diff --git a/Shorewall-docs2/FTP.xml b/Shorewall-docs2/FTP.xml index b20dcc484..b7fe0c40e 100644 --- a/Shorewall-docs2/FTP.xml +++ b/Shorewall-docs2/FTP.xml @@ -15,7 +15,7 @@ - 2005-01-03 + 2005-03-03 2003 @@ -257,7 +257,7 @@ jbd 47860 2 [ext3] have: loadmodule ip_conntrack_ftp ports=21,49 -loadmodule ip_nat_ftp ports=21,49 +loadmodule ip_nat_ftp ports=21,49 # NOTE: This is not necessary with kernel 2.6.11 and later! you MUST include port 21 in the ports list or you may have @@ -269,7 +269,7 @@ loadmodule ip_nat_ftp ports=21,49 /etc/modules.conf: options ip_conntrack_ftp ports=21,49 -options ip_nat_ftp ports=21,49 +options ip_nat_ftp ports=21,49 # NOTE: This is not necessary with kernel 2.6.11 and later! Once you have made these changes to /etc/shorewall/modules diff --git a/Shorewall-docs2/Shorewall_and_Routing.xml b/Shorewall-docs2/Shorewall_and_Routing.xml index 1b9713679..9b43ce697 100644 --- a/Shorewall-docs2/Shorewall_and_Routing.xml +++ b/Shorewall-docs2/Shorewall_and_Routing.xml @@ -15,7 +15,7 @@ - 2005-02-19 + 2005-03-03 2005 @@ -66,11 +66,15 @@ - The light blue boxes indicate where routing decisions are made. The - green boxes show where Netfilter processing takes place (as directed by - Shorewall). You will notice that there are two different paths through - this maze, depending on where the packet originates. We will look at each - of these separately. + The light blue boxes indicate where routing decisions are made. Upon + exit from one of these boxes, if the packet is being sent to another + system then the interface and the next hop have been uniquely + determined. + + The green boxes show where Netfilter processing takes place (as + directed by Shorewall). You will notice that there are two different paths + through this maze, depending on where the packet originates. We will look + at each of these separately.
Packets Entering the Firewall from Outside @@ -89,6 +93,14 @@ alternate routing table; see the Shorewall Squid documentation for examples. + + + Marking packets then using the fwmark + selector in your "ip rule add" + commands should NOT be your first choice. In most cases, you can + use the from or dev + selector instead. + @@ -165,6 +177,6 @@ the Shorewall init script (/etc/init.d/shorewall) to configure your alternate routing table at boot time and that other than as described in the previous section, there is no - connection between Shorewall and routing. + connection between Shorewall and routing.
\ No newline at end of file diff --git a/Shorewall-docs2/troubleshoot.xml b/Shorewall-docs2/troubleshoot.xml index 490c70749..13cc5fbe2 100644 --- a/Shorewall-docs2/troubleshoot.xml +++ b/Shorewall-docs2/troubleshoot.xml @@ -13,10 +13,10 @@ Eastep - 2004-08-25 + 20045-03-03 - 2001-2004 + 2001-2005 Thomas M. Eastep @@ -326,7 +326,7 @@ ACCEPT dmz loc udp 53 #ACTION SOURCE DEST PROTO DEST # PORT(S) -ACCEPT   <source zone>   <destination zone>    icmp    echo-request +AllowPing <source zone>   <destination zone> The ramifications of this can be subtle. For example, if you have the following in <source zone>   - - - Similarly, since Shorewall gives no special treatment to - pingpackets, these packets are subject to logging - specifications in policies. This allows people pinging your firewall - to create large number of messages in your log. These messages can be - eliminated by the following rule:#ACTION SOURCE DEST PROTO DEST -# PORT(S) -DROP net fw icmp echo-request -