /var/lib/shorewall as described above.</p>
|
||||
|
||||
<h3>Version 1.3.7</h3>
|
||||
|
||||
<p>Version 1.3.7 dead on arrival -- please use
|
||||
version 1.3.7a and check your version against
|
||||
these md5sums -- if there's a difference, please
|
||||
download again.</p>
|
||||
version 1.3.7a and check your version against
|
||||
these md5sums -- if there's a difference, please
|
||||
download again.</p>
|
||||
|
||||
<pre> d2fffb7fb99bcc6cb047ea34db1df10 shorewall-1.3.7a.tgz<br> 6a7fd284c8685b2b471a2f47b469fb94 shorewall-1.3.7a-1.noarch.rpm<br> 3decd14296effcff16853106771f7035 shorwall-1.3.7a.lrp</pre>
|
||||
|
||||
@ -265,90 +276,90 @@ a LAN segment.</li>
|
||||
<h3 align="left">Version 1.3.6</h3>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
|
||||
<p align="left">If ADD_SNAT_ALIASES=Yes is specified in /etc/shorewall/shorewall.conf,
|
||||
an error occurs when the firewall script attempts to add
|
||||
an SNAT alias. </p>
|
||||
</li>
|
||||
<li>
|
||||
</li>
|
||||
<li>
|
||||
|
||||
<p align="left">The <b>logunclean </b>and <b>dropunclean</b> options
|
||||
cause errors during startup when Shorewall is run with iptables
|
||||
cause errors during startup when Shorewall is run with iptables
|
||||
1.2.7. </p>
|
||||
</li>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p align="left">These problems are fixed in <a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.3.6/firewall">
|
||||
this correct firewall script</a> which must be installed in
|
||||
/var/lib/shorewall/ as described above. These problems are also
|
||||
corrected in version 1.3.7.</p>
|
||||
this correct firewall script</a> which must be installed in
|
||||
/var/lib/shorewall/ as described above. These problems are also
|
||||
corrected in version 1.3.7.</p>
|
||||
|
||||
<h3 align="left">Two-interface Samples 1.3.6 (file two-interfaces.tgz)</h3>
|
||||
|
||||
<p align="left">A line was inadvertently deleted from the "interfaces
|
||||
file" -- this line should be added back in if the version that you
|
||||
file" -- this line should be added back in if the version that you
|
||||
downloaded is missing it:</p>
|
||||
|
||||
<p align="left">net eth0 detect routefilter,dhcp,norfc1918</p>
|
||||
|
||||
<p align="left">If you downloaded two-interfaces-a.tgz then the above
|
||||
line should already be in the file.</p>
|
||||
line should already be in the file.</p>
|
||||
|
||||
<h3 align="left">Version 1.3.5-1.3.5b</h3>
|
||||
|
||||
<p align="left">The new 'proxyarp' interface option doesn't work :-(
|
||||
This is fixed in <a
|
||||
This is fixed in <a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.3.5/firewall">
|
||||
this corrected firewall script</a> which must be installed in
|
||||
/var/lib/shorewall/ as described above.</p>
|
||||
this corrected firewall script</a> which must be installed in
|
||||
/var/lib/shorewall/ as described above.</p>
|
||||
|
||||
<h3 align="left">Versions 1.3.4-1.3.5a</h3>
|
||||
|
||||
<p align="left">Prior to version 1.3.4, host file entries such as the
|
||||
following were allowed:</p>
|
||||
following were allowed:</p>
|
||||
|
||||
<div align="left">
|
||||
<pre> adm eth0:1.2.4.5,eth0:5.6.7.8</pre>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">That capability was lost in version 1.3.4 so that it is only
|
||||
possible to include a single host specification on each line.
|
||||
This problem is corrected by <a
|
||||
possible to include a single host specification on each line. This
|
||||
problem is corrected by <a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.3.5a/firewall">this
|
||||
modified 1.3.5a firewall script</a>. Install the script in /var/lib/pub/shorewall/firewall
|
||||
as instructed above.</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div align="left">
|
||||
<p align="left">This problem is corrected in version 1.3.5b.</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<h3 align="left">Version 1.3.5</h3>
|
||||
|
||||
<p align="left">REDIRECT rules are broken in this version. Install
|
||||
<a
|
||||
<a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.3.5/firewall">
|
||||
this corrected firewall script</a> in /var/lib/pub/shorewall/firewall
|
||||
this corrected firewall script</a> in /var/lib/pub/shorewall/firewall
|
||||
as instructed above. This problem is corrected in version
|
||||
1.3.5a.</p>
|
||||
|
||||
<h3 align="left">Version 1.3.n, n < 4</h3>
|
||||
|
||||
<p align="left">The "shorewall start" and "shorewall restart" commands
|
||||
to not verify that the zones named in the /etc/shorewall/policy
|
||||
file have been previously defined in the /etc/shorewall/zones
|
||||
file. The "shorewall check" command does perform this verification
|
||||
so it's a good idea to run that command after you have made configuration
|
||||
to not verify that the zones named in the /etc/shorewall/policy file
|
||||
have been previously defined in the /etc/shorewall/zones file.
|
||||
The "shorewall check" command does perform this verification so
|
||||
it's a good idea to run that command after you have made configuration
|
||||
changes.</p>
|
||||
|
||||
<h3 align="left">Version 1.3.n, n < 3</h3>
|
||||
|
||||
<p align="left">If you have upgraded from Shorewall 1.2 and after
|
||||
"Activating rules..." you see the message: "iptables: No chains/target/match
|
||||
"Activating rules..." you see the message: "iptables: No chains/target/match
|
||||
by that name" then you probably have an entry in /etc/shorewall/hosts
|
||||
that specifies an interface that you didn't include in /etc/shorewall/interfaces.
|
||||
To correct this problem, you must add an entry to /etc/shorewall/interfaces.
|
||||
@ -358,80 +369,80 @@ so it's a good idea to run that command after you have made configura
|
||||
<h3 align="left">Version 1.3.2</h3>
|
||||
|
||||
<p align="left">Until approximately 2130 GMT on 17 June 2002, the
|
||||
download sites contained an incorrect version of the .lrp file. That
|
||||
file can be identified by its size (56284 bytes). The correct
|
||||
version has a size of 38126 bytes.</p>
|
||||
download sites contained an incorrect version of the .lrp file. That
|
||||
file can be identified by its size (56284 bytes). The correct version
|
||||
has a size of 38126 bytes.</p>
|
||||
|
||||
<ul>
|
||||
<li>The code to detect a duplicate interface entry
|
||||
in /etc/shorewall/interfaces contained a typo that prevented
|
||||
it from working correctly. </li>
|
||||
<li>"NAT_BEFORE_RULES=No" was broken; it behaved
|
||||
just like "NAT_BEFORE_RULES=Yes".</li>
|
||||
<li>The code to detect a duplicate interface entry
|
||||
in /etc/shorewall/interfaces contained a typo that prevented
|
||||
it from working correctly. </li>
|
||||
<li>"NAT_BEFORE_RULES=No" was broken; it behaved
|
||||
just like "NAT_BEFORE_RULES=Yes".</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p align="left">Both problems are corrected in <a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.3.2/firewall">
|
||||
this script</a> which should be installed in <b><u>/var/lib/shorewall</u></b>
|
||||
this script</a> which should be installed in <b><u>/var/lib/shorewall</u></b>
|
||||
as described above.</p>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
|
||||
<p align="left">The IANA have just announced the allocation of subnet
|
||||
221.0.0.0/8. This <a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.3.2/rfc1918">
|
||||
updated rfc1918</a> file reflects that allocation.</p>
|
||||
</li>
|
||||
updated rfc1918</a> file reflects that allocation.</p>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3 align="left">Version 1.3.1</h3>
|
||||
|
||||
<ul>
|
||||
<li>TCP SYN packets may be double counted when
|
||||
LIMIT:BURST is included in a CONTINUE or ACCEPT policy (i.e.,
|
||||
<li>TCP SYN packets may be double counted when
|
||||
LIMIT:BURST is included in a CONTINUE or ACCEPT policy (i.e.,
|
||||
each packet is sent through the limit chain twice).</li>
|
||||
<li>An unnecessary jump to the policy chain is sometimes
|
||||
generated for a CONTINUE policy.</li>
|
||||
<li>When an option is given for more than one interface
|
||||
<li>An unnecessary jump to the policy chain is
|
||||
sometimes generated for a CONTINUE policy.</li>
|
||||
<li>When an option is given for more than one interface
|
||||
in /etc/shorewall/interfaces then depending on the option,
|
||||
Shorewall may ignore all but the first appearence of the
|
||||
option. For example:<br>
|
||||
<br>
|
||||
net eth0 dhcp<br>
|
||||
loc eth1 dhcp<br>
|
||||
<br>
|
||||
Shorewall will ignore the 'dhcp' on eth1.</li>
|
||||
<li>Update 17 June 2002 - The bug described in the
|
||||
prior bullet affects the following options: dhcp, dropunclean,
|
||||
logunclean, norfc1918, routefilter, multi, filterping and
|
||||
noping. An additional bug has been found that affects only
|
||||
the 'routestopped' option.<br>
|
||||
<br>
|
||||
Users who downloaded the corrected script prior
|
||||
<br>
|
||||
net eth0 dhcp<br>
|
||||
loc eth1 dhcp<br>
|
||||
<br>
|
||||
Shorewall will ignore the 'dhcp' on eth1.</li>
|
||||
<li>Update 17 June 2002 - The bug described in
|
||||
the prior bullet affects the following options: dhcp,
|
||||
dropunclean, logunclean, norfc1918, routefilter, multi,
|
||||
