2002-08-13 22:45:21 +02:00
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
< html >
< head >
2003-01-22 01:37:23 +01:00
2003-02-20 00:21:55 +01:00
2002-09-29 23:42:38 +02:00
< meta http-equiv = "Content-Type"
content="text/html; charset=windows-1252">
2003-02-20 00:21:55 +01:00
< title > Shorewall 1.4 Errata< / title >
2002-11-24 21:08:19 +01:00
2003-02-20 00:21:55 +01:00
2002-08-13 22:45:21 +02:00
< meta name = "GENERATOR" content = "Microsoft FrontPage 5.0" >
2003-01-22 01:37:23 +01:00
2003-02-20 00:21:55 +01:00
2002-11-24 21:08:19 +01:00
< meta name = "ProgId" content = "FrontPage.Editor.Document" >
2003-01-14 18:18:42 +01:00
2003-02-20 00:21:55 +01:00
2002-08-22 23:21:41 +02:00
< meta name = "Microsoft Theme" content = "none" >
2003-02-20 00:21:55 +01:00
< meta name = "author" content = "Tom Eastep" >
2002-08-13 22:45:21 +02:00
< / head >
2002-09-29 23:42:38 +02:00
< body >
2003-02-20 00:21:55 +01:00
2002-09-29 23:42:38 +02:00
< table border = "0" cellpadding = "0" cellspacing = "0"
style="border-collapse: collapse;" width="100%" id="AutoNumber1"
bgcolor="#400169" height="90">
2003-02-20 00:21:55 +01:00
< tbody >
< tr >
< td width = "100%" >
2003-01-22 01:37:23 +01:00
2003-02-20 00:21:55 +01:00
2002-09-29 23:42:38 +02:00
< h1 align = "center" > < font color = "#ffffff" > Shorewall Errata/Upgrade Issues< / font > < / h1 >
2003-02-20 00:21:55 +01:00
< / td >
< / tr >
2003-02-08 21:46:02 +01:00
2003-02-20 00:21:55 +01:00
< / tbody >
2002-09-29 23:42:38 +02:00
< / table >
2003-02-20 00:21:55 +01:00
2002-09-29 23:42:38 +02:00
< p align = "center" > < b > < u > IMPORTANT< / u > < / b > < / p >
2003-02-20 00:21:55 +01:00
2002-09-29 23:42:38 +02:00
< ol >
2003-02-20 00:21:55 +01:00
< li >
2003-02-08 21:46:02 +01:00
< p align = "left" > < b > < u > I< / u > f you use a Windows system to download
2003-02-20 00:21:55 +01:00
a corrected script, be sure to run the script through < u >
< a href = "http://www.megaloman.com/%7Ehany/software/hd2u/"
2003-02-08 21:46:02 +01:00
style="text-decoration: none;"> dos2unix< / a > < / u > after you have moved
2003-02-20 00:21:55 +01:00
it to your Linux system.< / b > < / p >
< / li >
< li >
2003-02-08 21:46:02 +01:00
< p align = "left" > < b > If you are installing Shorewall for the
first time and plan to use the .tgz and install.sh script, you can
untar the archive, replace the 'firewall' script in the untarred directory
2003-02-20 00:21:55 +01:00
with the one you downloaded below, and then run install.sh.< / b > < / p >
< / li >
< li >
< p align = "left" > < b > When the instructions say to install a corrected
firewall script in /usr/share/shorewall/firewall, you may
rename the existing file before copying in the new file.< / b > < / p >
< / li >
< li >
2003-02-08 21:46:02 +01:00
< p align = "left" > < b > < font color = "#ff0000" > DO NOT INSTALL CORRECTED COMPONENTS
2003-02-20 00:21:55 +01:00
ON A RELEASE EARLIER THAN THE ONE THAT THEY ARE LISTED UNDER BELOW.
