mirror of
https://gitlab.com/shorewall/code.git
synced 2024-12-01 20:13:49 +01:00
27 lines
1.0 KiB
Plaintext
27 lines
1.0 KiB
Plaintext
1) In all versions of Shorewall6 lite, the 'shorecap' program is
|
|
using the 'iptables' program rather than the 'ip6tables' program.
|
|
This causes many capabilities that are not available in IPv6 to
|
|
be incorrectly reported as available.
|
|
|
|
This results in errors such as:
|
|
|
|
ip6tables-restore v1.4.2: Couldn't load match `addrtype':
|
|
/lib/xtables/libip6t_addrtype.so: cannot open shared
|
|
object file: No such file or directory
|
|
|
|
To work around this problem, on the administrative system:
|
|
|
|
a) Remove the incorrect capabilties file.
|
|
b) In shorewall6.conf, set the IP6TABLES option to the
|
|
path name of ip6tables on the firewall (example:
|
|
IP6TABLES=/sbin/ip6tables).
|
|
c) 'shorewall6 load <firewall>'.
|
|
|
|
2) In a number of cases, Shorewall6 generates incorrect rules
|
|
involving the IPv6 multicast network. The rules specify
|
|
ff00::/10 where they should specify ff00::/8. Also, rules
|
|
instantiated when the IPv6 firewall is stopped use ff80::/10 rather
|
|
than fe80::/10 (IPv6 link local network).
|
|
|
|
|