thr3ads.net - Shorewall announce - [Shorewall-users] Shorewall 1.4.1 [Mar 2003]

If this information is useful, please help other people find it:
Share via:

Tom Eastep

2003-Mar-23 10:23 UTC

[Shorewall-users] Shorewall 1.4.1

This is a minor release of Shorewall.

WARNING: This release introduces incompatibilities with prior releases.  
See http://www.shorewall.net/upgrade_issues.htm.

Changes are:

a) There is now a new NONE policy specifiable in
/etc/shorewall/policy. This policy will cause Shorewall to assume that
there will never be any traffic between the source and destination
zones.

b) Shorewall no longer creates rules to govern traffic from an
interface:subnet to itself.

c) Intra-zone traffic is always accepted now (exception is (b)
 above).. Intrazone policies and rules are no longer allowed.

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
Shoreline,     \ http://shorewall.sf.net
Washington USA  \ teastep@shorewall.net

Steven Jan Springl

2003-Mar-23 15:19 UTC

head link

[Shorewall-users] Shorewall 1.4.1

Tom;
         After upgrading from Shorewall 1.4.0 to 1.4.1, I receive the 
following messages during a "shorewall check"
         
Validating rules file...
/usr/share/shorewall/firewall: line 2174: [: =: unary operator expected
Rule "ACCEPT fw wan tcp  21,53,80" checked. 

The error message is issued for every rule in the rules file.

I have not tried it with a Shorewall start or restart.
If you need any further information, please let me know.

Steven.

Tom Eastep

2003-Mar-23 15:22 UTC

head link

[Shorewall-users] Shorewall 1.4.1

On Sun, 23 Mar 2003, Steven Jan Springl wrote:
> Tom;
>          After upgrading from Shorewall 1.4.0 to 1.4.1, I receive the 
> following messages during a "shorewall check"
>          
> Validating rules file...
> /usr/share/shorewall/firewall: line 2174: [: =: unary operator expected
> Rule "ACCEPT fw wan tcp  21,53,80" checked. 
> 
> The error message is issued for every rule in the rules file.
> 
> I have not tried it with a Shorewall start or restart.
> If you need any further information, please let me know.
> 
Please send a trace...

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
Shoreline,     \ http://shorewall.sf.net
Washington USA  \ teastep@shorewall.net