filterping and noping. An additional bug has been found
|
||||
that affects only the 'routestopped' option.<br>
|
||||
<br>
|
||||
Users who downloaded the corrected script prior
|
||||
to 1850 GMT today should download and install the corrected
|
||||
script again to ensure that this second problem is corrected.</li>
|
||||
script again to ensure that this second problem is corrected.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<p align="left">These problems are corrected in <a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.3.1/firewall">
|
||||
this firewall script</a> which should be installed in /etc/shorewall/firewall
|
||||
this firewall script</a> which should be installed in /etc/shorewall/firewall
|
||||
as described above.</p>
|
||||
|
||||
<h3 align="left">Version 1.3.0</h3>
|
||||
|
||||
<ul>
|
||||
<li>Folks who downloaded 1.3.0 from the links on
|
||||
the download page before 23:40 GMT, 29 May 2002 may have
|
||||
downloaded 1.2.13 rather than 1.3.0. The "shorewall version"
|
||||
command will tell you which version that you have installed.</li>
|
||||
<li>The documentation NAT.htm file uses non-existent
|
||||
wallpaper and bullet graphic files. The <a
|
||||
<li>Folks who downloaded 1.3.0 from the links on
|
||||
the download page before 23:40 GMT, 29 May 2002 may have
|
||||
downloaded 1.2.13 rather than 1.3.0. The "shorewall version"
|
||||
command will tell you which version that you have installed.</li>
|
||||
<li>The documentation NAT.htm file uses non-existent
|
||||
wallpaper and bullet graphic files. The <a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.3.0/NAT.htm">
|
||||
corrected version is here</a>.</li>
|
||||
corrected version is here</a>.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
@ -447,43 +458,46 @@ command will tell you which version that you have installed.</
|
||||
|
||||
<blockquote>
|
||||
<p align="left">There are a couple of serious bugs in iptables 1.2.3 that
|
||||
prevent it from working with Shorewall. Regrettably, RedHat
|
||||
released this buggy iptables in RedHat 7.2. </p>
|
||||
prevent it from working with Shorewall. Regrettably, RedHat
|
||||
released this buggy iptables in RedHat 7.2. </p>
|
||||
|
||||
|
||||
<p align="left"> I have built a <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3-3.i386.rpm">
|
||||
corrected 1.2.3 rpm which you can download here</a> and I have also
|
||||
built an <a
|
||||
corrected 1.2.3 rpm which you can download here</a> and I have also
|
||||
built an <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/iptables-1.2.4-1.i386.rpm">
|
||||
iptables-1.2.4 rpm which you can download here</a>. If you are currently
|
||||
iptables-1.2.4 rpm which you can download here</a>. If you are currently
|
||||
running RedHat 7.1, you can install either of these RPMs
|
||||
<b><u>before</u> </b>you upgrade to RedHat 7.2.</p>
|
||||
<b><u>before</u> </b>you upgrade to RedHat 7.2.</p>
|
||||
|
||||
<p align="left"><font color="#ff6633"><b>Update 11/9/2001: </b></font>RedHat
|
||||
has released an iptables-1.2.4 RPM of their own which you can download
|
||||
from<font color="#ff6633"> <a
|
||||
href="http://www.redhat.com/support/errata/RHSA-2001-144.html">http://www.redhat.com/support/errata/RHSA-2001-144.html</a>.
|
||||
</font>I have installed this RPM on my firewall and it works fine.</p>
|
||||
</font>I have installed this RPM on my firewall and it works fine.</p>
|
||||
|
||||
|
||||
<p align="left">If you would like to patch iptables 1.2.3 yourself,
|
||||
the patches are available for download. This <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/loglevel.patch">patch</a>
|
||||
which corrects a problem with parsing of the --log-level specification
|
||||
which corrects a problem with parsing of the --log-level specification
|
||||
while this <a
|
||||
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/tos.patch">patch</a>
|
||||
corrects a problem in handling the TOS target.</p>
|
||||
corrects a problem in handling the TOS target.</p>
|
||||
|
||||
|
||||
<p align="left">To install one of the above patches:</p>
|
||||
|
||||
<ul>
|
||||
<li>cd iptables-1.2.3/extensions</li>
|
||||
<li>patch -p0 < <i>the-patch-file</i></li>
|
||||
<li>cd iptables-1.2.3/extensions</li>
|
||||
<li>patch -p0 < <i>the-patch-file</i></li>
|
||||
|
||||
</ul>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<h3><a name="Debug"></a>Problems with kernels >= 2.4.18
|
||||
and RedHat iptables</h3>
|
||||
and RedHat iptables</h3>
|
||||
|
||||
<blockquote>
|
||||
<p>Users who use RedHat iptables RPMs and who upgrade to kernel 2.4.18/19
|
||||
@ -492,73 +506,74 @@ iptables-1.2.4 rpm which you can download here</a>. If you are currently
|
||||
<blockquote>
|
||||
|
||||
<pre># shorewall start<br>Processing /etc/shorewall/shorewall.conf ...<br>Processing /etc/shorewall/params ...<br>Starting Shorewall...<br>Loading Modules...<br>Initializing...<br>Determining Zones...<br>Zones: net<br>Validating interfaces file...<br>Validating hosts file...<br>Determining Hosts in Zones...<br>Net Zone: eth0:0.0.0.0/0<br>iptables: libiptc/libip4tc.c:380: do_check: Assertion<br>`h->info.valid_hooks == (1 << 0 | 1 << 3)' failed.<br>Aborted (core dumped)<br>iptables: libiptc/libip4tc.c:380: do_check: Assertion<br>`h->info.valid_hooks == (1 << 0 | 1 << 3)' failed.<br>Aborted (core dumped)<br></pre>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
<p>The RedHat iptables RPM is compiled with debugging enabled but the
|
||||
user-space debugging code was not updated to reflect recent changes in
|
||||
user-space debugging code was not updated to reflect recent changes in
|
||||
the Netfilter 'mangle' table. You can correct the problem by installing
|
||||
<a
|
||||
<a
|
||||
href="http://www.shorewall.net/pub/shorewall/iptables-1.2.5-1.i386.rpm">
|
||||
this iptables RPM</a>. If you are already running a 1.2.5 version
|
||||
of iptables, you will need to specify the --oldpackage option to rpm
|
||||
(e.g., "iptables -Uvh --oldpackage iptables-1.2.5-1.i386.rpm").</p>
|
||||
</blockquote>
|
||||
this iptables RPM</a>. If you are already running a 1.2.5 version
|
||||
of iptables, you will need to specify the --oldpackage option to
|
||||
rpm (e.g., "iptables -Uvh --oldpackage iptables-1.2.5-1.i386.rpm").</p>
|
||||
</blockquote>
|
||||
|
||||
|
||||
<h3><a name="SuSE"></a>Problems installing/upgrading
|
||||
RPM on SuSE</h3>
|
||||
|
||||
<p>If you find that rpm complains about a conflict
|
||||
with kernel <= 2.2 yet you have a 2.4 kernel
|
||||
installed, simply use the "--nodeps" option to
|
||||
rpm.</p>
|
||||
with kernel <= 2.2 yet you have a 2.4 kernel
|
||||
installed, simply use the "--nodeps" option to
|
||||
rpm.</p>
|
||||
|
||||
<p>Installing: rpm -ivh --nodeps <i><shorewall rpm></i></p>
|
||||
|
||||
<p>Upgrading: rpm -Uvh --nodeps <i><shorewall rpm></i></p>
|
||||
|
||||
<h3><a name="Multiport"></a><b>Problems with
|
||||
iptables version 1.2.7 and MULTIPORT=Yes</b></h3>
|
||||
iptables version 1.2.7 and MULTIPORT=Yes</b></h3>
|
||||
|
||||
<p>The iptables 1.2.7 release of iptables has made
|
||||
an incompatible change to the syntax used to
|
||||
specify multiport match rules; as a consequence,
|
||||
if you install iptables 1.2.7 you must be running
|
||||
Shorewall 1.3.7a or later or:</p>
|
||||
an incompatible change to the syntax used to
|
||||
specify multiport match rules; as a consequence,
|
||||
if you install iptables 1.2.7 you must be running
|
||||
Shorewall 1.3.7a or later or:</p>
|
||||
|
||||
<ul>
|
||||
<li>set MULTIPORT=No in
|
||||
/etc/shorewall/shorewall.conf; or </li>
|
||||
<li>if you are running Shorewall
|
||||
1.3.6 you may install
|
||||
<a
|
||||
<li>set MULTIPORT=No in
|
||||
/etc/shorewall/shorewall.conf; or </li>
|
||||
<li>if you are running Shorewall
|
||||
1.3.6 you may install
|
||||
<a
|
||||
href="http://www.shorewall.net/pub/shorewall/errata/1.3.6/firewall">
|
||||
this firewall script</a> in /var/lib/shorewall/firewall
|
||||
this firewall script</a> in /var/lib/shorewall/firewall
|
||||
as described above.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3><a name="NAT"></a>Problems with RH Kernel 2.4.18-10 and NAT<br>
|
||||
</h3>
|
||||
/etc/shorewall/nat entries of the following form will result in Shorewall
|
||||
being unable to start:<br>
|
||||
<br>
|
||||
</h3>
|
||||
/etc/shorewall/nat entries of the following form will result in
|
||||
Shorewall being unable to start:<br>
|
||||
<br>
|
||||
|
||||
<pre>#EXTERNAL INTERFACE INTERNAL ALL INTERFACES LOCAL<br>192.0.2.22 eth0 192.168.9.22 yes yes<br>#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</pre>
|
||||
Error message is:<br>
|
||||
Error message is:<br>
|
||||
|
||||
<pre>Setting up NAT...<br>iptables: Invalid argument<br>Terminated<br><br></pre>
|
||||
The solution is to put "no" in the LOCAL column. Kernel support for
|
||||
LOCAL=yes has never worked properly and 2.4.18-10 has disabled it. The
|
||||
2.4.19 kernel contains corrected support under a new kernel configuraiton
|
||||
option; see <a href="Documentation.htm#NAT">http://www.shorewall.net/Documentation.htm#NAT</a><br>
|
||||
The solution is to put "no" in the LOCAL column. Kernel support
|
||||
for LOCAL=yes has never worked properly and 2.4.18-10 has disabled it.
