search for: ipt_tcpmss

...NFIG_IP_NF_TARGET_TCPMSS is a > loadable module, that should be loaded on demand. > Simon said: > Did you try adding it to /etc/shorewall/modules ? Actually, no I didn''t, so I''ve just tryed it. Found the module: /lib/modules/2.4.20-30.7.legacy/kernel/net/ipv4/netfilter/ipt_tcpmss.o so, I added this line to /etc/shorewall/modules loadmodule ipt_tcpmss so my modules file looks like this now: loadmodule ip_tables loadmodule iptable_filter loadmodule ipt_tcpmss # This one I added loadmodule ip_conntrack loadmodule ip_conntrack_ftp load...

...e Size Used by Not tainted ipt_ULOG 3424 25 3c509 7648 2 (autoclean) isa-pnp 28136 0 (autoclean) [3c509] iptable_mangle 2144 1 ipt_ttl 640 0 (unused) ipt_tos 480 0 (unused) ipt_tcpmss 928 0 (unused) ipt_multiport 640 0 ipt_mark 480 0 (unused) ipt_mac 672 0 (unused) ipt_state 608 30 ipt_limit 960 0 (unused) ipt_unclean 6784 0 (unused) iptable_filter 1728...

...# lsmod Module Size Used by Not tainted nls_cp437 4384 1 (autoclean) nls_iso8859-1 2880 1 (autoclean) smbfs 31680 1 (autoclean) serial 43968 0 (autoclean) (unused) af_packet 11144 2 (autoclean) ipt_TCPMSS 2368 1 (autoclean) ipt_TOS 1024 22 (autoclean) ipt_MASQUERADE 1216 2 (autoclean) ipt_MARK 736 13 (autoclean) ipt_LOG 3168 92 (autoclean) ipt_state 608 169 (autoclean) ip_nat_ftp 2944 0...

...5 at 11:03:36PM +0300, Andrey J. Melnikoff (TEMHOTA) wrote: > Hello. Hi Andrey, > Please, CC me, i'm not subscribed. > > Kernel 2.6.15-rc6 OOPS: > > kernel: general protection fault: 0000 [#1] > kernel: SMP > kernel: Modules linked in: ipt_REDIRECT ipt_LOG ipt_TOS ipt_TCPMSS ipt_tos > ip_nat_ftp ipt_tcpmss iptable_nat ip_nat iptable_mangle iptable_filter > ipt_multiport ipt_mac ipt_state ipt_limit ipt_conntrack ip_conntrack_ftp > ip_conntrack ip_tables af_packet ipv6 pcspkr floppy i2c_piix4 i2c_core > ohci_hcd usbcore aic7xxx scsi_transport_spi psmouse id...

...ed: Module Size Used by ebt_mark_m 1096 - ebt_mark 1096 - ebtables 17768 - ipt_mark 1128 - sch_wrr 11176 - sch_teql 4168 - sch_dsmark 5224 - cls_route 4936 - ipt_tcpmss 1640 - cls_tcindex 5256 - cls_u32 5772 - sch_ingress 2604 - ipt_TCPMSS 3208 - iptable_filter 1864 - ipt_MARK 1512 - cls_fw 3208 - iptable_mangle 1832 - ppp_async...

...at virtual address 00000019 Jun 10 10:28:59 shawarma kernel: printing eip: Jun 10 10:28:59 shawarma kernel: c0181d47 Jun 10 10:28:59 shawarma kernel: *pde = 00000000 Jun 10 10:28:59 shawarma kernel: Oops: 0000 [#1] Jun 10 10:28:59 shawarma kernel: Modules linked in: n_hdlc ppp_synctty ipv6 autofs ipt_TCPMSS ipt_MASQUERADE iptable_nat ip_conntrack iptable_filter ip_tables snd_ens1371 snd_rawmidi snd_seq_device snd_pcm_oss snd_mixer_oss snd_pcm snd_page_alloc snd_timer snd_ac97_codec snd soundcore uhci_hcd usbcore via_agp agpgart 3c59x Jun 10 10:28:59 shawarma kernel: CPU: 0 Jun 10 10:28:59 shawarma...