For example, do NOT install the 1.3.9a firewall script if you are running
1.3.7c.< / font > < / b > < br >
< / p >
< / li >
2002-09-29 23:42:38 +02:00
< / ol >
2003-02-20 00:21:55 +01:00
2002-09-29 23:42:38 +02:00
< ul >
2003-02-20 00:21:55 +01:00
< li > < b > < a href = "upgrade_issues.htm" > Upgrade Issues< / a > < / b > < / li >
< li > < b > < a href = "#V1.4" > Problems in Version 1.4< / a > < / b > < br >
< / li >
< li > < b > < a
href="errata_3.html">Problems in Version 1.3< / a > < / b > < / li >
< li > < b > < a
2002-12-28 16:38:03 +01:00
href="errata_2.htm">Problems in Version 1.2< / a > < / b > < / li >
2003-02-20 00:21:55 +01:00
< li > < b > < font
2002-12-29 19:23:07 +01:00
color="#660066"> < a href = "errata_1.htm" > Problems in Version 1.1< / a > < / font > < / b > < / li >
2003-02-20 00:21:55 +01:00
< li > < b > < font
2003-02-08 21:46:02 +01:00
color="#660066">< a href = "#iptables" > Problem with iptables version 1.2.3
2003-02-20 00:21:55 +01:00
on RH7.2< / a > < / font > < / b > < / li >
< li > < b > < a
2003-02-08 21:46:02 +01:00
href="#Debug">Problems with kernels > = 2.4.18 and
RedHat iptables< / a > < / b > < / li >
2003-02-20 00:21:55 +01:00
< li > < b > < a href = "#SuSE" > Problems installing/upgrading
RPM on SuSE< / a > < / b > < / li >
< li > < b > < a href = "#Multiport" > Problems with iptables
version 1.2.7 and MULTIPORT=Yes< / a > < / b > < / li >
< li > < b > < a href = "#NAT" > Problems with RH Kernel 2.4.18-10
and NAT< / a > < / b > < br >
< / li >
< / ul >
< hr >
< h2 align = "left" > < a name = "V1.4" > < / a > Problems in Version 1.4< / h2 >
2003-01-31 22:50:51 +01:00
2003-02-20 00:21:55 +01:00
< h3 > < / h3 >
None.
< hr width = "100%" size = "2" >
2002-09-29 23:42:38 +02:00
< h2 align = "left" > < a name = "Upgrade" > < / a > Upgrade Issues< / h2 >
2003-02-20 00:21:55 +01:00
2002-09-29 23:42:38 +02:00
< p align = "left" > The upgrade issues have moved to < a
href="upgrade_issues.htm">a separate page< / a > .< / p >
2003-02-20 00:21:55 +01:00
< hr >
2003-02-08 21:46:02 +01:00
< h3 align = "left" > < a name = "iptables" > < / a > < font color = "#660066" > Problem with
2003-02-20 00:21:55 +01:00
iptables version 1.2.3< / font > < / h3 >
2003-02-08 21:46:02 +01:00
< blockquote >
2003-02-20 00:21:55 +01:00
2003-02-08 21:46:02 +01:00
< p align = "left" > There are a couple of serious bugs in iptables 1.2.3 that
2003-02-20 00:21:55 +01:00
prevent it from working with Shorewall. Regrettably, RedHat
released this buggy iptables in RedHat 7.2.<2E> < / p >
2002-12-29 19:23:07 +01:00
2003-02-20 00:21:55 +01:00
2002-09-29 23:42:38 +02:00
< p align = "left" > I have built a < a
2003-02-08 21:46:02 +01:00
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3-3.i386.rpm">
2003-02-20 00:21:55 +01:00
corrected 1.2.3 rpm which you can download here< / a > <EFBFBD> and I have
also built an < a
2003-02-08 21:46:02 +01:00
href="ftp://ftp.shorewall.net/pub/shorewall/iptables-1.2.4-1.i386.rpm">
iptables-1.2.4 rpm which you can download here< / a > . If you are currently
2003-02-20 00:21:55 +01:00
running RedHat 7.1, you can install either of these RPMs
< b > < u > before< / u > < / b > you upgrade to RedHat 7.2.< / p >
2003-01-14 18:18:42 +01:00
2003-02-20 00:21:55 +01:00
2003-02-08 21:46:02 +01:00
< p align = "left" > < font color = "#ff6633" > < b > Update 11/9/2001: < / b > < / font > RedHat
2003-02-20 00:21:55 +01:00
has released an iptables-1.2.4 RPM of their own which you can
2003-02-08 21:46:02 +01:00
download from< font color = "#ff6633" > < a
href="http://www.redhat.com/support/errata/RHSA-2001-144.html">http://www.redhat.com/support/errata/RHSA-2001-144.html< / a > .