|
||||
The 2.4.19 kernel contains corrected support under a new kernel configuraiton
|
||||
option; see <a href="Documentation.htm#NAT">http://www.shorewall.net/Documentation.htm#NAT</a><br>
|
||||
|
||||
<p><font size="2"> Last updated 12/3/2002 -
|
||||
<a href="support.htm">Tom Eastep</a></font> </p>
|
||||
<p><font size="2"> Last updated 12/28/2002 -
|
||||
<a href="support.htm">Tom Eastep</a></font> </p>
|
||||
|
||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||
© <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font><br>
|
||||
</p>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
|
||||
@ -17,13 +17,13 @@
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#ffffff">GNU Mailman/Postfix the Easy
|
||||
Way</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
Way</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
@ -31,46 +31,49 @@ Way</font></h1>
|
||||
<h1 align="center"> </h1>
|
||||
|
||||
<h4>The following was posted on the Postfix mailing list on 5/4/2002 by Michael
|
||||
Tokarev as a suggested addition to the Postfix FAQ.</h4>
|
||||
Tokarev as a suggested addition to the Postfix FAQ.</h4>
|
||||
|
||||
<p>Q: Mailman does not work with Postfix, complaining about GID mismatch<br>
|
||||
<br>
|
||||
A: Mailman uses a setgid wrapper that is designed to be used in system-wide
|
||||
aliases file so that rest of mailman's mail handling processes will run
|
||||
<br>
|
||||
A: Mailman uses a setgid wrapper that is designed to be used in system-wide
|
||||
aliases file so that rest of mailman's mail handling processes will run
|
||||
with proper uid/gid. Postfix has an ability to run a command specified in
|
||||
an alias as owner of that alias, thus mailman's wrapper is not needed here.
|
||||
The best method to invoke mailman's mail handling via aliases is to use
|
||||
The best method to invoke mailman's mail handling via aliases is to use
|
||||
separate alias file especially for mailman, and made it owned by mailman
|
||||
and group mailman. Like:<br>
|
||||
<br>
|
||||
alias_maps = hash:/etc/postfix/aliases, hash:/var/mailman/aliases<br>
|
||||
<br>
|
||||
Make sure that /var/mailman/aliases.db is owned by mailman user (this may
|
||||
be done by executing postalias as mailman userid).<br>
|
||||
<br>
|
||||
Next, instead of using mailman-suggested aliases entries with wrapper, use
|
||||
the following:<br>
|
||||
<br>
|
||||
instead of<br>
|
||||
mailinglist: /var/mailman/mail/wrapper post mailinglist<br>
|
||||
mailinglist-admin: /var/mailman/mail/wrapper mailowner mailinglist<br>
|
||||
mailinglist-request: /var/mailman/mail/wrapper mailcmd mailinglist<br>
|
||||
...<br>
|
||||
<br>
|
||||
use<br>
|
||||
mailinglist: /var/mailman/scripts/post mailinglist<br>
|
||||
mailinglist-admin: /var/mailman/scripts/mailowner mailinglist<br>
|
||||
mailinglist-request: /var/mailman/scripts/mailcmd mailinglist<br>
|
||||
...</p>
|
||||
<br>
|
||||
alias_maps = hash:/etc/postfix/aliases, hash:/var/mailman/aliases<br>
|
||||
<br>
|
||||
Make sure that /var/mailman/aliases.db is owned by mailman user (this
|
||||
may be done by executing postalias as mailman userid).<br>
|
||||
<br>
|
||||
Next, instead of using mailman-suggested aliases entries with wrapper,
|
||||
use the following:<br>
|
||||
<br>
|
||||
instead of<br>
|
||||
mailinglist: /var/mailman/mail/wrapper post mailinglist<br>
|
||||
mailinglist-admin: /var/mailman/mail/wrapper mailowner mailinglist<br>
|
||||
mailinglist-request: /var/mailman/mail/wrapper mailcmd mailinglist<br>
|
||||
...<br>
|
||||
<br>
|
||||
use<br>
|
||||
mailinglist: /var/mailman/scripts/post mailinglist<br>
|
||||
mailinglist-admin: /var/mailman/scripts/mailowner mailinglist<br>
|
||||
mailinglist-request: /var/mailman/scripts/mailcmd mailinglist<br>
|
||||
...</p>
|
||||
|
||||
<h4>The Shorewall mailing lists are currently running Postfix 1.1.11 together
|
||||
with the stock RedHat Mailman-2.0.13 RPM configured as shown above.</h4>
|
||||
<h4>The above tip works with Mailman 2.0; Mailman 2.1 has adopted something
|
||||
very similar so that no workaround is necessary. See the README.POSTFIX file
|
||||
included with Mailman-2.1. </h4>
|
||||
|
||||
<p align="left"><font size="2">Last updated 9/14/2002 - <a
|
||||
<p align="left"><font size="2">Last updated 12/29/2002 - <a
|
||||
href="support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
||||
size="2">Copyright</font> © <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font></p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -12,6 +12,7 @@
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
<title>Shorewall Mailing Lists</title>
|
||||
|
||||
|
||||
<meta name="Microsoft Theme" content="none">
|
||||
</head>
|
||||
<body>
|
||||
@ -19,34 +20,35 @@
|
||||
<table height="90" bgcolor="#400169" id="AutoNumber1" width="100%"
|
||||
style="border-collapse: collapse;" cellspacing="0" cellpadding="0"
|
||||
border="0">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<h1 align="center"><a
|
||||
href="http://www.centralcommand.com/linux_products.html"><img
|
||||
src="images/Vexira_Antivirus_Logo.gif" alt="Vexira Logo" width="78"
|
||||
height="79" align="left">
|
||||
</a><a href="http://www.gnu.org/software/mailman/mailman.html">
|
||||
<img border="0" src="images/logo-sm.jpg" align="left" hspace="5"
|
||||
width="110" height="35">
|
||||
</a><a href="http://www.postfix.org/"> <img
|
||||
</a><a
|
||||
href="http://www.gnu.org/software/mailman/mailman.html"> <img
|
||||
border="0" src="images/logo-sm.jpg" align="left" hspace="5" width="110"
|
||||
height="35">
|
||||
</a><a href="http://www.postfix.org/"> <img
|
||||
src="images/small-picture.gif" align="right" border="0" width="115"
|
||||
height="45">
|
||||
</a><font color="#ffffff">Shorewall Mailing Lists<a
|
||||
</a><font color="#ffffff">Shorewall Mailing Lists<a
|
||||
href="http://www.inter7.com/courierimap/"><img
|
||||
src="images/courier-imap.png" alt="Courier-Imap" width="100"
|
||||
height="38" align="right">
|
||||
</a></font></h1>
|
||||
</a></font></h1>
|
||||
|
||||
|
||||
<p align="right"><font color="#ffffff"><b><br>
|
||||
</b></font></p>
|
||||
</b></font></p>
|
||||
|
||||
<p align="right"><font color="#ffffff"><b><br>
|
||||
Powered by Postfix </b></font> </p>
|
||||
</td>
|
||||
</tr>
|
||||
Powered by Postfix </b></font> </p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
@ -57,55 +59,56 @@
|
||||
href="mailing_list_problems.htm">Check Here</a></h2>
|
||||
|
||||
<p align="left">If you experience problems with any of these lists, please
|
||||
let <a href="mailto:teastep@shorewall.net">me</a> know</p>
|
||||
let <a href="mailto:teastep@shorewall.net">me</a> know</p>
|
||||
|
||||
<h2 align="left">Not able to Post Mail to shorewall.net?</h2>
|
||||
|
||||
<p align="left">You can report such problems by sending mail to tom dot eastep
|
||||
at hp dot com.</p>
|
||||
at hp dot com.</p>
|
||||
|
||||
<h2>A Word about SPAM Filters <a href="http://ordb.org"> <img border="0"
|
||||
src="images/but3.png" hspace="3" width="88" height="31">
|
||||
</a><a href="http://osirusoft.com/"> </a></h2>
|
||||
<h2>A Word about SPAM Filters <a href="http://ordb.org"></a><a
|
||||
href="http://osirusoft.com/"> </a></h2>
|
||||
|
||||
<p>Before subscribing please read my <a href="spam_filters.htm">policy
|
||||
about list traffic that bounces.</a> Also please note that the mail server
|
||||
at shorewall.net checks incoming mail:<br>
|
||||
</p>
|
||||
at shorewall.net checks incoming mail:<br>
|
||||
</p>
|
||||
|
||||
<ol>
|
||||
<li>against the open relay databases at <a
|
||||
href="http://ordb.org">ordb.org.</a></li>
|
||||
<li>to ensure that the sender address is fully qualified.</li>
|
||||
<li>to verify that the sender's domain has an A or MX record in DNS.</li>
|
||||
<li>to ensure that the host name in the HELO/EHLO command is a valid
|
||||
fully-qualified DNS name.</li>
|
||||
<li>against <a href="http://spamassassin.org">Spamassassin</a>
|
||||
(including <a href="http://razor.sourceforge.net/">Vipul's Razor</a>).<br>
|
||||
</li>
|
||||
<li>to ensure that the sender address is fully qualified.</li>
|
||||
<li>to verify that the sender's domain has an A or MX record in
|
||||
DNS.</li>
|
||||
<li>to ensure that the host name in the HELO/EHLO command is a
|
||||
valid fully-qualified DNS name that resolves.</li>
|
||||
|
||||
</ol>
|
||||
<h2>Please post in plain text</h2>
|
||||
While the list server here at shorewall.net accepts and distributes HTML
|
||||
posts, a growing number of MTAs serving list subscribers are rejecting this
|
||||
HTML list traffic. At least one MTA has gone so far as to blacklist shorewall.net
|
||||
"for continuous abuse"!!<br>
