Copyright
diff --git a/STABLE/documentation/errata.htm b/STABLE/documentation/errata.htm
index 6adf735d5..3bbc78fb2 100644
--- a/STABLE/documentation/errata.htm
+++ b/STABLE/documentation/errata.htm
@@ -65,15 +65,15 @@ dos2unix
- Upgrade Issues
+ Problems in Version 1.3
- Version >= 1.3.7
+ Version 1.3.7a
- Users specifying ALLOWRELATED=No in
- /etc/shorewall.conf will need to include the
- following rules in their /etc/shorewall/icmpdef
- file (creating this file if necessary):
+ "shorewall refresh" is not creating the proper
+ rule for FORWARDPING=Yes. Consequently, after
+ "shorewall refresh", the firewall will not forward
+ icmp echo-request (ping) packets. Installing
+
+ this corrected firewall script in /var/lib/shorewall/firewall
+ as described above corrects this problem.
- run_iptables -A icmpdef -p ICMP --icmp-type echo-reply -j ACCEPT
- run_iptables -A icmpdef -p ICMP --icmp-type source-quench -j ACCEPT
- run_iptables -A icmpdef -p ICMP --icmp-type destination-unreachable -j ACCEPT
- run_iptables -A icmpdef -p ICMP --icmp-type time-exceeded -j ACCEPT
- run_iptables -A icmpdef -p ICMP --icmp-type parameter-problem -j ACCEPT
- Users having an /etc/shorewall/icmpdef file may remove the ".
- /etc/shorewall/icmp.def" command from that file since the icmp.def file is now
- empty.
- Upgrading Bering to
- Shorewall >= 1.3.3
+ Version <= 1.3.7a
- To properly upgrade with Shorewall version
- 1.3.3 and later:
+ If "norfc1918" and "dhcp" are both specified as
+ options on a given interface then RFC 1918
+ checking is occurring before DHCP checking. This
+ means that if a DHCP client broadcasts using an
+ RFC 1918 source address, then the firewall will
+ reject the broadcast (usually logging it). This
+ has two problems:
- - Be sure you have a backup -- you will need
- to transcribe any Shorewall configuration
- changes that you have made to the new
- configuration.
- - Replace the shorwall.lrp package provided on
- the Bering floppy with the later one. If you did
- not obtain the later version from Jacques's
- site, see additional instructions below.
- - Edit the /var/lib/lrpkg/root.exclude.list
- file and remove the /var/lib/shorewall entry if
- present. Then do not forget to backup root.lrp !
+ - If the firewall is running a DHCP server,
+ the client won't be able to obtain an IP address
+ lease from that server.
+ - With this order of checking, the "dhcp"
+ option cannot be used as a noise-reduction
+ measure where there are both dynamic and static
+ clients on a LAN segment.
- The .lrp that I release isn't set up for a two-interface firewall like
- Jacques's. You need to follow the instructions for
- setting up a two-interface firewall plus you also need to add the following
- two Bering-specific rules to /etc/shorewall/rules:
-
- # Bering specific rules:
-# allow loc to fw udp/53 for dnscache to work
-# allow loc to fw tcp/80 for weblet to work
-#
-ACCEPT loc fw udp 53
-ACCEPT loc fw tcp 80
-
- Version >= 1.3.6
-
- If you have a pair of firewall systems configured for
- failover, you will need to modify your firewall setup slightly under
- Shorewall versions >= 1.3.6.
-
-
- -
-
-
Create the file /etc/shorewall/newnotsyn and in it add
- the following rule
-
- run_iptables -A newnotsyn -j RETURN # So that the
- connection tracking table can be rebuilt
-
- # from non-SYN packets after takeover.
-
- -
-
-
Create /etc/shorewall/common (if you don't already
- have that file) and include the following:
-
- run_iptables -A common -p tcp --tcp-flags
- ACK,FIN,RST ACK -j ACCEPT #Accept Acks to rebuild connection
-
- #tracking table.
- . /etc/shorewall/common.def
-
-
- Versions >= 1.3.5
-
- Some forms of pre-1.3.0 rules file syntax are no
- longer supported.
-
- Example 1:
-
-
-
ACCEPT net loc:192.168.1.12:22 tcp 11111 - all
-
Must be replaced with:
-
-
-
DNAT net loc:192.168.1.12:22 tcp 11111
-
-
ACCEPT loc fw::3128 tcp 80 - all
-
-
REDIRECT loc 3128 tcp 80
-
Problems in Version 1.3
+
+
+ This version of the 1.3.7a firewall script
+ corrects the problem. It must be installed in /var/lib/shorewall
+ as described above.