Steven Jan Springl

2003-Mar-23 15:41 UTC

head link

[Shorewall-users] Shorewall 1.4.1

On Sunday 23 March 2003 23:22, Tom Eastep wrote:> On Sun, 23 Mar 2003, Steven Jan Springl wrote:
> > Tom;
> >          After upgrading from Shorewall 1.4.0 to 1.4.1, I receive the
> > following messages during a "shorewall check"
> >
> > Validating rules file...
> > /usr/share/shorewall/firewall: line 2174: [: =: unary operator
expected
> > Rule "ACCEPT fw wan tcp  21,53,80" checked.
> >
> > The error message is issued for every rule in the rules file.
> >
> > I have not tried it with a Shorewall start or restart.
> > If you need any further information, please let me know.
>
> Please send a trace...
>
> -TomTom :
         Please find trace attached.
 Steven.
-------------- next part --------------
+ shift
+ nolock+ ''['' 1 -gt 1 '']''
+ trap ''my_mutex_off; exit 2'' 1 2 3 4 5 6 9
+ command=check
+ ''['' 1 -ne 1 '']''
+ do_initialize
+ export LC_ALL=C
+ LC_ALL=C
+ PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
+ terminator=startup_error
+ version+ FW+ SUBSYSLOCK+ STATEDIR+ ALLOWRELATED=Yes
+ LOGRATE+ LOGBURST+ LOGPARMS+ NAT_ENABLED+ MANGLE_ENABLED+ ADD_IP_ALIASES+
ADD_SNAT_ALIASES+ TC_ENABLED+ LOGUNCLEAN+ BLACKLIST_DISPOSITION+
BLACKLIST_LOGLEVEL+ CLAMPMSS+ ROUTE_FILTER+ NAT_BEFORE_RULES+ MULTIPORT+
DETECT_DNAT_IPADDRS+ MUTEX_TIMEOUT+ NEWNOTSYN+ LOGNEWNOTSYN+ FORWARDPING+
MACLIST_DISPOSITION+ MACLIST_LOG_LEVEL+ TCP_FLAGS_DISPOSITION+
TCP_FLAGS_LOG_LEVEL+ RFC1918_LOG_LEVEL+ MARK_IN_FORWARD_CHAIN+
SHARED_DIR=/usr/share/shorewall
+ FUNCTIONS+ VERSION_FILE+ stopping+ have_mutex+ masq_seq=1
+ nonat_seq=1
+ aliases_to_add+ TMP_DIR=/tmp/shorewall-4655
+ rm -rf /tmp/shorewall-4655
+ mkdir -p /tmp/shorewall-4655
+ chmod 700 /tmp/shorewall-4655
+ trap ''rm -rf /tmp/shorewall-4655; my_mutex_off; exit 2'' 1 2
3 4 5 6 9
+ FUNCTIONS=/usr/share/shorewall/functions
+ ''['' -f /usr/share/shorewall/functions '']''
+ . /usr/share/shorewall/functions
+ VERSION_FILE=/usr/share/shorewall/version
+ ''['' -f /usr/share/shorewall/version '']''
++ cat /usr/share/shorewall/version
+ version=1.4.1
+ run_user_exit params
++ find_file params
++ ''['' -n '''' -a -f /params
'']''
++ echo /etc/shorewall/params
+ local user_exit=/etc/shorewall/params
+ ''['' -f /etc/shorewall/params '']''
+ echo ''Processing /etc/shorewall/params ...''
+ . /etc/shorewall/params
++ find_file shorewall.conf
++ ''['' -n '''' -a -f /shorewall.conf
'']''
++ echo /etc/shorewall/shorewall.conf
+ config=/etc/shorewall/shorewall.conf
+ ''['' -f /etc/shorewall/shorewall.conf '']''
+ echo ''Processing /etc/shorewall/shorewall.conf...''
+ . /etc/shorewall/shorewall.conf
++ LOGFILE=/var/log/messages
++ LOGRATE++ LOGBURST++ LOGUNCLEAN=warn
++ BLACKLIST_LOGLEVEL=warn
++ LOGNEWNOTSYN=info
++ MACLIST_LOG_LEVEL=warn
++ TCP_FLAGS_LOG_LEVEL=warn
++ RFC1918_LOG_LEVEL=warn
++ PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
++ SUBSYSLOCK=/var/lock/subsys/shorewall
++ STATEDIR=/var/lib/shorewall
++ MODULESDIR++ FW=fw
++ NAT_ENABLED=Yes
++ MANGLE_ENABLED=Yes
++ IP_FORWARDING=On
++ ADD_IP_ALIASES=Yes
++ ADD_SNAT_ALIASES=No
++ TC_ENABLED=No
++ CLEAR_TC=Yes
++ MARK_IN_FORWARD_CHAIN=No
++ CLAMPMSS=Yes
++ ROUTE_FILTER=No
++ NAT_BEFORE_RULES=Yes
++ MULTIPORT=Yes
++ DETECT_DNAT_IPADDRS=No
++ MUTEX_TIMEOUT=60
++ NEWNOTSYN=No
++ BLACKLIST_DISPOSITION=DROP
++ MACLIST_DISPOSITION=REJECT
++ TCP_FLAGS_DISPOSITION=DROP
+ ''['' -z /var/lib/shorewall '']''
+ ''['' -d /var/lib/shorewall '']''
