diff --git a/Shorewall-docs2/FTP.xml b/Shorewall-docs2/FTP.xml
index b20dcc484..b7fe0c40e 100644
--- a/Shorewall-docs2/FTP.xml
+++ b/Shorewall-docs2/FTP.xml
@@ -15,7 +15,7 @@
- 2005-01-03
+ 2005-03-03
2003
@@ -257,7 +257,7 @@ jbd 47860 2 [ext3]
have:
loadmodule ip_conntrack_ftp ports=21,49
-loadmodule ip_nat_ftp ports=21,49
+loadmodule ip_nat_ftp ports=21,49 # NOTE: This is not necessary with kernel 2.6.11 and later!
you MUST include port 21 in the ports list or you may have
@@ -269,7 +269,7 @@ loadmodule ip_nat_ftp ports=21,49
/etc/modules.conf:
options ip_conntrack_ftp ports=21,49
-options ip_nat_ftp ports=21,49
+options ip_nat_ftp ports=21,49 # NOTE: This is not necessary with kernel 2.6.11 and later!
Once you have made these changes to /etc/shorewall/modules
diff --git a/Shorewall-docs2/Shorewall_and_Routing.xml b/Shorewall-docs2/Shorewall_and_Routing.xml
index 1b9713679..9b43ce697 100644
--- a/Shorewall-docs2/Shorewall_and_Routing.xml
+++ b/Shorewall-docs2/Shorewall_and_Routing.xml
@@ -15,7 +15,7 @@
- 2005-02-19
+ 2005-03-03
2005
@@ -66,11 +66,15 @@
- The light blue boxes indicate where routing decisions are made. The
- green boxes show where Netfilter processing takes place (as directed by
- Shorewall). You will notice that there are two different paths through
- this maze, depending on where the packet originates. We will look at each
- of these separately.
+ The light blue boxes indicate where routing decisions are made. Upon
+ exit from one of these boxes, if the packet is being sent to another
+ system then the interface and the next hop have been uniquely
+ determined.
+
+ The green boxes show where Netfilter processing takes place (as
+ directed by Shorewall). You will notice that there are two different paths
+ through this maze, depending on where the packet originates. We will look
+ at each of these separately.
Packets Entering the Firewall from Outside
@@ -89,6 +93,14 @@
alternate routing table; see the Shorewall Squid
documentation for examples.
+
+
+ Marking packets then using the fwmark
+ selector in your "ip rule add"
+ commands should NOT be your first choice. In most cases, you can
+ use the from or dev
+ selector instead.
+
@@ -165,6 +177,6 @@
the Shorewall init script (/etc/init.d/shorewall) to
configure your alternate routing table at boot time and that other than as described in the previous section, there is no
- connection between Shorewall and routing.
+ connection between Shorewall and routing.
\ No newline at end of file
diff --git a/Shorewall-docs2/troubleshoot.xml b/Shorewall-docs2/troubleshoot.xml
index 490c70749..13cc5fbe2 100644
--- a/Shorewall-docs2/troubleshoot.xml
+++ b/Shorewall-docs2/troubleshoot.xml
@@ -13,10 +13,10 @@
Eastep
- 2004-08-25
+ 20045-03-03
- 2001-2004
+ 2001-2005
Thomas M. Eastep
@@ -326,7 +326,7 @@ ACCEPT dmz loc udp 53
#ACTION SOURCE DEST PROTO DEST
# PORT(S)
-ACCEPT <source zone> <destination zone> icmp echo-request
+AllowPing <source zone> <destination zone>
The ramifications of this can be subtle. For example, if you
have the following in <source zone>
-
-
- Similarly, since Shorewall gives no special treatment to
- ping
packets, these packets are subject to logging
- specifications in policies. This allows people pinging your firewall
- to create large number of messages in your log. These messages can be
- eliminated by the following rule:#ACTION SOURCE DEST PROTO DEST
-# PORT(S)
-DROP net fw icmp echo-request
-