|
||||
<br>
|
||||
I think that blocking all HTML is a rather draconian way to control spam
|
||||
and that the unltimate loser here is not the spammers but the list subscribers
|
||||
whose MTAs are bouncing all shorewall.net mail. Nevertheless, all of you
|
||||
can help by restricting your list posts to plain text.<br>
|
||||
<br>
|
||||
And as a bonus, subscribers who use email clients like pine and mutt will
|
||||
be able to read your plain text posts whereas they are most likely simply
|
||||
ignoring your HTML posts.<br>
|
||||
<br>
|
||||
A final bonus for the use of HTML is that it cuts down the size of messages
|
||||
by a large percentage -- that is important when the same message must be
|
||||
sent 500 times over the slow DSL line connecting the list server to the internet.<br>
|
||||
|
||||
<h2></h2>
|
||||
<h2>Please post in plain text</h2>
|
||||
A growing number of MTAs serving list subscribers are rejecting all HTML
|
||||
traffic. At least one MTA has gone so far as to blacklist shorewall.net "for
|
||||
continuous abuse" because it has been my policy to allow HTML in list posts!!<br>
|
||||
<br>
|
||||
I think that blocking all HTML is a Draconian way to control spam and
|
||||
that the ultimate losers here are not the spammers but the list subscribers
|
||||
whose MTAs are bouncing all shorewall.net mail. As one list subscriber wrote
|
||||
to me privately "These e-mail admin's need to get a <i>(explitive deleted)</i>
|
||||
life instead of trying to rid the planet of HTML based e-mail". Nevertheless,
|
||||
to allow subscribers to receive list posts as must as possible, I have now
|
||||
configured the list server at shorewall.net to strip all HTML from outgoing
|
||||
posts.<br>
|
||||
<h2>Other Mail Delivery Problems</h2>
|
||||
If you find that you are missing an occasional list post, your e-mail admin
|
||||
may be blocking mail whose <i>Received:</i> headers contain the names of
|
||||
certain ISPs. Again, I believe that such policies hurt more than they help
|
||||
but I'm not prepared to go so far as to start stripping <i>Received:</i>
|
||||
headers to circumvent those policies.<br>
|
||||
|
||||
<h2 align="left">Mailing Lists Archive Search</h2>
|
||||
|
||||
<form method="post" action="http://www.shorewall.net/cgi-bin/htsearch">
|
||||
<form method="post" action="http://mail.shorewall.net/cgi-bin/htsearch">
|
||||
|
||||
<p> <font size="-1"> Match:
|
||||
<select name="method">
|
||||
@ -113,12 +116,12 @@ sent 500 times over the slow DSL line connecting the list server to the internet
|
||||
<option value="or">Any </option>
|
||||
<option value="boolean">Boolean </option>
|
||||
</select>
|
||||
Format:
|
||||
Format:
|
||||
<select name="format">
|
||||
<option value="builtin-long">Long </option>
|
||||
<option value="builtin-short">Short </option>
|
||||
</select>
|
||||
Sort by:
|
||||
Sort by:
|
||||
<select name="sort">
|
||||
<option value="score">Score </option>
|
||||
<option value="time">Time </option>
|
||||
@ -127,48 +130,49 @@ sent 500 times over the slow DSL line connecting the list server to the internet
|
||||
<option value="revtime">Reverse Time </option>
|
||||
<option value="revtitle">Reverse Title </option>
|
||||
</select>
|
||||
</font> <input type="hidden" name="config" value="htdig"> <input
|
||||
</font> <input type="hidden" name="config" value="htdig"> <input
|
||||
type="hidden" name="restrict"
|
||||
value="[http://www.shorewall.net/pipermail/.*]"> <input type="hidden"
|
||||
value="[http://mail.shorewall.net/pipermail/.*]"> <input type="hidden"
|
||||
name="exclude" value=""> <br>
|
||||
Search: <input type="text" size="30" name="words" value=""> <input
|
||||
Search: <input type="text" size="30" name="words" value=""> <input
|
||||
type="submit" value="Search"> </p>
|
||||
</form>
|
||||
</form>
|
||||
|
||||
<h2 align="left"><font color="#ff0000">Please do not try to download the entire
|
||||
Archive -- its 75MB (and growing daily) and my slow DSL line simply won't
|
||||
stand the traffic. If I catch you, you'll be blacklisted.<br>
|
||||
</font></h2>
|
||||
Archive -- it is 75MB (and growing daily) and my slow DSL line simply won't
|
||||
stand the traffic. If I catch you, you will be blacklisted.<br>
|
||||
</font></h2>
|
||||
|
||||
<h2 align="left">Shorewall CA Certificate</h2>
|
||||
If you want to trust X.509 certificates issued by Shoreline Firewall
|
||||
(such as the one used on my web site), you may <a
|
||||
If you want to trust X.509 certificates issued by Shoreline Firewall
|
||||
(such as the one used on my web site), you may <a
|
||||
href="Shorewall_CA_html.html">download and install my CA certificate</a>
|
||||
in your browser. If you don't wish to trust my certificates then you
|
||||
in your browser. If you don't wish to trust my certificates then you
|
||||
can either use unencrypted access when subscribing to Shorewall mailing
|
||||
lists or you can use secure access (SSL) and accept the server's certificate
|
||||
when prompted by your browser.<br>
|
||||
when prompted by your browser.<br>
|
||||
|
||||
<h2 align="left">Shorewall Users Mailing List</h2>
|
||||
|
||||
<p align="left">The Shorewall Users Mailing list provides a way for users
|
||||
to get answers to questions and to report problems. Information of general
|
||||
interest to the Shorewall user community is also posted to this list.</p>
|
||||
to get answers to questions and to report problems. Information of
|
||||
general interest to the Shorewall user community is also posted to
|
||||
this list.</p>
|
||||
|
||||
<p align="left"><b>Before posting a problem report to this list, please see
|
||||
the <a href="support.htm">problem reporting guidelines</a>.</b></p>
|
||||
the <a href="support.htm">problem reporting guidelines</a>.</b></p>
|
||||
|
||||
<p align="left">To subscribe to the mailing list, go to <a
|
||||
href="http://www.shorewall.net/mailman/listinfo/shorewall-users">http://www.shorewall.net/mailman/listinfo/shorewall-users</a>
|
||||
SSL: <a
|
||||
href="https://www.shorewall.net/mailman/listinfo/shorewall-users"
|
||||
target="_top">https//www.shorewall.net/mailman/listinfo/shorewall-users</a></p>
|
||||
href="http://mail.shorewall.net/mailman/listinfo/shorewall-users">http://mail.shorewall.net/mailman/listinfo/shorewall-users</a>
|
||||
SSL: <a
|
||||
href="https://mail.shorewall.net/mailman/listinfo/shorewall-users"
|
||||
target="_top">https//mail.shorewall.net/mailman/listinfo/shorewall-users</a></p>
|
||||
|
||||
<p align="left">To post to the list, post to <a
|
||||
href="mailto:shorewall-users@shorewall.net">shorewall-users@shorewall.net</a>.</p>
|
||||
|
||||
<p align="left">The list archives are at <a
|
||||
href="http://www.shorewall.net/pipermail/shorewall-users/index.html">http://www.shorewall.net/pipermail/shorewall-users</a>.</p>
|
||||
href="http://mail.shorewall.net/pipermail/shorewall-users/index.html">http://mail.shorewall.net/pipermail/shorewall-users</a>.</p>
|
||||
|
||||
<p align="left">Note that prior to 1/1/2002, the mailing list was hosted
|
||||
at <a href="http://sourceforge.net">Sourceforge</a>. The archives from that
|
||||
@ -178,55 +182,59 @@ list may be found at <a
|
||||
<h2 align="left">Shorewall Announce Mailing List</h2>
|
||||
|
||||
<p align="left">This list is for announcements of general interest to the
|
||||
Shorewall community. To subscribe, go to <a
|
||||
href="http://www.shorewall.net/mailman/listinfo/shorewall-announce">http://www.shorewall.net/mailman/listinfo/shorewall-announce</a>
|
||||
SSL: <a
|
||||
href="https://www.shorewall.net/mailman/listinfo/shorewall-announce"
|
||||
target="_top">https//www.shorewall.net/mailman/listinfo/shorewall-announce.<br>
|
||||
</a><br>
|
||||
The list archives are at <a
|
||||
href="http://www.shorewall.net/pipermail/shorewall-announce">http://www.shorewall.net/pipermail/shorewall-announce</a>.</p>
|
||||
Shorewall community. To subscribe, go to <a
|
||||
href="http://mail.shorewall.net/mailman/listinfo/shorewall-announce">http://mail.shorewall.net/mailman/listinfo/shorewall-announce</a>
|
||||
SSL: <a
|
||||
href="https://mail.shorewall.net/mailman/listinfo/shorewall-announce"
|
||||
target="_top">https//mail.shorewall.net/mailman/listinfo/shorewall-announce.<br>
|
||||
</a><br>
|
||||
The list archives are at <a
|
||||
href="http://mail.shorewall.net/pipermail/shorewall-announce">http://mail.shorewall.net/pipermail/shorewall-announce</a>.</p>
|
||||
|
||||
<h2 align="left">Shorewall Development Mailing List</h2>
|
||||
|
||||
<p align="left">The Shorewall Development Mailing list provides a forum for
|
||||
the exchange of ideas about the future of Shorewall and for coordinating
|
||||