2003-02-20 00:21:55 +01:00
< / font > I have installed this RPM on my firewall and it works
fine.< / p >
2002-12-29 19:23:07 +01:00
2003-02-20 00:21:55 +01:00
2003-02-08 21:46:02 +01:00
< p align = "left" > If you would like to patch iptables 1.2.3 yourself,
2003-02-20 00:21:55 +01:00
the patches are available for download. This < a
2003-02-08 21:46:02 +01:00
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/loglevel.patch">patch< / a >
2003-02-20 00:21:55 +01:00
which corrects a problem with parsing of the --log-level specification
while this < a
2003-02-08 21:46:02 +01:00
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/tos.patch">patch< / a >
2003-02-20 00:21:55 +01:00
corrects a problem in handling the<68> TOS target.< / p >
2002-12-28 16:38:03 +01:00
2003-02-20 00:21:55 +01:00
2002-09-29 23:42:38 +02:00
< p align = "left" > To install one of the above patches:< / p >
2003-01-22 01:37:23 +01:00
2003-02-20 00:21:55 +01:00
2002-09-29 23:42:38 +02:00
< ul >
2003-02-20 00:21:55 +01:00
< li > cd iptables-1.2.3/extensions< / li >
< li > patch -p0 < < i > the-patch-file< / i > < / li >
2003-01-22 01:37:23 +01:00
2003-02-20 00:21:55 +01:00
2002-09-29 23:42:38 +02:00
< / ul >
2003-02-20 00:21:55 +01:00
< / blockquote >
2003-01-14 18:18:42 +01:00
2003-02-20 00:21:55 +01:00
2003-02-08 21:46:02 +01:00
< h3 > < a name = "Debug" > < / a > Problems with kernels > = 2.4.18
and RedHat iptables< / h3 >
2003-02-20 00:21:55 +01:00
< blockquote >
2003-02-08 21:46:02 +01:00
< p > Users who use RedHat iptables RPMs and who upgrade to kernel 2.4.18/19
2003-02-20 00:21:55 +01:00
may experience the following:< / p >
2003-01-31 22:50:51 +01:00
2003-02-20 00:21:55 +01:00
2003-02-08 21:46:02 +01:00
< blockquote >
2003-02-20 00:21:55 +01:00
2002-09-29 23:42:38 +02:00
< pre > # shorewall start< br > Processing /etc/shorewall/shorewall.conf ...< br > Processing /etc/shorewall/params ...< br > Starting Shorewall...< br > Loading Modules...< br > Initializing...< br > Determining Zones...< br > Zones: net< br > Validating interfaces file...< br > Validating hosts file...< br > Determining Hosts in Zones...< br > Net Zone: eth0:0.0.0.0/0< br > iptables: libiptc/libip4tc.c:380: do_check: Assertion< br > `h-> info.valid_hooks == (1 < < 0 | 1 < < 3)' failed.< br > Aborted (core dumped)< br > iptables: libiptc/libip4tc.c:380: do_check: Assertion< br > `h-> info.valid_hooks == (1 < < 0 | 1 < < 3)' failed.< br > Aborted (core dumped)< br > < / pre >
2003-02-20 00:21:55 +01:00
< / blockquote >
2002-11-09 19:06:34 +01:00
2003-02-20 00:21:55 +01:00
2003-02-08 21:46:02 +01:00
< p > The RedHat iptables RPM is compiled with debugging enabled but the
user-space debugging code was not updated to reflect recent changes in
2003-02-20 00:21:55 +01:00
the Netfilter 'mangle' table. You can correct the problem by
installing < a
2003-02-08 21:46:02 +01:00
href="http://www.shorewall.net/pub/shorewall/iptables-1.2.5-1.i386.rpm">
2003-02-20 00:21:55 +01:00
this iptables RPM< / a > . If you are already running a 1.2.5 version
of iptables, you will need to specify the --oldpackage option to
rpm (e.g., "iptables -Uvh --oldpackage iptables-1.2.5-1.i386.rpm").< / p >
< / blockquote >
2003-01-31 22:50:51 +01:00
2003-02-20 00:21:55 +01:00
2003-02-08 21:46:02 +01:00
< h3 > < a name = "SuSE" > < / a > Problems installing/upgrading