...tables modules (that supported by OpenVZ) installed, > loaded and working but under virtual > server its are invisible (if i correct understand). This is parameter in > vz.conf: > > IPTABLES="iptable_filter iptable_mangle ipt_limit ipt_multiport ipt_tos > ipt_TOS ipt_REJECT ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_LOG ipt_length > ip_conntrack ipt_state ipt_helper iptable_nat ip_nat_ftp ip_nat_irc > ipt_REDIRECT xt_mac" > > On the host node all OK: > > vserver1 / # shorewall check > Checking... > Checking /etc/shorewall/zones... > Determining Hos...

....o ipt_REDIRECT.o ip_conntrack_ftp.o ip_tables.o ipt_MASQUERADE.o ipt_REJECT.o ip_conntrack_h323.o ipt_ah.o ipt_MIRROR.o ipt_state.o ip_conntrack_irc.o ipt_conntrack.o ipt_mport.o ipt_string.o ip_conntrack.o ipt_dscp.o ipt_multiport.o ipt_tcpmss.o ip_conntrack_rpc_tcp.o ipt_DSCP.o ipt_NETLINK.o ipt_TCPMSS.o ip_conntrack_rpc_udp.o ipt_esp.o ipt_nth.o ipt_time.o ip_nat_ftp.o ipt_helper.o ipt_owner.o ipt_tos.o ip_nat_h323.o ipt_IMQ.o ipt_pkttype.o ipt_TOS.o ip_nat_irc...

I have had a web server listining sql-1433, www 80, ftp-21 using proxy arp with sub-netting in a three interface DMZ. All these ports are in the rules file as ACCEPT. With one exeception that 1433 allows a few host from the net. 21 and 80 allow all net to dmz connections. The policy is DMZ to net ACCEPT This has been working great for about a month or more until I rebooted the

...ragmented UDPv6 packets towards the destination. It does not happen when nf_conntrack_ipv6 is not loaded. This is the OOPS as dumped from the serial console: heimdall login: Oops: 0000 [#1] Modules linked in: sit sch_red sch_htb pppoe pppox ppp_generic slhc xt_CLASSIFY ipt_TOS xt_length ipt_tos ipt_TCPMSS xt_tcpudp ipt_MASQUERADE xt_state iptable_mangle iptable_filter iptable_nat nf_nat nf_conntrack_ipv4 ip_tables x_tables nf_conntrack_ipv6 nf_conntrack nfnetlink CPU: 0 EIP: 0060:[<00000001>] Not tainted VLI EFLAGS: 00010246 (2.6.20-rc3 #2) EIP is at 0x1 eax: cd215bc0 ebx: cd1...

We have a (supposedly) quite standard setup: 2 Dom0 with drbd-on-lvm and a bunch of DomU, on Quad Xeon Dell servers. We tried with both sid-based and etch-based (+ 3.1 xen hypervisor and drbd 8 from backports.org ) Dom0, and quite consistently have "kernel: invalid opcode: 0000 [1] SMP" errors which freezes Dom0 (during lasts tests a simple start-and-stop loop of 10 DomU can trigger

...th 2.6.17-2-k7 too. We haven't tried vanilla yet. All boxen are the same hardware (amd64, 32bit kernel+userland (debian/unstable) 1GB ram). The filesystem is residing on a raid0-md, consisting of 2 sata-disks. Any ideas what could cause this? Thanks, Christian. f8836d37 Modules linked in: ipt_TCPMSS xt_tcpudp xt_state iptable_filter ip_conntrack_ftp ip_conntrack_irc ip_conntrack nfnetlink ip_tables x_tables ipv6 ipip tunnel4 dm_snapshot dm_mirror dm_mod shpchp pci_hotplug i2c_viapro psmouse i2c_core serio_raw pcspkr evdev amd64_agp agpgart parport_pc parport rtc floppy ide_generic r8169 uh...

...0 (autoclean) (unused) ipt_TOS 1688 12 (autoclean) ipt_MASQUERADE 2232 1 (autoclean) ipt_REDIRECT 1400 1 (autoclean) ipt_unclean 7736 2 (autoclean) ipt_LOG 4184 8 (autoclean) ipt_REJECT 3736 4 (autoclean) ipt_TCPMSS 3064 1 (autoclean) ipt_state 1080 55 (autoclean) iptable_mangle 2808 1 (autoclean) iptable_nat 19992 1 (autoclean) [ipt_MASQUERADE ipt_REDIRECT] ip_conntrack_ftp 5120 0 (unused) ip_conntrack_irc 3552 0 (unused) ip_conntra...