ongoing Shorewall Development.</p>
|
||||
the exchange of ideas about the future of Shorewall and for coordinating
|
||||
ongoing Shorewall Development.</p>
|
||||
|
||||
<p align="left">To subscribe to the mailing list, go to <a
|
||||
href="http://www.shorewall.net/mailman/listinfo/shorewall-devel">http://www.shorewall.net/mailman/listinfo/shorewall-devel</a>
|
||||
SSL: <a
|
||||
href="https://www.shorewall.net/mailman/listinfo/shorewall-devel"
|
||||
target="_top">https//www.shorewall.net/mailman/listinfo/shorewall-devel.</a><br>
|
||||
To post to the list, post to <a
|
||||
href="http://mail.shorewall.net/mailman/listinfo/shorewall-devel">http://mail.shorewall.net/mailman/listinfo/shorewall-devel</a>
|
||||
SSL: <a
|
||||
href="https://mail.shorewall.net/mailman/listinfo/shorewall-devel"
|
||||
target="_top">https//mail.shorewall.net/mailman/listinfo/shorewall-devel.</a><br>
|
||||
To post to the list, post to <a
|
||||
href="mailto:shorewall-devel@shorewall.net">shorewall-devel@shorewall.net</a>. </p>
|
||||
|
||||
<p align="left">The list archives are at <a
|
||||
href="http://www.shorewall.net/pipermail/shorewall-devel">http://www.shorewall.net/pipermail/shorewall-devel</a>.</p>
|
||||
href="http://mail.shorewall.net/pipermail/shorewall-devel">http://mail.shorewall.net/pipermail/shorewall-devel</a>.</p>
|
||||
|
||||
<h2 align="left"><a name="Unsubscribe"></a>How to Unsubscribe from one of
|
||||
the Mailing Lists</h2>
|
||||
the Mailing Lists</h2>
|
||||
|
||||
<p align="left">There seems to be near-universal confusion about unsubscribing
|
||||
from Mailman-managed lists. To unsubscribe:</p>
|
||||
from Mailman-managed lists although Mailman 2.1 has attempted to make
|
||||
this less confusing. To unsubscribe:</p>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
|
||||
<p align="left">Follow the same link above that you used to subscribe
|
||||
to the list.</p>
|
||||
</li>
|
||||
<li>
|
||||
to the list.</p>
|
||||
</li>
|
||||
<li>
|
||||
|
||||
<p align="left">Down at the bottom of that page is the following text:
|
||||
"To change your subscription (set options like digest and delivery
|
||||
modes, get a reminder of your password, <b>or unsubscribe</b> from
|
||||
<name of list>), enter your subscription email address:". Enter
|
||||
your email address in the box and click on the "Edit Options" button.</p>
|
||||
</li>
|
||||
<li>
|
||||
" To <b>unsubscribe</b> from <i><list name></i>, get a password
|
||||
reminder, or change your subscription options enter your subscription
|
||||
email address:". Enter your email address in the box and click
|
||||
on the "<b>Unsubscribe</b> or edit options" button.</p>
|
||||
</li>
|
||||
<li>
|
||||
|
||||
<p align="left">There will now be a box where you can enter your password
|
||||
and click on "Unsubscribe"; if you have forgotten your password, there
|
||||
is another button that will cause your password to be emailed to you.</p>
|
||||
</li>
|
||||
and click on "Unsubscribe"; if you have forgotten your password, there
|
||||
is another button that will cause your password to be emailed to you.</p>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
@ -235,12 +243,14 @@ your email address in the box and click on the "Edit Options" button.</p>
|
||||
|
||||
<p align="left"><a href="gnu_mailman.htm">Check out these instructions</a></p>
|
||||
|
||||
<p align="left"><font size="2">Last updated 12/27/2002 - <a
|
||||
<p align="left"><font size="2">Last updated 12/29/2002 - <a
|
||||
href="support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
||||
size="2">Copyright</font> © <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font><br>
|
||||
</p>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -213,7 +213,7 @@ is also added as a separate page in "shorewall monitor"</li>
|
||||
than the LOG target. This allows you to run ulogd (available from <a
|
||||
href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
||||
and log all Shorewall messages <a
|
||||
href="configuration_file_basics.htm#Levels">to a separate log file</a>.</li>
|
||||
href="shorewall_logging.html">to a separate log file</a>.</li>
|
||||
<li>If you are running a kernel that has a FORWARD chain in the mangle
|
||||
table ("shorewall show mangle" will show you the chains in the mangle table),
|
||||
you can set MARK_IN_FORWARD_CHAIN=Yes in <a
|
||||
@ -269,7 +269,7 @@ refresh" would also fail.<br>
|
||||
rather than the LOG target. This allows you to run ulogd (available from
|
||||
<a href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
||||
and log all Shorewall messages <a
|
||||
href="configuration_file_basics.htm#Levels">to a separate log file</a>.</li>
|
||||
href="shorewall_logging.html">to a separate log file</a>.</li>
|
||||
<li>If you are running a kernel that has a FORWARD chain in
|
||||
the mangle table ("shorewall show mangle" will show you the chains in the
|
||||
mangle table), you can set MARK_IN_FORWARD_CHAIN=Yes in shorewall.conf.
|
||||
|
||||
137
Shorewall-docs/shorewall_logging.html
Normal file
137
Shorewall-docs/shorewall_logging.html
Normal file
@ -0,0 +1,137 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
<title>Shorewall Logging</title>
|
||||
<meta http-equiv="content-type"
|
||||
content="text/html; charset=ISO-8859-1">
|
||||
<meta name="author" content="Tom Eastep">
|
||||
</head>
|
||||
<body>
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||
id="AutoNumber1" bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Logging</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
<br>
|
||||
By default, Shorewall directs NetFilter to log using syslog (8). Syslog
|
||||
classifies log messages by a <i>facility</i> and a <i>priority</i> (using
|
||||
the notation <i>facility.priority</i>). <br>
|
||||
<br>
|
||||
The facilities defined by syslog are <i>auth, authpriv, cron, daemon,
|
||||
kern, lpr, mail, mark, news, syslog, user, uucp</i> and <i>local0</i> through
|
||||
<i>local7</i>.<br>
|
||||
<br>
|
||||
Throughout the Shorewall documentation, I will use the term <i>level</i>
|
||||
rather than <i>priority</i> since <i>level</i> is the term used by NetFilter.
|
||||
The syslog documentation uses the term <i>priority</i>.<br>
|
||||
|
||||
<h3>Syslog Levels<br>
|
||||
</h3>
|
||||
Syslog levels are a method of describing to syslog (8) the importance
|
||||
of a message and a number of Shorewall parameters have a syslog level as
|
||||
their value.<br>
|
||||
<br>
|
||||
Valid levels are:<br>
|
||||
<br>
|
||||
7
|
||||
debug<br>
|
||||
6
|
||||
info<br>
|
||||
5
|
||||
notice<br>
|
||||
4
|
||||
warning<br>
|
||||
3
|
||||
err<br>
|
||||
2
|
||||
crit<br>
|
||||
1
|
||||
alert<br>
|
||||
0
|
||||
emerg<br>
|
||||
<br>
|
||||
For most Shorewall logging, a level of 6 (info) is appropriate. Shorewall
|
||||
log messages are generated by NetFilter and are logged using the <i>kern</i>
|
||||
facility and the level that you specify. If you are unsure of the level
|
||||
to choose, 6 (info) is a safe bet. You may specify levels by name or by
|
||||
number.<br>
|
||||
<br>
|
||||
Syslogd writes log messages to files (typically in /var/log/*) based
|
||||
on their facility and level. The mapping of these facility/level pairs
|
||||
to log files is done in /etc/syslog.conf (5). If you make changes to this
|
||||
file, you must restart syslogd before the changes can take effect.<br>
|
||||
|
||||
<h3>Configuring a Separate Log for Shorewall Messages</h3>
|
||||
There are a couple of limitations to syslogd-based logging:<br>
|
||||
|
||||
<ol>
|
||||
<li>If you give, for example, kern.info it's own log destination then
|
||||
that destination will also receive all kernel messages of levels 5 (notice)
|
||||
through 0 (emerg).</li>
|
||||
<li>All kernel.info messages will go to that destination and not just
|
||||
those from NetFilter.<br>
|
||||
</li>
|
||||
</ol>
|
||||
Beginning with Shorewall version 1.3.12, if your kernel has ULOG target
|
||||
support (and most vendor-supplied kernels do), you may also specify a log
|
||||
level of ULOG (must be all caps). When ULOG is used, Shorewall will direct
|
||||
netfilter to log the related messages via the ULOG target which will send
|
||||
them to a process called 'ulogd'. The ulogd program is available from http://www.gnumonks.org/projects/ulogd
|
||||
and can be configured to log all Shorewall message to their own log file.<br>
|
||||
<br>
|
||||
Download the ulod tar file and:<br>
|
||||
|
||||
<ol>
|
||||
<li>cd /usr/local/src (or wherever you do your builds)</li>
|
||||
<li>tar -zxf <i>source-tarball-that-you-downloaded</i></li>
|
||||
<li>cd ulogd-<i>version</i><br>
|
||||
</li>
|
||||
<li>./configure</li>
|
||||
<li>make</li>
