mirror of
https://gitlab.com/shorewall/code.git
synced 2025-06-19 17:28:35 +02:00
Minor tweak to scalability doc
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@8718 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
parent
fbf1b8db12
commit
f869d3d18b
26
docs/FAQ.xml
26
docs/FAQ.xml
@ -1959,6 +1959,19 @@ iptables: Invalid argument
|
|||||||
</listitem>
|
</listitem>
|
||||||
</orderedlist>
|
</orderedlist>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
|
<section id="faq78">
|
||||||
|
<title>(FAQ 78) After restart and bootup of my Debian firewall, all
|
||||||
|
traffic is blocked for hosts behind the firewall trying to connect out
|
||||||
|
onto the net or through the vpn (although i can reach the internal
|
||||||
|
firewall interface and obtain dumps etc). Once I issue 'shorewall clear'
|
||||||
|
followed by 'shorewall restart' it then works, despite the config not
|
||||||
|
changing</title>
|
||||||
|
|
||||||
|
<para><emphasis role="bold">Answer:</emphasis> Set IP_FORWARDING=On in
|
||||||
|
<filename><ulink
|
||||||
|
url="manpages/shorewall.conf.html">/etc/shorewall/shorewall.conf</ulink></filename>.</para>
|
||||||
|
</section>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
<section id="MultiISP">
|
<section id="MultiISP">
|
||||||
@ -1998,19 +2011,6 @@ iptables: Invalid argument
|
|||||||
will have mark = 1 and will be sent via ISP1. That will work whether
|
will have mark = 1 and will be sent via ISP1. That will work whether
|
||||||
<emphasis role="bold">balance</emphasis> is specified or not!</para>
|
<emphasis role="bold">balance</emphasis> is specified or not!</para>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
<section id="faq78">
|
|
||||||
<title>(FAQ 78) After restart and bootup of my Debian firewall, all
|
|
||||||
traffic is blocked for hosts behind the firewall trying to connect out
|
|
||||||
onto the net or through the vpn (although i can reach the internal
|
|
||||||
firewall interface and obtain dumps etc). Once I issue 'shorewall clear'
|
|
||||||
followed by 'shorewall restart' it then works, despite the config not
|
|
||||||
changing</title>
|
|
||||||
|
|
||||||
<para><emphasis role="bold">Answer:</emphasis> Set IP_FORWARDING=On in
|
|
||||||
<filename><ulink
|
|
||||||
url="manpages/shorewall.conf.html">/etc/shorewall/shorewall.conf</ulink></filename>.</para>
|
|
||||||
</section>
|
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
<section id="TC">
|
<section id="TC">
|
||||||
|
@ -109,11 +109,11 @@
|
|||||||
<section id="Shorewall">
|
<section id="Shorewall">
|
||||||
<title>Scaling within the Shorewall Code</title>
|
<title>Scaling within the Shorewall Code</title>
|
||||||
|
|
||||||
<para>Shorewall is written entirely in Bourne Shell. While this allows
|
<para>Shorewall-shell is written entirely in Bourne Shell. While this
|
||||||
Shorewall to run on a wide range of distributions (included embedded
|
allows Shorewall to run on a wide range of distributions (included
|
||||||
ones), the shell programming environment is not ideal for writing the
|
embedded ones), the shell programming environment is not ideal for writing
|
||||||
compiler portion of Shorewall. As a consequence, the code must repeatedly
|
the compiler portion of Shorewall. As a consequence, the code must
|
||||||
perform sequential searches of lists. If a list has <emphasis
|
repeatedly perform sequential searches of lists. If a list has <emphasis
|
||||||
role="bold">N</emphasis> elements and a sequential search is made for each
|
role="bold">N</emphasis> elements and a sequential search is made for each
|
||||||
of those elements, then the number of comparisons is 1 + 2 + 3 + .... +
|
of those elements, then the number of comparisons is 1 + 2 + 3 + .... +
|
||||||
<emphasis role="bold">N</emphasis> = <emphasis role="bold">N</emphasis> *
|
<emphasis role="bold">N</emphasis> = <emphasis role="bold">N</emphasis> *
|
||||||
@ -157,8 +157,8 @@
|
|||||||
</listitem>
|
</listitem>
|
||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
<para>Use NONE policies wherever appropriate. This helps especially
|
<para>Use NONE policies wherever appropriate. This helps especially in
|
||||||
in the rules activation phase of both script compilation and
|
the rules activation phase of both script compilation and
|
||||||
execution.</para>
|
execution.</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
</itemizedlist>
|
</itemizedlist>
|
||||||
@ -209,4 +209,4 @@ ACCEPT $HOSTS </programlisting>
|
|||||||
# PORT PORT(S) DEST LIMIT GROUP
|
# PORT PORT(S) DEST LIMIT GROUP
|
||||||
AcceptHosts net $FW tcp 22 </programlisting>
|
AcceptHosts net $FW tcp 22 </programlisting>
|
||||||
</section>
|
</section>
|
||||||
</article>
|
</article>
|
Loading…
x
Reference in New Issue
Block a user