+ ''['' -z fw '']''
++ added_param_value_yes ALLOWRELATED Yes
++ local val=Yes
++ ''['' -z Yes '']''
++ echo Yes
+ ALLOWRELATED=Yes
+ ''['' -n Yes '']''
++ added_param_value_yes NAT_ENABLED Yes
++ local val=Yes
++ ''['' -z Yes '']''
++ echo Yes
+ NAT_ENABLED=Yes
++ added_param_value_yes MANGLE_ENABLED Yes
++ local val=Yes
++ ''['' -z Yes '']''
++ echo Yes
+ MANGLE_ENABLED=Yes
++ added_param_value_yes ADD_IP_ALIASES Yes
++ local val=Yes
++ ''['' -z Yes '']''
++ echo Yes
+ ADD_IP_ALIASES=Yes
++ added_param_value_yes TC_ENABLED No
++ local val=No
++ ''['' -z No '']''
++ echo ''''
+ TC_ENABLED+ ''['' -n ''''
'']''
+ ''['' -n On '']''
+ ''['' -n '''' -a -z Yes '']''
+ ''['' -z DROP '']''
++ added_param_value_no CLAMPMSS Yes
++ local val=Yes
++ ''['' -z Yes '']''
++ echo Yes
+ CLAMPMSS=Yes
++ added_param_value_no ADD_SNAT_ALIASES No
++ local val=No
++ ''['' -z No '']''
++ echo ''''
+ ADD_SNAT_ALIASES++ added_param_value_no ROUTE_FILTER No
++ local val=No
++ ''['' -z No '']''
++ echo ''''
+ ROUTE_FILTER++ added_param_value_yes NAT_BEFORE_RULES Yes
++ local val=Yes
++ ''['' -z Yes '']''
++ echo Yes
+ NAT_BEFORE_RULES=Yes
++ added_param_value_no MULTIPORT Yes
++ local val=Yes
++ ''['' -z Yes '']''
++ echo Yes
+ MULTIPORT=Yes
++ added_param_value_no DETECT_DNAT_IPADDRS No
++ local val=No
++ ''['' -z No '']''
++ echo ''''
+ DETECT_DNAT_IPADDRS++ added_param_value_no FORWARDPING
++ local val++ ''['' -z ''''
'']''
++ echo ''''
+ FORWARDPING+ ''['' -n ''''
'']''
++ added_param_value_yes NEWNOTSYN No
++ local val=No
++ ''['' -z No '']''
++ echo ''''
+ NEWNOTSYN+ maclist_target=reject
+ ''['' -n REJECT '']''
+ ''['' -n DROP '']''
+ ''['' -z warn '']''
++ added_param_value_no MARK_IN_FORWARD_CHAIN No
++ local val=No
++ ''['' -z No '']''
++ echo ''''
+ MARK_IN_FORWARD_CHAIN+ ''['' -n ''''
'']''
+ marking_chain=tcpre
+ ''['' -n '''' '']''
+ CLEAR_TC+ strip_file interfaces
+ local fname
+ ''['' 1 = 1 '']''
++ find_file interfaces
++ ''['' -n '''' -a -f /interfaces
'']''
++ echo /etc/shorewall/interfaces
+ fname=/etc/shorewall/interfaces
+ ''['' -f /etc/shorewall/interfaces '']''
+ cut -d# -f1 /etc/shorewall/interfaces
+ grep -v ''^[[:space:]]*$''
+ strip_file hosts
+ local fname
+ ''['' 1 = 1 '']''
++ find_file hosts
++ ''['' -n '''' -a -f /hosts
'']''
++ echo /etc/shorewall/hosts
+ fname=/etc/shorewall/hosts
+ ''['' -f /etc/shorewall/hosts '']''
+ cut -d# -f1 /etc/shorewall/hosts
+ grep -v ''^[[:space:]]*$''
+ check_config
+ disclaimer
+ echo
+ echo ''WARNING: THE
''\''''check''\'''' COMMAND IS
TOTALLY UNSUPPORTED AND PROBLEM''
+ echo ''         REPORTS COMPLAINING ABOUT ERRORS THAT IT
DIDN''\''''T CATCH''
+ echo ''         WILL NOT BE ACCEPTED''
+ echo
+ echo ''Verifying Configuration...''
+ verify_os_version
++ uname -r
+ osversion=2.4.19-4GB
++ lsmod
++ grep ''^ipchains''
+ ''['' check = start -a -n ''''
'']''
+ load_kernel_modules
+ ''['' -z '''' '']''
+ MODULESDIR=/lib/modules/2.4.19-4GB/kernel/net/ipv4/netfilter
++ find_file modules
++ ''['' -n '''' -a -f /modules
'']''
++ echo /etc/shorewall/modules
+ modules=/etc/shorewall/modules
+ ''['' -f /etc/shorewall/modules -a -d
/lib/modules/2.4.19-4GB/kernel/net/ipv4/netfilter '']''
+ echo ''Loading Modules...''
+ . /etc/shorewall/modules
++ loadmodule ip_tables
++ local modulename=ip_tables
++ local modulefile
+++ lsmod
+++ grep ip_tables
++ ''['' -z ''ip_tables              11576  13  [ipt_TOS
ipt_MASQUERADE ipt_multiport ipt_unclean ipt_REJECT ipt_LOG ipt_TCPMSS ipt_state
