diff --git a/Shorewall/known_problems.txt b/Shorewall/known_problems.txt index f5f0352d2..7a3baf608 100644 --- a/Shorewall/known_problems.txt +++ b/Shorewall/known_problems.txt @@ -17,25 +17,34 @@ IP6TABLES=/sbin/ip6tables). c) 'shorewall6 load '. + Corrected in Shorewall 4.4.11.1 + 2) In a number of cases, Shorewall6 generates incorrect rules involving the IPv6 multicast network. The rules specify ff00::/10 where they should specify ff00::/8. Also, rules instantiated when the IPv6 firewall is stopped use ff80::/10 rather than fe80::/10 (IPv6 link local network). + Corrected in Shorewall 4.4.11.1 + 3) Using a destination port-range with :random produces a fatal - compilation error in REDIRECT rules. + compilation error in REDIRECT rules unless the firewall zone is + explicitly specified (e.g., $FW::2000-2010:random). -4) Shorewall-init is not reliable in bringing up interfaces during - boot on Ubuntu systems that use upstart. + Corrected in Shorewall 4.4.11.1 - Suggested workaround is to set startup=1 in your - /etc/default/shorewall* files. - -5) /sbin/shorewall and /sbin/shorewall6 sometimes fail to honor the +4) /sbin/shorewall and /sbin/shorewall6 sometimes fail to honor the 'nolock' option. In other cases, this option is incorrectly passed on to the compiled script, causing the script to issue a usage synopsis and to terminate. + Corrected in Shorewall 4.4.11.1 +5) On systems that use the Upstart init system (such as Ubuntu and + Fedora), Shorewall-init is not reliable at starting the firewall + during boot when normal firewall startup is disabled and UPDOWN=1 + is specified in /etc/default/shorewall-init. + Suggested workaround is to not disable normal startup (e.g., do not + set startup=0 on Debian-based systems and do not 'checkconfig + --del...' on Fedora). diff --git a/Shorewall/releasenotes.txt b/Shorewall/releasenotes.txt index 901ae6b4f..948b1831d 100644 --- a/Shorewall/releasenotes.txt +++ b/Shorewall/releasenotes.txt @@ -295,7 +295,14 @@ I I I. P R O B L E M S C O R R E C T E D I N T H I S R E L E A S E I V. K N O W N P R O B L E M S R E M A I N I N G ---------------------------------------------------------------------------- -None. +1) On systems that use the Upstart init system (such as Ubuntu and + Fedora), Shorewall-init is not reliable at starting the firewall + during boot when normal firewall startup is disabled and UPDOWN=1 + is specified in /etc/default/shorewall-init. + + Suggested workaround is to not disable normal startup (e.g., do not + set startup=0 on Debian-based systems and do not 'checkconfig + --del...' on Fedora). ---------------------------------------------------------------------------- V. N E W F E A T U R E S I N T H I S R E L E A S E