@@ -211,7 +216,7 @@ Shorewall component. There's no guarantee that what you find there will work at
all.
-Last Updated 8/05/2002 - Tom
+Last Updated 8/22/2002 - Tom
Eastep
Copyright
diff --git a/Shorewall-docs/errata.htm b/Shorewall-docs/errata.htm
index a3905ae22..6adf735d5 100644
--- a/Shorewall-docs/errata.htm
+++ b/Shorewall-docs/errata.htm
@@ -10,15 +10,19 @@
-
+
- Shorewall Errata/Upgrade Issues
+
+
+
+ Shorewall Errata/Upgrade Issues
+ |
+
+
-
-
- IMPORTANT
+ IMPORTANT
-
@@ -86,6 +90,53 @@ dos2unix
Upgrade Issues
+ Version >= 1.3.7
+
+ Users specifying ALLOWRELATED=No in
+ /etc/shorewall.conf will need to include the
+ following rules in their /etc/shorewall/icmpdef
+ file (creating this file if necessary):
+
+ run_iptables -A icmpdef -p ICMP --icmp-type echo-reply -j ACCEPT
+ run_iptables -A icmpdef -p ICMP --icmp-type source-quench -j ACCEPT
+ run_iptables -A icmpdef -p ICMP --icmp-type destination-unreachable -j ACCEPT
+ run_iptables -A icmpdef -p ICMP --icmp-type time-exceeded -j ACCEPT
+ run_iptables -A icmpdef -p ICMP --icmp-type parameter-problem -j ACCEPT
+ Users having an /etc/shorewall/icmpdef file may remove the ".
+ /etc/shorewall/icmp.def" command from that file since the icmp.def file is now
+ empty.
+ Upgrading Bering to
+ Shorewall >= 1.3.3
+
+ To properly upgrade with Shorewall version
+ 1.3.3 and later:
+
+
+ - Be sure you have a backup -- you will need
+ to transcribe any Shorewall configuration
+ changes that you have made to the new
+ configuration.
+ - Replace the shorwall.lrp package provided on
+ the Bering floppy with the later one. If you did
+ not obtain the later version from Jacques's
+ site, see additional instructions below.
+ - Edit the /var/lib/lrpkg/root.exclude.list
+ file and remove the /var/lib/shorewall entry if
+ present. Then do not forget to backup root.lrp !
+
+ The .lrp that I release isn't set up for a two-interface firewall like
+ Jacques's. You need to follow the instructions for
+ setting up a two-interface firewall plus you also need to add the following
+ two Bering-specific rules to /etc/shorewall/rules:
+
+ # Bering specific rules:
+# allow loc to fw udp/53 for dnscache to work
+# allow loc to fw tcp/80 for weblet to work
+#
+ACCEPT loc fw udp 53
+ACCEPT loc fw tcp 80
+
+
Version >= 1.3.6
If you have a pair of firewall systems configured for
@@ -144,6 +195,38 @@ dos2unix
Problems in Version 1.3
+ Version 1.3.6
+
+
+ -
+
+
If ADD_SNAT_ALIASES=Yes is specified in
+ /etc/shorewall/shorewall.conf, an error occurs when the firewall
+ script attempts to add an SNAT alias.
+ -
+
+
The logunclean and dropunclean options
+ cause errors during startup when Shorewall is run with iptables 1.2.7.
+
+
+ These problems are fixed in
+
+ this correct firewall script which must be installed in
+ /var/lib/shorewall/ as described above. These problems are also
+ corrected in version 1.3.7.
+
+ Two-interface Samples 1.3.6 (file two-interfaces.tgz)
+
+ A line was inadvertently deleted from the "interfaces
+ file" -- this line should be added back in if the version that you
+ downloaded is missing it:
+
+ net eth0 detect
+ routefilter,dhcp,norfc1918
+
+ If you downloaded two-interfaces-a.tgz then the above
+ line should already be in the file.