iptable_mangle iptable_nat iptable_filter]'' '']''
++ loadmodule iptable_filter
++ local modulename=iptable_filter
++ local modulefile
+++ lsmod
+++ grep iptable_filter
++ ''['' -z ''iptable_filter          1644   1 
(autoclean)
ip_tables              11576  13  [ipt_TOS ipt_MASQUERADE ipt_multiport
ipt_unclean ipt_REJECT ipt_LOG ipt_TCPMSS ipt_state iptable_mangle iptable_nat
iptable_filter]'' '']''
++ loadmodule ip_conntrack
++ local modulename=ip_conntrack
++ local modulefile
+++ lsmod
+++ grep ip_conntrack
++ ''['' -z ''ip_conntrack_irc        2496   0  (unused)
ip_conntrack_ftp        3456   0  (unused)
ip_conntrack           14140   4  [ipt_MASQUERADE ipt_state ip_nat_irc
ip_nat_ftp iptable_nat ip_conntrack_irc ip_conntrack_ftp]''
'']''
++ loadmodule ip_conntrack_ftp
++ local modulename=ip_conntrack_ftp
++ local modulefile
+++ lsmod
+++ grep ip_conntrack_ftp
++ ''['' -z ''ip_conntrack_ftp        3456   0  (unused)
ip_conntrack           14140   4  [ipt_MASQUERADE ipt_state ip_nat_irc
ip_nat_ftp iptable_nat ip_conntrack_irc ip_conntrack_ftp]''
'']''
++ loadmodule ip_conntrack_irc
++ local modulename=ip_conntrack_irc
++ local modulefile
+++ lsmod
+++ grep ip_conntrack_irc
++ ''['' -z ''ip_conntrack_irc        2496   0  (unused)
ip_conntrack           14140   4  [ipt_MASQUERADE ipt_state ip_nat_irc
ip_nat_ftp iptable_nat ip_conntrack_irc ip_conntrack_ftp]''
'']''
++ loadmodule iptable_nat
++ local modulename=iptable_nat
++ local modulefile
+++ lsmod
+++ grep iptable_nat
++ ''['' -z ''iptable_nat            13688   3 
[ipt_MASQUERADE ip_nat_irc ip_nat_ftp]
ip_conntrack           14140   4  [ipt_MASQUERADE ipt_state ip_nat_irc
ip_nat_ftp iptable_nat ip_conntrack_irc ip_conntrack_ftp]
ip_tables              11576  13  [ipt_TOS ipt_MASQUERADE ipt_multiport
ipt_unclean ipt_REJECT ipt_LOG ipt_TCPMSS ipt_state iptable_mangle iptable_nat
iptable_filter]'' '']''
++ loadmodule ip_nat_ftp
++ local modulename=ip_nat_ftp
++ local modulefile
+++ lsmod
+++ grep ip_nat_ftp
++ ''['' -z ''ip_nat_ftp              3056   0  (unused)
iptable_nat            13688   3  [ipt_MASQUERADE ip_nat_irc ip_nat_ftp]
ip_conntrack           14140   4  [ipt_MASQUERADE ipt_state ip_nat_irc
ip_nat_ftp iptable_nat ip_conntrack_irc ip_conntrack_ftp]''
'']''
++ loadmodule ip_nat_irc
++ local modulename=ip_nat_irc
++ local modulefile
+++ lsmod
+++ grep ip_nat_irc
++ ''['' -z ''ip_nat_irc              2480   0  (unused)
iptable_nat            13688   3  [ipt_MASQUERADE ip_nat_irc ip_nat_ftp]
ip_conntrack           14140   4  [ipt_MASQUERADE ipt_state ip_nat_irc
ip_nat_ftp iptable_nat ip_conntrack_irc ip_conntrack_ftp]''
'']''
+ echo ''Determining Zones...''
+ determine_zones
++ find_file zones
++ ''['' -n '''' -a -f /zones
'']''
++ echo /etc/shorewall/zones
+ local zonefile=/etc/shorewall/zones
+ multi_display=Multi-zone
+ ''['' -f /etc/shorewall/zones '']''
++ find_zones /etc/shorewall/zones
++ read zone display comments
++ ''['' -n ''#'' '']''
++ read zone display comments
++ ''['' -n ''#'' '']''
++ read zone display comments
++ ''['' -n ''#'' '']''
++ read zone display comments
++ ''['' -n ''#'' '']''
++ read zone display comments
++ ''['' -n ''#'' '']''
++ read zone display comments
++ ''['' -n ''#'' '']''
++ read zone display comments
++ ''['' -n ''#'' '']''
++ read zone display comments
++ ''['' -n ''#'' '']''
++ read zone display comments
++ ''['' -n ''#'' '']''
++ read zone display comments
++ ''['' -n ''#ZONE'' '']''
