holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Merge branch '4.5.8'

Browse Source
This commit is contained in:
Tom Eastep 2012-09-21 07:28:56 -07:00
commit 669dbc7238
1 changed files with 24 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
docs/FAQ.xml
View File

@ -247,7 +247,7 @@ DNAT net:<emphasis>address</emphasis> loc:<emphasis>local-IP-address</empha
<itemizedlist>
<listitem>
<para>You are trying to test from inside your firewall (no, that
won't work -- see <xref linkend="faq2" />).</para>
won't work -- see <xref linkend="faq2"/>).</para>
</listitem>
<listitem>
@ -546,6 +546,28 @@ REDIRECT net 22 tcp 9022</programlisting>
net on TCP port 22. If you don't want that, see <link
linkend="faq1e">FAQ 1e</link>.</para>
</section>
<section id="faq1j">
<title>(FAQ 1j) Why doesn't this DNAT rule work?</title>
<para>I added this rule but I'm still seeing the log message
below</para>
<programlisting>RULE:
DNAT scnet:172.19.41.2 dmz0:10.199.198.145 udp 2055
LOG:
Sep 21 12:55:37 fw001 kernel: [10357687.114928] Shorewall:scnet2fw:DROP:IN=eth2 OUT=
MAC=00:26:33:dd:aa:05:00:24:f7:19:ce:44:08:00 SRC=172.19.41.2 DST=172.19.1.1 LEN=1492
TOS=0x00 PREC=0x00 TTL=63 ID=23035 PROTO=UDP SPT=6376 DPT=2055 LEN=1472</programlisting>
<para><emphasis role="bold">Answer</emphasis>: There was already a
conntrack entry for the failing connection before you added the rule.
Install the <emphasis role="bold">conntrack</emphasis> utility program
and use it to delete the entry.</para>
<programlisting><command>conntrack -D -s 172.19.41.2 -d 172.19.1.1 -p udp -sport 6367 -dport 2055 </command></programlisting>
</section>
</section>
<section id="faq30">
@ -2900,7 +2922,7 @@ Shorewall has detected the following iptables/netfilter capabilities:
Persistent SNAT: Available
gateway:~# </programlisting>
<para></para>
<para/>
</section>
<section id="faq19">