+
Version 1.3.5-1.3.5b
The new 'proxyarp' interface option doesn't work :-(
@@ -289,8 +372,7 @@ you are currently running RedHat 7.1, you can install either of these RPMs
Update
11/9/2001: RedHat has
- released an iptables-1.2.4 RPM of their own which you can download from
-
+ released an iptables-1.2.4 RPM of their own which you can download from
http://www.redhat.com/support/errata/RHSA-2001-144.html.
I have installed this RPM
on my firewall and it works fine.
@@ -357,21 +439,25 @@ Aborted (core dumped)
Upgrading: rpm -Uvh <shorewall rpm>
- Problems with
- iptables version 1.2.7 and MULTIPORT=Yes
+ Problems with
+ iptables version 1.2.7 and MULTIPORT=Yes
The iptables 1.2.7 release of iptables has made
an incompatible change to the syntax used to
specify multiport match rules; as a consequence,
- users who install iptables 1.2.7 must set
- MULTIPORT=No in /etc/shorewall/shorewall.conf or
- install
-
- this firewall script in /var/lib/shorewall/firewall
- as described above.
+ if you install iptables 1.2.7 you must
-
- Last updated 8/14/2002 -
+
+ - set MULTIPORT=No in
+ /etc/shorewall/shorewall.conf; or
+ - if you are running Shorewall 1.3.6 you may
+ install
+
+ this firewall script in /var/lib/shorewall/firewall
+ as described above.
+
+
+ Last updated 8/22/2002 -
Tom Eastep
Copyright
diff --git a/Shorewall-docs/errata_1.htm b/Shorewall-docs/errata_1.htm
index c6b5123a1..b64dc819a 100644
--- a/Shorewall-docs/errata_1.htm
+++ b/Shorewall-docs/errata_1.htm
@@ -6,12 +6,17 @@
Shorewall Errata for Version 1
-
-Shorewall Errata for Version 1.1
+
+
+
+ Shorewall Errata for Version 1.1
+ |
+
+
To those of you who downloaded the 1.1.13 updated firewall script prior
to Sept 20, 2001:
diff --git a/Shorewall-docs/errata_2.htm b/Shorewall-docs/errata_2.htm
index 11355f3a7..29250ef7d 100644
--- a/Shorewall-docs/errata_2.htm
+++ b/Shorewall-docs/errata_2.htm
@@ -10,10 +10,15 @@
-
-
+
- Shorewall 1.2 Errata
+
+
+
+ Shorewall 1.2 Errata
+ |
+
+
diff --git a/Shorewall-docs/fallback.htm b/Shorewall-docs/fallback.htm
index 843fa0682..b3219c5e1 100644
--- a/Shorewall-docs/fallback.htm
+++ b/Shorewall-docs/fallback.htm
@@ -5,12 +5,19 @@
Shorewall Fallback and Uninstall
-
-Fallback and Uninstall
+
+
+
+
+Fallback and Uninstall
+
+ |
+
+
Shorewall includes
a fallback script
diff --git a/Shorewall-docs/gnu_mailman.htm b/Shorewall-docs/gnu_mailman.htm
index 94a1aa0bd..702ff74be 100644
--- a/Shorewall-docs/gnu_mailman.htm
+++ b/Shorewall-docs/gnu_mailman.htm
@@ -6,13 +6,20 @@
GNU Mailman
-
-GNU Mailman/Postfix
-the Easy Way
+
+
+
+ GNU Mailman/Postfix
+the Easy Way
+ |
+
+
+
+
The following was posted on the Postfix mailing list on 5/4/2002 by Michael
Tokarev as a suggested addition to the Postfix FAQ.
Q: Mailman does not work with Postfix, complaining about GID mismatch
diff --git a/Shorewall-docs/index.htm b/Shorewall-docs/index.htm
index b140d6f58..6bf808fdb 100644
--- a/Shorewall-docs/index.htm
+++ b/Shorewall-docs/index.htm
@@ -5,10 +5,9 @@
Shoreline Firewall
-
-
+ 