|
||||
<li>make install<br>
|
||||
</li>
|
||||
</ol>
|
||||
If you are like me and don't have a development environment on your firewall,
|
||||
you can do the first five steps on another system then either NFS mount
|
||||
your /usr/local/src directory or tar up the /usr/local/src/ulogd-<i>version</i>
|
||||
directory and move it to your firewall system.<br>
|
||||
<br>
|
||||
Now on the firewall system, edit /usr/local/etc/ulogd.conf and set:<br>
|
||||
|
||||
<ol>
|
||||
<li>syslogfile <i><file that you wish to log to></i></li>
|
||||
<li>syslogsync 1</li>
|
||||
</ol>
|
||||
I also copied the file /usr/local/src/ulogd-<i>version</i>/ulogd.init to
|
||||
/etc/init.d/ulogd. I had to edit the line that read "daemon /usr/local/sbin/ulogd"
|
||||
to read daemon /usr/local/sbin/ulogd -d". On a RedHat system, a simple "chkconfig
|
||||
--level 3 ulogd on" starts ulogd during boot up. Your init system may need
|
||||
something else done to activate the script.<br>
|
||||
<br>
|
||||
Finally edit /etc/shorewall/shorewall.conf and set LOGFILE=<i><file
|
||||
that you wish to log to></i>. This tells the /sbin/shorewall program
|
||||
where to look for the log when processing its "show log", "logwatch" and
|
||||
"monitor" commands.<br>
|
||||
|
||||
<p><font size="2"> Updated 12/29/2002 - <a
|
||||
href="file:///home/teastep/Shorewall-docs/support.htm">Tom Eastep</a>
|
||||
</font></p>
|
||||
|
||||
|
||||
|
||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||
© <font size="2">2001, 2002 Thomas M. Eastep</font></a></font><br>
|
||||
</p>
|
||||
|
||||
<h2><br>
|
||||
</h2>
|
||||
</body>
|
||||
</html>
|
||||
@ -20,20 +20,20 @@
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Shorewall QuickStart Guides<br>
|
||||
Version 3.1</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
Version 3.1</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<p align="center">With thanks to Richard who reminded me once again that
|
||||
we must all first walk before we can run.</p>
|
||||
<p align="center">With thanks to Richard who reminded me once again that we
|
||||
must all first walk before we can run.</p>
|
||||
|
||||
<h2>The Guides</h2>
|
||||
|
||||
@ -43,12 +43,12 @@ we must all first walk before we can run.</p>
|
||||
<p>The following guides are for <b>users who have a single public IP address</b>:</p>
|
||||
|
||||
<ul>
|
||||
<li><a href="standalone.htm">Standalone</a> Linux System</li>
|
||||
<li><a href="two-interface.htm">Two-interface</a> Linux System
|
||||
acting as a firewall/router for a small local network</li>
|
||||
<li><a href="three-interface.htm">Three-interface</a> Linux
|
||||
System acting as a firewall/router for a small local network and
|
||||
a DMZ.</li>
|
||||
<li><a href="standalone.htm">Standalone</a> Linux System</li>
|
||||
<li><a href="two-interface.htm">Two-interface</a> Linux System
|
||||
acting as a firewall/router for a small local network</li>
|
||||
<li><a href="three-interface.htm">Three-interface</a> Linux
|
||||
System acting as a firewall/router for a small local network and a
|
||||
DMZ.</li>
|
||||
|
||||
</ul>
|
||||
|
||||
@ -61,21 +61,22 @@ a DMZ.</li>
|
||||
than is explained in the single-address guides above.</b></p>
|
||||
|
||||
<ul>
|
||||
<li><a href="shorewall_setup_guide.htm#Introduction">1.0 Introduction</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Concepts">2.0 Shorewall
|
||||
Concepts</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Interfaces">3.0 Network
|
||||
Interfaces</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Addressing">4.0 Addressing,
|
||||
Subnets and Routing</a>
|
||||
<li><a href="shorewall_setup_guide.htm#Introduction">1.0
|
||||
Introduction</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Concepts">2.0 Shorewall
|
||||
Concepts</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Interfaces">3.0 Network
|
||||
Interfaces</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Addressing">4.0 Addressing,
|
||||
Subnets and Routing</a>
|
||||
|
||||
<ul>
|
||||
<li><a href="shorewall_setup_guide.htm#Addresses">4.1 IP
|
||||
Addresses</a></li>
|
||||
<li><a
|
||||
<li><a href="shorewall_setup_guide.htm#Addresses">4.1 IP
|
||||
Addresses</a></li>
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#Subnets">4.2 Subnets</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Routing">4.3 Routing</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#ARP">4.4 Address
|
||||
<li><a href="shorewall_setup_guide.htm#Routing">4.3 Routing</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#ARP">4.4 Address
|
||||
Resolution Protocol</a></li>
|
||||
|
||||
|
||||
@ -83,48 +84,48 @@ Resolution Protocol</a></li>
|
||||
|
||||
|
||||
<ul>
|
||||
<li><a href="shorewall_setup_guide.htm#RFC1918">4.5 RFC
|
||||
<li><a href="shorewall_setup_guide.htm#RFC1918">4.5 RFC
|
||||
1918</a></li>
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="shorewall_setup_guide.htm#Options">5.0 Setting
|
||||
</li>
|
||||
<li><a href="shorewall_setup_guide.htm#Options">5.0 Setting
|
||||
up your Network</a>
|
||||
|
||||
<ul>
|
||||
<li><a href="shorewall_setup_guide.htm#Routed">5.1 Routed</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#Routed">5.1 Routed</a></li>
|
||||
|
||||
|
||||
</ul>
|
||||
|
||||
|
||||
<ul>
|
||||
<li><a href="shorewall_setup_guide.htm#NonRouted">5.2 Non-routed</a>
|
||||
<li><a href="shorewall_setup_guide.htm#NonRouted">5.2 Non-routed</a>
|
||||
|
||||
|
||||
<ul>
|
||||
<li><a href="shorewall_setup_guide.htm#SNAT">5.2.1 SNAT</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#DNAT">5.2.2 DNAT</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#ProxyARP">5.2.3
|
||||
Proxy ARP</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#NAT">5.2.4 Static
|
||||
NAT</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#SNAT">5.2.1 SNAT</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#DNAT">5.2.2 DNAT</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#ProxyARP">5.2.3
|
||||
Proxy ARP</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#NAT">5.2.4 Static
|
||||
NAT</a></li>
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="shorewall_setup_guide.htm#Rules">5.3 Rules</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#OddsAndEnds">5.4
|
||||
</li>
|
||||
<li><a href="shorewall_setup_guide.htm#Rules">5.3 Rules</a></li>
|
||||
<li><a href="shorewall_setup_guide.htm#OddsAndEnds">5.4
|
||||
Odds and Ends</a></li>
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="shorewall_setup_guide.htm#DNS">6.0 DNS</a></li>
|
||||
<li><a
|
||||
</li>
|
||||
<li><a href="shorewall_setup_guide.htm#DNS">6.0 DNS</a></li>
|
||||
<li><a
|
||||
href="shorewall_setup_guide.htm#StartingAndStopping">7.0 Starting and
|
||||
Stopping the Firewall</a></li>
|
||||
Stopping the Firewall</a></li>
|
||||
|
||||
</ul>
|
||||
|
||||
@ -136,119 +137,128 @@ described above</b>. Please review the appropriate guide before trying
|
||||
to use this documentation directly.</p>
|
||||
|
||||
<ul>
|
||||
<li><a href="blacklisting_support.htm">Blacklisting</a>
|
||||
<li><a href="blacklisting_support.htm">Blacklisting</a>
|
||||
|
||||
<ul>
|
||||
<li>Static Blacklisting using /etc/shorewall/blacklist</li>
|
||||
<li>Dynamic Blacklisting using /sbin/shorewall</li>
|
||||
<li>Static Blacklisting using /etc/shorewall/blacklist</li>
|
||||
<li>Dynamic Blacklisting using /sbin/shorewall</li>
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="configuration_file_basics.htm">Common configuration
|
||||
file features</a>
|
||||
</li>
|
||||
<li><a href="configuration_file_basics.htm">Common configuration
|
||||
file features</a>
|
||||
|
||||
<ul>
|
||||
<li>Comments in configuration files</li>
|
||||
<li>Line Continuation</li>
|
||||
<li>Port Numbers/Service Names</li>
|
||||
<li>Port Ranges</li>
|
||||
<li>Using Shell Variables</li>
|
||||
<li>Using DNS Names<br>
|
||||
</li>
|
||||
<li>Complementing an IP address or Subnet</li>
|
||||
<li>Shorewall Configurations (making a test configuration)</li>
|
||||
<li>Using MAC Addresses in Shorewall</li>
|
||||
<li>Logging<br>
|
||||
</li>
|
||||
<li><a href="configuration_file_basics.htm#Comments">Comments
|
||||
in configuration files</a></li>
|
||||
<li><a
|
||||
href="configuration_file_basics.htm#Continuation">Line Continuation</a></li>
|
||||
<li><a href="configuration_file_basics.htm#Ports">Port
|
||||
Numbers/Service Names</a></li>
|
||||
<li><a href="configuration_file_basics.htm#Ranges">Port
|
||||
Ranges</a></li>
|
||||
<li><a href="configuration_file_basics.htm#Variables">Using
|
||||
Shell Variables</a></li>
|
||||
<li><a href="configuration_file_basics.htm#dnsnames">Using
|
||||
DNS Names</a><br>
|
||||
</li>
|