++ read zone display comments
++ ''['' -n wan '']''
++ echo wan
++ read zone display comments
++ ''['' -n lan '']''
++ echo lan
++ read zone display comments
++ ''['' -n ''#dmz'' '']''
++ read zone display comments
++ ''['' -n ''#LAST'' '']''
++ read zone display comments
+ zones=wan
lan
++ echo wan lan
+ zones=wan lan
++ find_display wan /etc/shorewall/zones
++ read z display comments
++ grep ''^wan'' /etc/shorewall/zones
++ ''['' xwan = xwan '']''
++ echo WAN
++ read z display comments
+ dsply=WAN
+ eval ''wan_display=$dsply''
++ wan_display=WAN
++ find_display lan /etc/shorewall/zones
++ grep ''^lan'' /etc/shorewall/zones
++ read z display comments
++ ''['' xlan = xlan '']''
++ echo LAN
++ read z display comments
+ dsply=LAN
+ eval ''lan_display=$dsply''
++ lan_display=LAN
+ ''['' -z ''wan lan'' '']''
+ display_list Zones: wan lan
+ ''['' 3 -gt 1 '']''
+ echo ''   Zones: wan lan''
+ echo ''Validating interfaces file...''
+ validate_interfaces_file
+ read z interface subnet options
+ expandv z interface subnet options
+ local varval
+ ''['' 4 -gt 0 '']''
+ eval ''varval=$z''
++ varval=wan
+ eval ''z="wan"''
++ z=wan
+ shift
+ ''['' 3 -gt 0 '']''
+ eval ''varval=$interface''
++ varval=ppp+
+ eval ''interface="ppp+"''
++ interface=ppp+
+ shift
+ ''['' 2 -gt 0 '']''
+ eval ''varval=$subnet''
++ varval=-
+ eval ''subnet="-"''
++ subnet=-
+ shift
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$options''
++ varval=logunclean,tcpflags,norfc1918
+ eval ''options="logunclean,tcpflags,norfc1918"''
++ options=logunclean,tcpflags,norfc1918
+ shift
+ ''['' 0 -gt 0 '']''
+ r=wan ppp+ - logunclean,tcpflags,norfc1918
+ ''['' xwan = x- '']''
+ ''['' -n wan '']''
+ validate_zone wan
+ list_search wan wan lan fw
+ local e=wan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xwan = xwan '']''
+ return 0
++ ip link show ppp+
++ grep LOOPBACK
+ ''['' -n '''' '']''
+ list_search ppp+
+ local e=ppp+
+ ''['' 1 -gt 1 '']''
+ return 1
+ all_interfaces= ppp+
++ separate_list logunclean,tcpflags,norfc1918
++ local list
++ local part
++ local newlist
++ list=logunclean,tcpflags,norfc1918
++ part=logunclean
++ newlist=logunclean
++ ''['' xlogunclean ''!=''
xlogunclean,tcpflags,norfc1918 '']''
++ list=tcpflags,norfc1918
++ part=tcpflags
++ newlist=logunclean tcpflags
++ ''['' xtcpflags ''!='' xtcpflags,norfc1918
'']''
++ list=norfc1918
++ part=norfc1918
++ newlist=logunclean tcpflags norfc1918
++ ''['' xnorfc1918 ''!='' xnorfc1918
'']''
++ echo ''logunclean tcpflags norfc1918''
+ options=logunclean tcpflags norfc1918
++ chain_base ppp+
++ local c=ppp
++ echo ppp
+ interface=ppp
+ eval ppp_broadcast=-
++ ppp_broadcast=-
+ eval ppp_zone=wan
++ ppp_zone=wan
+ eval ''ppp_options="logunclean'' tcpflags
''norfc1918"''
++ ppp_options=logunclean tcpflags norfc1918
+ ''['' -z '' ppp+'' '']''
+ read z interface subnet options
+ expandv z interface subnet options
+ local varval
+ ''['' 4 -gt 0 '']''
+ eval ''varval=$z''
++ varval=lan
+ eval ''z="lan"''
++ z=lan
+ shift
+ ''['' 3 -gt 0 '']''
+ eval ''varval=$interface''
++ varval=eth0
+ eval ''interface="eth0"''
++ interface=eth0
+ shift
+ ''['' 2 -gt 0 '']''
+ eval ''varval=$subnet''
++ varval=192.168.0.255
+ eval ''subnet="192.168.0.255"''
++ subnet=192.168.0.255
+ shift
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$options''
++ varval=routefilter,logunclean,tcpflags
+ eval ''options="routefilter,logunclean,tcpflags"''
++ options=routefilter,logunclean,tcpflags