...target allows for packets to be #                        manipulated for things like the TCPMSS #                        option, etc. # # -- # #    ipt_mark       - this target marks a given packet for future action. #                     This automatically loads the ipt_MARK module # #    ipt_tcpmss     - this target allows to manipulate the TCP MSS #                     option for braindead remote firewalls. #                     This automatically loads the ipt_TCPMSS module # #    ipt_limit      - this target allows for packets to be limited to #                     to many hits per se...

...et/ipv4/netfilter/ ip_conntrack.ko ip_nat_ftp.ko ipt_MASQUERADE.ko ipt_SAME.ko ipt_ecn.ko ipt_length.ko ipt_multiport.ko ipt_state.ko iptable_filter.ko ip_conntrack_ftp.ko ip_nat_irc.ko ipt_NETMAP.ko ipt_ah.ko ipt_esp.ko ipt_limit.ko ipt_owner.ko ipt_tcpmss.ko iptable_mangle.ko ip_conntrack_irc.ko ip_nat_tftp.ko ipt_REDIRECT.ko ipt_conntrack.ko ipt_helper.ko ipt_mac.ko ipt_pkttype.ko ipt_tos.ko iptable_nat.ko ip_conntrack_tftp.ko ip_tables.ko ipt_REJECT.ko ipt_dscp.ko ipt_iprange.ko ipt_mark.ko ipt_recent.ko...

I''m very new to shorewall. My setup is IP Gateway (CentOS 4 + Shorewall) with 3 NIC cards. Shorewall works great on the firewall machine. Bind also works (local net machines get IPs fine). Under firestarter, all works great. With shorewall, the loc machines can not route past the firewall. They can connect to the firewall, but not past it. Exactly what information should I post to get

...- this target allows for packets to be # manipulated for things like the TCPMSS # option, etc. # # -- # # ipt_mark - this target marks a given packet for future action. # This automatically loads the ipt_MARK module # # ipt_tcpmss - this target allows to manipulate the TCP MSS # option for braindead remote firewalls. # This automatically loads the ipt_TCPMSS module # # ipt_limit - this target allows for packets to be limited to # to many hits per sec/min...

...0.150 192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.1 default via 62.58.222.90 dev ppp0 Table default: ARP ? (192.168.1.105) at 00:0C:6E:D7:65:D1 [ether] on eth0 ? (10.0.0.138) at 00:90:D0:39:56:A7 [ether] on eth1 Modules ipt_MASQUERADE 3968 1 ipt_REJECT 6528 4 ipt_LOG 6272 10 ipt_TCPMSS 4480 1 ipt_state 2304 16 ipt_pkttype 2048 4 ipt_recent 10252 0 ipt_iprange 2048 0 ipt_physdev 2320 0 ipt_multiport 2304 2 ipt_conntrack 2816 0 ip_nat_irc 4464 0 ip_nat_tftp 3696 0 ip_nat_ftp 4976 0 ip_conntrack_irc 71600 1 ip_nat_irc ip_conntrack_tftp 3888 0 ip_conntrack_ftp 72240 1 ip_nat_ftp ip_c...

...rnel scope link src 192.168.0.50 default via 213.191.84.201 dev ppp0 Table default: ARP ? (192.168.0.48) auf 02:0E:A6:0B:8A:DB [ether] auf br0 ? (192.168.0.2) auf 00:E0:7D:82:0B:12 [ether] auf br0 ? (192.168.0.47) auf 00:0E:35:54:AE:2C [ether] auf br0 Modules ipt_mac 2048 1 ipt_tcpmss 2368 0 ipt_MASQUERADE 4032 1 ipt_REJECT 7104 4 ipt_LOG 6656 8 ipt_TCPMSS 4480 0 ipt_state 2112 19 ipt_pkttype 1792 4 ipt_recent 11148 0 ipt_iprange 1856 0 ipt_physdev...

Hello, You will find in attachment the layout of my current physical configuration. For now, the Cable ISP is not used. Since it is a dynamic ISP, my mailserver is rejected and my domain name registers on blacklists like ORDB and al. I want it to be used as a default gateway except for my mail server that would be seen as coming from my "honest" ADSL ISP. Here is