+
+ Version 1.3.7
+
+ Version 1.3.7 dead on arrival -- please use
+ version 1.3.7a and check your version against
+ these md5sums -- if there's a difference, please
+ download again.
+
+ d2fffb7fb99bcc6cb047ea34db1df10 shorewall-1.3.7a.tgz
+ 6a7fd284c8685b2b471a2f47b469fb94 shorewall-1.3.7a-1.noarch.rpm
+ 3decd14296effcff16853106771f7035 shorwall-1.3.7a.lrp
+ In other words, type "md5sum <whatever package you downloaded> and
+ compare the result with what you see above.
+ I'm embarrassed to report that 1.2.7 was also DOA -- maybe I'll skip the .7
+ version in each sequence from now on.
Version 1.3.6
@@ -352,6 +298,120 @@ ACCEPT loc fw tcp 80
corrected version is here.
+
+
+ Upgrade Issues
+
+ Version >= 1.3.7
+
+ Users specifying ALLOWRELATED=No in
+ /etc/shorewall.conf will need to include the
+ following rules in their /etc/shorewall/icmpdef
+ file (creating this file if necessary):
+
+ run_iptables -A icmpdef -p ICMP --icmp-type echo-reply -j ACCEPT
+ run_iptables -A icmpdef -p ICMP --icmp-type source-quench -j ACCEPT
+ run_iptables -A icmpdef -p ICMP --icmp-type destination-unreachable -j ACCEPT
+ run_iptables -A icmpdef -p ICMP --icmp-type time-exceeded -j ACCEPT
+ run_iptables -A icmpdef -p ICMP --icmp-type parameter-problem -j ACCEPT
+ Users having an /etc/shorewall/icmpdef file may remove the ".
+ /etc/shorewall/icmp.def" command from that file since the icmp.def file is now
+ empty.
+ Upgrading Bering to
+ Shorewall >= 1.3.3
+
+ To properly upgrade with Shorewall version
+ 1.3.3 and later:
+
+
+ - Be sure you have a backup -- you will need
+ to transcribe any Shorewall configuration
+ changes that you have made to the new
+ configuration.
+ - Replace the shorwall.lrp package provided on
+ the Bering floppy with the later one. If you did
+ not obtain the later version from Jacques's
+ site, see additional instructions below.
+ - Edit the /var/lib/lrpkg/root.exclude.list
+ file and remove the /var/lib/shorewall entry if
+ present. Then do not forget to backup root.lrp !
+
+ The .lrp that I release isn't set up for a two-interface firewall like
+ Jacques's. You need to follow the instructions for
+ setting up a two-interface firewall plus you also need to add the following
+ two Bering-specific rules to /etc/shorewall/rules:
+
+ # Bering specific rules:
+# allow loc to fw udp/53 for dnscache to work
+# allow loc to fw tcp/80 for weblet to work
+#
+ACCEPT loc fw udp 53
+ACCEPT loc fw tcp 80
+
+
+ Version >= 1.3.6
+
+ If you have a pair of firewall systems configured for
+ failover, you will need to modify your firewall setup slightly under
+ Shorewall versions >= 1.3.6.
+
+
+ -
+
+
Create the file /etc/shorewall/newnotsyn and in it add
+ the following rule
+
+ run_iptables -A newnotsyn -j RETURN # So that the
+ connection tracking table can be rebuilt
+
+ # from non-SYN packets after takeover.
+
+ -
+
+
Create /etc/shorewall/common (if you don't already
+ have that file) and include the following:
+
+ run_iptables -A common -p tcp --tcp-flags
+ ACK,FIN,RST ACK -j ACCEPT #Accept Acks to rebuild connection
+
+ #tracking table.
+ . /etc/shorewall/common.def
+
+
+ Versions >= 1.3.5
+
+ Some forms of pre-1.3.0 rules file syntax are no
+ longer supported.
+
+ Example 1:
+
+
+
ACCEPT net loc:192.168.1.12:22 tcp 11111 - all
+
Must be replaced with:
+
+
+
DNAT net loc:192.168.1.12:22 tcp 11111
+
+
ACCEPT loc fw::3128 tcp 80 - all
+
+
REDIRECT loc 3128 tcp 80
+
Version >= 1.3.2
+
+ The functions and versions files together with the
+ 'firewall' symbolic link have moved from /etc/shorewall to /var/lib/shorewall.
+ If you have applications that access these files, those applications
+ should be modified accordingly.
+
@@ -435,9 +495,9 @@ Aborted (core dumped)
installed, simply use the "--nodeps" option to
rpm.