+ shift
+ ''['' 0 -gt 0 '']''
+ r=lan eth0 192.168.0.255 routefilter,logunclean,tcpflags
+ ''['' xlan = x- '']''
+ ''['' -n lan '']''
+ validate_zone lan
+ list_search lan wan lan fw
+ local e=lan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xlan = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xlan = xlan '']''
+ return 0
++ ip link show eth0
++ grep LOOPBACK
+ ''['' -n '''' '']''
+ list_search eth0 ppp+
+ local e=eth0
+ ''['' 2 -gt 1 '']''
+ shift
+ ''['' xeth0 = xppp+ '']''
+ ''['' 1 -gt 1 '']''
+ return 1
+ all_interfaces= ppp+ eth0
++ separate_list routefilter,logunclean,tcpflags
++ local list
++ local part
++ local newlist
++ list=routefilter,logunclean,tcpflags
++ part=routefilter
++ newlist=routefilter
++ ''['' xroutefilter ''!=''
xroutefilter,logunclean,tcpflags '']''
++ list=logunclean,tcpflags
++ part=logunclean
++ newlist=routefilter logunclean
++ ''['' xlogunclean ''!='' xlogunclean,tcpflags
'']''
++ list=tcpflags
++ part=tcpflags
++ newlist=routefilter logunclean tcpflags
++ ''['' xtcpflags ''!='' xtcpflags
'']''
++ echo ''routefilter logunclean tcpflags''
+ options=routefilter logunclean tcpflags
++ chain_base eth0
++ local c=eth0
++ echo eth0
+ interface=eth0
+ eval eth0_broadcast=192.168.0.255
++ eth0_broadcast=192.168.0.255
+ eval eth0_zone=lan
++ eth0_zone=lan
+ eval ''eth0_options="routefilter'' logunclean
''tcpflags"''
++ eth0_options=routefilter logunclean tcpflags
+ ''['' -z '' ppp+ eth0'' '']''
+ read z interface subnet options
+ expandv z interface subnet options
+ local varval
+ ''['' 4 -gt 0 '']''
+ eval ''varval=$z''
++ varval=lan
+ eval ''z="lan"''
++ z=lan
+ shift
+ ''['' 3 -gt 0 '']''
+ eval ''varval=$interface''
++ varval=eth1
+ eval ''interface="eth1"''
++ interface=eth1
+ shift
+ ''['' 2 -gt 0 '']''
+ eval ''varval=$subnet''
++ varval=192.168.1.255
+ eval ''subnet="192.168.1.255"''
++ subnet=192.168.1.255
+ shift
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$options''
++ varval=routefilter,logunclean,tcpflags
+ eval ''options="routefilter,logunclean,tcpflags"''
++ options=routefilter,logunclean,tcpflags
+ shift
+ ''['' 0 -gt 0 '']''
+ r=lan eth1 192.168.1.255 routefilter,logunclean,tcpflags
+ ''['' xlan = x- '']''
+ ''['' -n lan '']''
+ validate_zone lan
+ list_search lan wan lan fw
+ local e=lan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xlan = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xlan = xlan '']''
+ return 0
++ ip link show eth1
++ grep LOOPBACK
+ ''['' -n '''' '']''
+ list_search eth1 ppp+ eth0
+ local e=eth1
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xeth1 = xppp+ '']''
+ ''['' 2 -gt 1 '']''
+ shift
+ ''['' xeth1 = xeth0 '']''
+ ''['' 1 -gt 1 '']''
+ return 1
+ all_interfaces= ppp+ eth0 eth1
++ separate_list routefilter,logunclean,tcpflags
++ local list
++ local part
++ local newlist
++ list=routefilter,logunclean,tcpflags
++ part=routefilter
++ newlist=routefilter
++ ''['' xroutefilter ''!=''
xroutefilter,logunclean,tcpflags '']''
++ list=logunclean,tcpflags
++ part=logunclean
++ newlist=routefilter logunclean
++ ''['' xlogunclean ''!='' xlogunclean,tcpflags
'']''
++ list=tcpflags
++ part=tcpflags
++ newlist=routefilter logunclean tcpflags
++ ''['' xtcpflags ''!='' xtcpflags
'']''
++ echo ''routefilter logunclean tcpflags''
+ options=routefilter logunclean tcpflags
++ chain_base eth1
++ local c=eth1
++ echo eth1
+ interface=eth1
+ eval eth1_broadcast=192.168.1.255
++ eth1_broadcast=192.168.1.255
