diff --git a/Shorewall/firewall b/Shorewall/firewall index fb472a6c4..d7cf77801 100755 --- a/Shorewall/firewall +++ b/Shorewall/firewall @@ -3684,10 +3684,6 @@ add_common_rules() { run_iptables -A INPUT -i lo -j ACCEPT run_iptables -A OUTPUT -o lo -j ACCEPT - # - # Enable icmp output - # - run_iptables -A OUTPUT -p icmp -j ACCEPT # # Route Filtering # diff --git a/Shorewall/hosts b/Shorewall/hosts index 9b8d11e36..bd9a73b9d 100644 --- a/Shorewall/hosts +++ b/Shorewall/hosts @@ -8,7 +8,10 @@ # # This file is used to define zones in terms of subnets and/or # individual IP addresses. Most simple setups don't need to -# (should not) place anything in this file. +# (should not) place anything in this file. Note that if you +# assign one or more interfaces to a zone in /etc/shorewall/interfaces, +# the hosts/networks that you define for the zone in the file will be +# IN ADDITION to those interfaces. # # ZONE - The name of a zone defined in /etc/shorewall/zones # diff --git a/Shorewall/releasenotes.txt b/Shorewall/releasenotes.txt index f6206baa2..34391ddea 100755 --- a/Shorewall/releasenotes.txt +++ b/Shorewall/releasenotes.txt @@ -38,4 +38,9 @@ Changes for 2.0 include: 4. Late arriving DNS replies are now silently dropped in the common chain by default. +5. In addition to behaving like OLD_PING_HANDLING=No, Shorewall 2.0 no + longer unconditionally accepts outbound ICMP packets. So if you want + to 'ping' from the firewall, you will need the appropriate rule or + policy. +