From 48b85c5353cd18347c5c588289854534a5b6b551 Mon Sep 17 00:00:00 2001 From: teastep Date: Mon, 12 Jan 2009 23:57:02 +0000 Subject: [PATCH] Update Shorewall-perl migration issues git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@9277 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb --- docs/Shorewall-perl.xml | 43 ++++++++++++++++++++++++++++------------- 1 file changed, 30 insertions(+), 13 deletions(-) diff --git a/docs/Shorewall-perl.xml b/docs/Shorewall-perl.xml index 3e33bca1d..a4863e745 100644 --- a/docs/Shorewall-perl.xml +++ b/docs/Shorewall-perl.xml @@ -148,7 +148,8 @@ The refresh command does not alter the Netfilter - configuration except for the static blacklist. + configuration except for the static blacklist (it also refreshes + the mangle table, beginning with Shorewall 4.2.0). @@ -186,23 +187,13 @@ maclog - initdone - - + start Per-chain (including those associated with actions) - start - - - - - - - started @@ -518,11 +509,37 @@ ACCEPT loc:eth0:192.168.1.3,192.168.1.5 $FW tcp 22Wit ACCEPT loc:eth0:192.168.1.3,eth0:192.168.1.5 $fw tcp 22 Shorewall-perl does not support this alternative syntax. + + + Beginning in Shorewall 4.2.0, Shorewall-perl gives a warning + if a zone name is entered in the DEST column of a + nonat rule. Nonat rules include: + + + + DNAT- + + + + REDIRECT- + + + + NONAT + + + + So rather than this:#ACTION SOURCE DEST PROTO DEST PORT(S) +DNAT- net loc:192.168.1.3 tcp 21 + + you instead want:#ACTION SOURCE DEST PROTO DEST PORT(S) +DNAT- net 192.168.1.3 tcp 21 +
- Dependence on Perl + Dependence on Perl Shorewall-perl is dependent on Perl (see the next section) which has a large disk footprint. This makes Shorewall-perl less desirable in