+ eval eth1_zone=lan
++ eth1_zone=lan
+ eval ''eth1_options="routefilter'' logunclean
''tcpflags"''
++ eth1_options=routefilter logunclean tcpflags
+ ''['' -z '' ppp+ eth0 eth1''
'']''
+ read z interface subnet options
+ echo ''Validating hosts file...''
+ validate_hosts_file
+ read z hosts options
+ echo ''Determining Hosts in Zones...''
+ determine_interfaces
++ find_interfaces wan
++ local zne=wan
++ local z
++ local interface
+++ chain_base ppp+
+++ local c=ppp
+++ echo ppp
++ eval ''z=$ppp_zone''
+++ z=wan
++ ''['' xwan = xwan '']''
++ echo ppp+
+++ chain_base eth0
+++ local c=eth0
+++ echo eth0
++ eval ''z=$eth0_zone''
+++ z=lan
++ ''['' xlan = xwan '']''
+++ chain_base eth1
+++ local c=eth1
+++ echo eth1
++ eval ''z=$eth1_zone''
+++ z=lan
++ ''['' xlan = xwan '']''
+ interfaces=ppp+
++ echo ppp+
+ interfaces=ppp+
+ eval ''wan_interfaces="$interfaces"''
++ wan_interfaces=ppp+
++ find_interfaces lan
++ local zne=lan
++ local z
++ local interface
+++ chain_base ppp+
+++ local c=ppp
+++ echo ppp
++ eval ''z=$ppp_zone''
+++ z=wan
++ ''['' xwan = xlan '']''
+++ chain_base eth0
+++ local c=eth0
+++ echo eth0
++ eval ''z=$eth0_zone''
+++ z=lan
++ ''['' xlan = xlan '']''
++ echo eth0
+++ chain_base eth1
+++ local c=eth1
+++ echo eth1
++ eval ''z=$eth1_zone''
+++ z=lan
++ ''['' xlan = xlan '']''
++ echo eth1
+ interfaces=eth0
eth1
++ echo eth0 eth1
+ interfaces=eth0 eth1
+ eval ''lan_interfaces="$interfaces"''
++ lan_interfaces=eth0 eth1
+ determine_hosts
++ find_hosts wan
++ local hosts
++ read z hosts options
+ hosts++ echo
+ hosts+ eval ''interfaces=$wan_interfaces''
++ interfaces=ppp+
+ ''['' -z '''' '']''
+ hosts=ppp+:0.0.0.0/0
+ interfaces+ interface=ppp+
+ list_search ppp+
+ local e=ppp+
+ ''['' 1 -gt 1 '']''
+ return 1
+ ''['' -z '''' '']''
+ interfaces=ppp+
+ eval ''wan_interfaces=$interfaces''
++ wan_interfaces=ppp+
+ eval ''wan_hosts=$hosts''
++ wan_hosts=ppp+:0.0.0.0/0
+ ''['' -n ppp+:0.0.0.0/0 '']''
+ eval ''display=$wan_display''
++ display=WAN
+ display_list ''WAN Zone:'' ppp+:0.0.0.0/0
+ ''['' 2 -gt 1 '']''
+ echo ''   WAN Zone: ppp+:0.0.0.0/0''
++ find_hosts lan
++ local hosts
++ read z hosts options
+ hosts++ echo
+ hosts+ eval ''interfaces=$lan_interfaces''
++ interfaces=eth0 eth1
+ ''['' -z '''' '']''
+ hosts=eth0:0.0.0.0/0
+ ''['' -z eth0:0.0.0.0/0 '']''
+ hosts=eth0:0.0.0.0/0 eth1:0.0.0.0/0
+ interfaces+ interface=eth0
+ list_search eth0
+ local e=eth0
+ ''['' 1 -gt 1 '']''
+ return 1
+ ''['' -z '''' '']''
+ interfaces=eth0
+ interface=eth1
+ list_search eth1 eth0
+ local e=eth1
+ ''['' 2 -gt 1 '']''
+ shift
+ ''['' xeth1 = xeth0 '']''
+ ''['' 1 -gt 1 '']''
+ return 1
+ ''['' -z eth0 '']''
+ interfaces=eth0 eth1
+ eval ''lan_interfaces=$interfaces''
++ lan_interfaces=eth0 eth1
+ eval ''lan_hosts=$hosts''
++ lan_hosts=eth0:0.0.0.0/0 eth1:0.0.0.0/0
+ ''['' -n ''eth0:0.0.0.0/0 eth1:0.0.0.0/0''
'']''
+ eval ''display=$lan_display''
++ display=LAN
+ display_list ''LAN Zone:'' eth0:0.0.0.0/0 eth1:0.0.0.0/0
+ ''['' 3 -gt 1 '']''
+ echo ''   LAN Zone: eth0:0.0.0.0/0 eth1:0.0.0.0/0''
+ echo ''Validating rules file...''
++ find_file rules
++ ''['' -n '''' -a -f /rules
'']''
++ echo /etc/shorewall/rules
+ rules=/etc/shorewall/rules
+ strip_file rules /etc/shorewall/rules
+ local fname
+ ''['' 2 = 1 '']''
+ fname=/etc/shorewall/rules
+ ''['' -f /etc/shorewall/rules '']''
+ cut -d# -f1 /etc/shorewall/rules
+ grep -v ''^[[:space:]]*$''
+ process_rules
+ read xtarget xclients xservers xprotocol xports xcports xaddress