||||
<li><a href="configuration_file_basics.htm#Compliment">Complementing
|
||||
an IP address or Subnet</a></li>
|
||||
<li><a href="configuration_file_basics.htm#Configs">Shorewall
|
||||
Configurations (making a test configuration)</a></li>
|
||||
<li><a href="configuration_file_basics.htm#MAC">Using MAC
|
||||
Addresses in Shorewall</a></li>
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="Documentation.htm">Configuration File Reference
|
||||
Manual</a>
|
||||
</li>
|
||||
<li><a href="Documentation.htm">Configuration File Reference
|
||||
Manual</a>
|
||||
|
||||
<ul>
|
||||
<li> <a href="Documentation.htm#Variables">params</a></li>
|
||||
<li><font color="#000099"><a
|
||||
<li> <a href="Documentation.htm#Variables">params</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Zones">zones</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Interfaces">interfaces</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Hosts">hosts</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Policy">policy</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Rules">rules</a></font></li>
|
||||
<li><a href="Documentation.htm#Common">common</a></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><a href="Documentation.htm#Common">common</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Masq">masq</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#ProxyArp">proxyarp</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#NAT">nat</a></font></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Tunnels">tunnels</a></font></li>
|
||||
<li><a href="traffic_shaping.htm#tcrules">tcrules</a></li>
|
||||
<li><font color="#000099"><a
|
||||
<li><a href="traffic_shaping.htm#tcrules">tcrules</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="Documentation.htm#Conf">shorewall.conf</a></font></li>
|
||||
<li><a href="Documentation.htm#modules">modules</a></li>
|
||||
<li><a href="Documentation.htm#TOS">tos</a> </li>
|
||||
<li><a href="Documentation.htm#Blacklist">blacklist</a></li>
|
||||
<li><a href="Documentation.htm#rfc1918">rfc1918</a></li>
|
||||
<li><a href="Documentation.htm#Routestopped">routestopped</a></li>
|
||||
<li><a href="Documentation.htm#modules">modules</a></li>
|
||||
<li><a href="Documentation.htm#TOS">tos</a> </li>
|
||||
<li><a href="Documentation.htm#Blacklist">blacklist</a></li>
|
||||
<li><a href="Documentation.htm#rfc1918">rfc1918</a></li>
|
||||
<li><a href="Documentation.htm#Routestopped">routestopped</a></li>
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="dhcp.htm">DHCP</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="shorewall_extension_scripts.htm">Extension Scripts</a></font> (How
|
||||
to extend Shorewall without modifying Shorewall code)</li>
|
||||
<li><a href="fallback.htm">Fallback/Uninstall</a></li>
|
||||
<li><a href="shorewall_firewall_structure.htm">Firewall Structure</a></li>
|
||||
<li><font color="#000099"><a href="kernel.htm">Kernel Configuration</a></font></li>
|
||||
<li><a href="configuration_file_basics.htm#Levels">Logging</a><br>
|
||||
</li>
|
||||
<li><a href="myfiles.htm">My Configuration Files</a> (How
|
||||
I personally use Shorewall)</li>
|
||||
<li><a href="ping.html">'Ping' Management</a><br>
|
||||
</li>
|
||||
<li><a href="dhcp.htm">DHCP</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="shorewall_extension_scripts.htm">Extension Scripts</a></font>
|
||||
(How to extend Shorewall without modifying Shorewall code)</li>
|
||||
<li><a href="fallback.htm">Fallback/Uninstall</a></li>
|
||||
<li><a href="shorewall_firewall_structure.htm">Firewall Structure</a></li>
|
||||
<li><font color="#000099"><a href="kernel.htm">Kernel Configuration</a></font></li>
|
||||
<li><a href="shorewall_logging.html">Logging</a><br>
|
||||
</li>
|
||||
<li><a href="ports.htm">Port Information</a>
|
||||
<li><a href="MAC_Validation.html">MAC Verification</a><br>
|
||||
</li>
|
||||
<li><a href="myfiles.htm">My Configuration Files</a> (How I personally
|
||||
use Shorewall)</li>
|
||||
<li><a href="ping.html">'Ping' Management</a><br>
|
||||
</li>
|
||||
<li><a href="ports.htm">Port Information</a>
|
||||
|
||||
<ul>
|
||||
<li>Which applications use which ports</li>
|
||||
<li>Ports used by Trojans</li>
|
||||
<li>Which applications use which ports</li>
|
||||
<li>Ports used by Trojans</li>
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="ProxyARP.htm">Proxy ARP</a></li>
|
||||
<li><a href="samba.htm">Samba</a></li>
|
||||
<li><font color="#000099"><a
|
||||
</li>
|
||||
<li><a href="ProxyARP.htm">Proxy ARP</a></li>
|
||||
<li><a href="samba.htm">Samba</a></li>
|
||||
<li><font color="#000099"><a
|
||||
href="starting_and_stopping_shorewall.htm">Starting/stopping the Firewall</a></font></li>
|
||||
|
||||
<ul>
|
||||
<li>Description of all /sbin/shorewall commands</li>
|
||||
<li>How to safely test a Shorewall configuration change<br>
|
||||
</li>
|
||||
<li>Description of all /sbin/shorewall commands</li>
|
||||
<li>How to safely test a Shorewall configuration change<br>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
<li><font color="#000099"><a href="NAT.htm">Static NAT</a></font></li>
|
||||
<li><a href="traffic_shaping.htm">Traffic Shaping/Control</a></li>
|
||||
<li>VPN
|
||||
<li><font color="#000099"><a href="NAT.htm">Static NAT</a></font></li>
|
||||
<li><a href="traffic_shaping.htm">Traffic Shaping/Control</a></li>
|
||||
<li>VPN
|
||||
|
||||
<ul>
|
||||
<li><a href="IPSEC.htm">IPSEC</a></li>
|
||||
<li><a href="IPIP.htm">GRE and IPIP</a></li>
|
||||
<li><a href="PPTP.htm">PPTP</a></li>
|
||||
<li><a href="VPN.htm">IPSEC/PPTP</a> from a system behind
|
||||
<li><a href="IPSEC.htm">IPSEC</a></li>
|
||||
<li><a href="IPIP.htm">GRE and IPIP</a></li>
|
||||
<li><a href="PPTP.htm">PPTP</a></li>
|
||||
<li><a href="VPN.htm">IPSEC/PPTP</a> from a system behind
|
||||
your firewall to a remote network.</li>
|
||||
|
||||
|
||||
</ul>
|
||||
</li>
|
||||
<li><a href="whitelisting_under_shorewall.htm">White List
|
||||
</li>
|
||||
<li><a href="whitelisting_under_shorewall.htm">White List
|
||||
Creation</a></li>
|
||||
|
||||
</ul>
|
||||
@ -256,14 +266,9 @@ Creation</a></li>
|
||||
<p>If you use one of these guides and have a suggestion for improvement <a
|
||||
href="mailto:webmaster@shorewall.net">please let me know</a>.</p>
|
||||
|
||||
<p><font size="2">Last modified 12/13/2002 - <a href="support.htm">Tom Eastep</a></font></p>
|
||||
<p><font size="2">Last modified 12/29/2002 - <a href="support.htm">Tom Eastep</a></font></p>
|
||||
|
||||
<p><a href="copyright.htm"><font size="2">Copyright 2002 Thomas M. Eastep</font></a><br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</p>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -239,7 +239,7 @@ the request is first checked against the rules in /etc/shorewall/common.def.</
|
||||
<li>allow all connection requests from your local network to the internet</li>
|
||||
<li>drop (ignore) all connection requests from the internet to your
|
||||
firewall or local network and log a message at the <i>info</i> level
|
||||
(<a href="configuration_file_basics.htm#Levels">here</a> is a description
|
||||
(<a href="shorewall_logging.html">here</a> is a description
|
||||
of log levels).</li>
|
||||
<li>reject all other connection requests and log a message at the <i>info</i>
|
||||
level. When a request is rejected, the firewall will return an RST (if
|
||||
|
||||
@ -200,7 +200,7 @@ is also added as a separate page in "shorewall monitor"</li>
|
||||
than the LOG target. This allows you to run ulogd (available from <a
|
||||
href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
||||
and log all Shorewall messages <a
|
||||
href="configuration_file_basics.htm#Levels">to a separate log file</a>.</li>
|
||||
href="shorewall_logging.html">to a separate log file</a>.</li>
|
||||
<li>If you are running a kernel that has a FORWARD chain in the
|
||||
mangle table ("shorewall show mangle" will show you the chains in the
|
||||
mangle table), you can set MARK_IN_FORWARD_CHAIN=Yes in <a
|
||||
@ -257,7 +257,7 @@ to start and "shorewall refresh" would also fail.<br>
|
||||
rather than the LOG target. This allows you to run ulogd (available from
|
||||
<a href="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</a>)
|
||||
and log all Shorewall messages <a
|
||||
href="configuration_file_basics.htm#Levels">to a separate log file</a>.</li>
|
||||
href="shorewall_logging.html">to a separate log file</a>.</li>
|
||||
<li>If you are running a kernel that has a FORWARD chain in
|
||||
the mangle table ("shorewall show mangle" will show you the chains in the
|
||||
mangle table), you can set MARK_IN_FORWARD_CHAIN=Yes in shorewall.conf.