2003-02-20 00:21:55 +01:00
RPM on SuSE< / h3 >
2003-02-08 21:46:02 +01:00
< p > If you find that rpm complains about a conflict
with kernel < = 2.2 yet you have a 2.4 kernel
installed, simply use the "--nodeps" option to
rpm.< / p >
2003-02-20 00:21:55 +01:00
2002-09-29 23:42:38 +02:00
< p > Installing: rpm -ivh --nodeps < i > < shorewall rpm> < / i > < / p >
2003-02-20 00:21:55 +01:00
2002-09-29 23:42:38 +02:00
< p > Upgrading: rpm -Uvh --nodeps < i > < shorewall rpm> < / i > < / p >
2003-02-20 00:21:55 +01:00
2003-02-08 21:46:02 +01:00
< h3 > < a name = "Multiport" > < / a > < b > Problems with
iptables version 1.2.7 and MULTIPORT=Yes< / b > < / h3 >
2003-02-20 00:21:55 +01:00
2003-02-08 21:46:02 +01:00
< p > The iptables 1.2.7 release of iptables has made
an incompatible change to the syntax used to
specify multiport match rules; as a consequence,
if you install iptables 1.2.7 you must be running
Shorewall 1.3.7a or later or:< / p >
2003-02-20 00:21:55 +01:00
2002-09-29 23:42:38 +02:00
< ul >
2003-02-20 00:21:55 +01:00
< li > set MULTIPORT=No
in /etc/shorewall/shorewall.conf; or < / li >
< li > if you are running
Shorewall 1.3.6 you may install
< a
2003-02-08 21:46:02 +01:00
href="http://www.shorewall.net/pub/shorewall/errata/1.3.6/firewall">
this firewall script< / a > in /var/lib/shorewall/firewall
2003-02-20 00:21:55 +01:00
as described above.< / li >
2002-09-29 23:42:38 +02:00
< / ul >
2003-02-20 00:21:55 +01:00
2002-11-09 19:06:34 +01:00
< h3 > < a name = "NAT" > < / a > Problems with RH Kernel 2.4.18-10 and NAT< br >
2003-02-20 00:21:55 +01:00
< / h3 >
/etc/shorewall/nat entries of the following form will result
in Shorewall being unable to start:< br >
< br >
2002-11-09 19:06:34 +01:00
< pre > #EXTERNAL<41> <4C> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> INTERFACE<43> <45> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> INTERNAL<41> <4C> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> ALL INTERFACES<45> <53> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> <EFBFBD> LOCAL< br > 192.0.2.22<EFBFBD> <EFBFBD> <EFBFBD> eth0<68> <30> <EFBFBD> 192.168.9.22<EFBFBD> <EFBFBD> yes<65> <73> <EFBFBD> <EFBFBD> yes< br > #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE< / pre >
2003-02-20 00:21:55 +01:00
Error message is:< br >
2002-11-09 19:06:34 +01:00
< pre > Setting up NAT...< br > iptables: Invalid argument< br > Terminated< br > < br > < / pre >
2003-02-20 00:21:55 +01:00
The solution is to put "no" in the LOCAL column. Kernel support
for LOCAL=yes has never worked properly and 2.4.18-10 has disabled
it. The 2.4.19 kernel contains corrected support under a new kernel configuraiton
2003-02-08 21:46:02 +01:00
option; see < a href = "Documentation.htm#NAT" > http://www.shorewall.net/Documentation.htm#NAT< / a > < br >
2003-02-20 00:21:55 +01:00
2003-02-08 21:46:02 +01:00
< p > < font size = "2" > Last updated 2/8/2003 -
< a href = "support.htm" > Tom Eastep< / a > < / font > < / p >
2003-02-20 00:21:55 +01:00
2003-01-14 18:18:42 +01:00
< p > < a href = "copyright.htm" > < font size = "2" > Copyright< / font > <20> < font
size="2">2001, 2002, 2003 Thomas M. Eastep.< / font > < / a > < br >
2003-02-20 00:21:55 +01:00
< / p >
2002-09-29 23:42:38 +02:00
< br >
2002-08-13 22:45:21 +02:00
< / body >
2002-09-29 23:42:38 +02:00
< / html >