|
||||
|
||||
@ -25,74 +25,74 @@
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
|
||||
bgcolor="#400169" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
|
||||
|
||||
<h1 align="center"><font color="#ffffff">Shorewall Support<img
|
||||
src="images/obrasinf.gif" alt="" width="90" height="90" align="middle">
|
||||
</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<p> <br>
|
||||
<span style="font-weight: 400;"></span></p>
|
||||
<span style="font-weight: 400;"></span></p>
|
||||
|
||||
<h2><big><font color="#ff0000"><b>I don't look at problems sent to me directly
|
||||
but I try to spend some amount of time each day responding to problems
|
||||
posted on the Shorewall mailing list.</b></font></big></h2>
|
||||
but I try to spend some amount of time each day responding to
|
||||
problems posted on the Shorewall mailing list.</b></font></big></h2>
|
||||
|
||||
<h2 align="center"><big><font color="#ff0000"><b>-Tom</b></font></big></h2>
|
||||
|
||||
<h2>Before Reporting a Problem</h2>
|
||||
|
||||
<h3>T<b>here are a number of sources for problem solution information. Please
|
||||
try these before you post.</b></h3>
|
||||
try these before you post.</b></h3>
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<h3><b>The <a href="FAQ.htm">FAQ</a> has solutions to more than 20 common
|
||||
problems.</b></h3>
|
||||
</li>
|
||||
problems.</b></h3>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<h3><b>The <a href="troubleshoot.htm">Troubleshooting</a> Information
|
||||
contains a number of tips to help you solve common problems.</b></h3>
|
||||
</li>
|
||||
contains a number of tips to help you solve common problems.</b></h3>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<h3><b>The <a href="errata.htm"> Errata</a> has links to download
|
||||
updated components.</b></h3>
|
||||
</li>
|
||||
updated components.</b></h3>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<h3><b>The Mailing List Archives search facility can locate posts
|
||||
about similar problems:</b></h3>
|
||||
</li>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
@ -109,13 +109,13 @@
|
||||
<option value="or">Any </option>
|
||||
<option value="boolean">Boolean </option>
|
||||
</select>
|
||||
Format:
|
||||
Format:
|
||||
|
||||
<select name="format">
|
||||
<option value="builtin-long">Long </option>
|
||||
<option value="builtin-short">Short </option>
|
||||
</select>
|
||||
Sort by:
|
||||
Sort by:
|
||||
|
||||
<select name="sort">
|
||||
<option value="score">Score </option>
|
||||
@ -125,129 +125,131 @@
|
||||
<option value="revtime">Reverse Time </option>
|
||||
<option value="revtitle">Reverse Title </option>
|
||||
</select>
|
||||
</font> <input type="hidden" name="config"
|
||||
</font> <input type="hidden" name="config"
|
||||
value="htdig"> <input type="hidden" name="restrict"
|
||||
value="[http://www.shorewall.net/pipermail/.*]"> <input type="hidden"
|
||||
name="exclude" value=""> <br>
|
||||
Search: <input type="text" size="30" name="words"
|
||||
Search: <input type="text" size="30" name="words"
|
||||
value=""> <input type="submit" value="Search"> </p>
|
||||
</form>
|
||||
</form>
|
||||
|
||||
<h2>Problem Reporting Guidelines</h2>
|
||||
<i>"Let me see if I can translate your message into a real-world example.
|
||||
It would be like saying that you have three rooms at home, and when you
|
||||
<i>"Let me see if I can translate your message into a real-world example.
|
||||
It would be like saying that you have three rooms at home, and when you
|
||||
walk into one of the rooms, you detect this strange smell. Can anyone tell
|
||||
you what that strange smell is?<br>
|
||||
<br>
|
||||
Now, all of us could do some wonderful guessing as to the smell and even
|
||||
what's causing it. You would be absolutely amazed at the range and variety
|
||||
of smells we could come up with. Even more amazing is that all of the explanations
|
||||
for the smells would be completely plausible."<br>
|
||||
</i><br>
|
||||
<br>
|
||||
Now, all of us could do some wonderful guessing as to the smell and even
|
||||
what's causing it. You would be absolutely amazed at the range and variety
|
||||
of smells we could come up with. Even more amazing is that all of the
|
||||
explanations for the smells would be completely plausible."<br>
|
||||
</i><br>
|
||||
|
||||
<div align="center"> - Russell Mosemann<br>
|
||||
</div>
|
||||
<br>
|
||||
</div>
|
||||
<br>
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<h3><b>When reporting a problem, give as much information as you can.
|
||||
Reports that say "I tried XYZ and it didn't work" are not at all helpful.</b></h3>
|
||||
</li>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<h3><b>Please don't describe your environment and then ask us to send
|
||||
you custom configuration files. We're here to answer your
|
||||
questions but we can't do your job for you.</b></h3>
|
||||
</li>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<h3><b>Do you see any "Shorewall" messages in /var/log/messages
|
||||
when you exercise the function that is giving you problems?</b></h3>
|
||||
</li>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<h3><b>Have you looked at the packet flow with a tool like tcpdump
|
||||
to try to understand what is going on?</b></h3>
|
||||
</li>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<h3><b>Have you tried using the diagnostic capabilities of the
|
||||
application that isn't working? For example, if "ssh" isn't able
|
||||
to connect, using the "-v" option gives you a lot of valuable diagnostic
|
||||
information.</b></h3>
|
||||
</li>
|
||||
information.</b></h3>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<h3><b>Please include any of the Shorewall configuration files (especially
|
||||
the /etc/shorewall/hosts file if you have modified that file)
|
||||
that you think are relevant.</b></h3>
|
||||
</li>
|
||||
<li>
|
||||
<h3><b>If an error occurs when you try to "shorewall start", include
|
||||
a trace (See the <a href="troubleshoot.htm">Troubleshooting</a> section
|
||||
for instructions).</b></h3>
|
||||
the /etc/shorewall/hosts file if you have modified that file)
|
||||
that you think are relevant.</b></h3>
|
||||
</li>
|
||||
<li>
|
||||
<h3><b>If an error occurs when you try to "shorewall start", include
|
||||
a trace (See the <a href="troubleshoot.htm">Troubleshooting</a> section
|
||||
for instructions).</b></h3>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3> </h3>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<li>
|
||||
<h3><b>The list server limits posts to 120kb so don't post GIFs of
|
||||
your network layout, etc to the Mailing List -- your post
|
||||
will be rejected.</b></h3>
|
||||
</li>
|
||||
your network layout, etc to the Mailing List -- your post
|
||||
will be rejected.</b></h3>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
|
||||
<h3> </h3>
|
||||
<br>
|
||||
|
||||
<h2>Please post in plain text</h2>
|
||||
|
||||
<blockquote>
|
||||
<h3><b> While the list server here at shorewall.net accepts and distributes
|
||||
HTML posts, a growing number of MTAs serving list subscribers are rejecting
|
||||
this HTML list traffic. At least one MTA has gone so far as to blacklist
|
||||
shorewall.net "for continuous abuse"!!</b></h3>
|
||||
<h3><b> I think that blocking all HTML is a rather draconian way to control
|
||||
spam and that the unltimate loser here is not the spammers but the list subscribers
|
||||
whose MTAs are bouncing all shorewall.net mail. Nevertheless, all of you can
|
||||
help by restricting your list posts to plain text.</b></h3>
|
||||
<h3><b> And as a bonus, subscribers who use email clients like pine and
|
||||
mutt will be able to read your plain text posts whereas they are most likely
|
||||
simply ignoring your HTML posts.</b></h3>
|
||||
<h3><b> A final bonus for the use of HTML is that it cuts down the size
|
||||
of messages by a large percentage -- that is important when the same message
|
||||
must be sent 500 times over the slow DSL line connecting the list server
|
||||
to the internet.</b> </h3>
|
||||
<h3> A growing number of MTAs serving list subscribers are rejecting all
|
||||
HTML traffic. At least one MTA has gone so far as to blacklist shorewall.net
|
||||
"for continuous abuse" because it has been my policy to allow HTML in list
|
||||
posts!!<br>
|
||||
<br>
|
||||
I think that blocking all HTML is a Draconian way to control spam and
|
||||
that the ultimate losers here are not the spammers but the list subscribers
|
||||
whose MTAs are bouncing all shorewall.net mail. As one list subscriber wrote
|
||||
to me privately "These e-mail admin's need to get a <i>(explitive deleted)</i>
|
||||
life instead of trying to rid the planet of HTML based e-mail". Nevertheless,
|
||||
to allow subscribers to receive list posts as must as possible, I have now
|
||||
configured the list server at shorewall.net to strip all HTML from outgoing
|
||||
posts.<br>
|
||||
</h3>
|
||||
<h3></h3>
|
||||
</blockquote>
|
||||
<h2>Where to Send your Problem Report or to Ask for Help</h2>
|
||||
|
||||
@ -256,12 +258,17 @@ to the internet.</b> </h3>
|
||||
<blockquote>
|
||||
<h4>If you run Shorewall under Bering -- <span
|
||||
style="font-weight: 400;">please post your question or problem
|
||||
to the <a href="mailto:leaf-user@lists.sourceforge.net">LEAF Users mailing
|
||||
list</a>.</span></h4>
|
||||
to the <a href="mailto:leaf-user@lists.sourceforge.net">LEAF Users mailing
|
||||
list</a>.</span></h4>
|
||||
<b>If you run Shorewall under MandrakeSoft Multi Network Firewall (MNF)
|
||||
and you have not purchased an MNF license from MandrakeSoft then you can post
|
||||
non MNF-specific Shorewall questions to the </b><a
|
||||
href="mailto:shorewall-users@shorewall.net">Shorewall users mailing list.</a>
|
||||
<b>Do not expect to get free MNF support on the list.</b><br>
|
||||
|
||||
<p>Otherwise, please post your question or problem to the <a
|
||||
href="mailto:shorewall-users@shorewall.net">Shorewall users mailing list.</a></p>
|
||||
</blockquote>
|
||||
</blockquote>
|
||||
|
||||
|
||||
|
||||
@ -269,19 +276,15 @@ to the internet.</b> </h3>
|
||||
|
||||
|
||||
<p>To Subscribe to the mailing list go to <a
|
||||
href="http://www.shorewall.net/mailman/listinfo/shorewall-users">http://www.shorewall.net/mailman/listinfo/shorewall-users</a>
|
||||
.</p>
|
||||
href="http://mail.shorewall.net/mailman/listinfo/shorewall-users">http://mail.shorewall.net/mailman/listinfo/shorewall-users</a>
|
||||
.</p>
|
||||
|
||||
|
||||
<p align="left"><font size="2">Last Updated 12/27/2002 - Tom Eastep</font></p>
|
||||
<p align="left"><font size="2">Last Updated 12/29/2002 - Tom Eastep</font></p>
|
||||
|
||||
<p align="left"><font face="Trebuchet MS"><a href="copyright.htm"> <font
|
||||
size="2">Copyright</font> © <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font><br>
|
||||
</p>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
<br>
|
||||
</p>
|
||||
<br>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user