+ expandv xclients xservers xprotocol xports xcports xaddress
+ local varval
+ ''['' 6 -gt 0 '']''
+ eval ''varval=$xclients''
++ varval=fw
+ eval ''xclients="fw"''
++ xclients=fw
+ shift
+ ''['' 5 -gt 0 '']''
+ eval ''varval=$xservers''
++ varval=wan
+ eval ''xservers="wan"''
++ xservers=wan
+ shift
+ ''['' 4 -gt 0 '']''
+ eval ''varval=$xprotocol''
++ varval=tcp
+ eval ''xprotocol="tcp"''
++ xprotocol=tcp
+ shift
+ ''['' 3 -gt 0 '']''
+ eval ''varval=$xports''
++ varval=21,53,80
+ eval ''xports="21,53,80"''
++ xports=21,53,80
+ shift
+ ''['' 2 -gt 0 '']''
+ eval ''varval=$xcports''
++ varval+ eval ''xcports=""''
++ xcports+ shift
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$xaddress''
++ varval+ eval ''xaddress=""''
++ xaddress+ shift
+ ''['' 0 -gt 0 '']''
+ ''['' xfw = xall '']''
+ ''['' xwan = xall '']''
+ process_rule ACCEPT fw wan tcp 21,53,80
+ local target=ACCEPT
+ local clients=fw
+ local servers=wan
+ local protocol=tcp
+ local ports=21,53,80
+ local cports+ local address++ echo ACCEPT fw wan tcp 21,53,80
+ local ''rule=ACCEPT fw wan tcp 21,53,80''
+ ''['' ACCEPT = ACCEPT '']''
+ loglevel+ logtarget=ACCEPT
+ dnat_only+ ''['' x = x- '']''
+ ''['' fw = fw '']''
+ clientzone=fw
+ clients+ ''['' fw = fw '']''
+ excludezones+ validate_zone fw
+ list_search fw wan lan fw
+ local e=fw
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xfw = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xfw = xlan '']''
+ ''['' 2 -gt 1 '']''
+ shift
+ ''['' xfw = xfw '']''
+ return 0
+ source=fw
+ ''['' fw = fw '']''
+ source_hosts+ ''['' wan = wan '']''
+ serverzone=wan
+ servers+ serverport+ validate_zone wan
+ list_search wan wan lan fw
+ local e=wan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xwan = xwan '']''
+ return 0
+ dest=wan
+ chain=fw2wan
+ eval ''policy=$fw2wan_policy''
++ policy+ ''['' = NONE '']''
/usr/share/shorewall/firewall: line 2174: [: =: unary operator expected
+ ''['' check = check '']''
+ ''['' xfw2wan = xfw2fw '']''
+ ''['' check = check '']''
++ list_count 21,53,80
+++ separate_list 21,53,80
+++ local list
+++ local part
+++ local newlist
+++ list=21,53,80
+++ part=21
+++ newlist=21
+++ ''['' x21 ''!='' x21,53,80
'']''
+++ list=53,80
+++ part=53
+++ newlist=21 53
+++ ''['' x53 ''!='' x53,80
'']''
+++ list=80
+++ part=80
+++ newlist=21 53 80
+++ ''['' x80 ''!='' x80 '']''
+++ echo ''21 53 80''
++ arg_count 21 53 80
++ echo 3
++ list_count
+++ separate_list
+++ local list
+++ local part
+++ local newlist
+++ list+++ part+++ newlist+++ ''['' x ''!='' x
'']''
+++ echo ''''
++ arg_count
++ echo 0
+ ''['' -n Yes -a 21,53,80 = 21,53,80 -a '''' =
'''' -a 3 -le 15 -a 0 -le 15 '']''
+ multioption=-m multiport
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
+ port=21,53,80
+ cport=-
+ add_a_rule
+ cli+ ''['' -n - '']''
+ dest_interface+ serv+ ''['' -n - '']''
+ sports+ dports+ state=-m state --state NEW
+ proto=tcp
+ addr+ servport+ multiport+ ''['' -n 21,53,80 -a x21,53,80
''!='' x- '']''
+ dports=--dport
+ ''['' -n ''-m multiport'' -a 21,53,80
''!='' 21,53 '']''
+ multiport=-m multiport
+ dports=--dports
+ dports=--dports 21,53,80
+ ''['' -n - -a x- ''!='' x-
'']''
+ proto=-p tcp
+ ''['' -z ''-p tcp'' -a -z ''''
-a -z '''' -a -z '''' '']''
+ ''['' -n '''' '']''
+ ''['' -n '''' '']''
+ ''['' check ''!='' check '']''
+ ''['' check = check '']''
+ echo ''   Rule "ACCEPT fw wan tcp 21,53,80"
checked.''
+ read xtarget xclients xservers xprotocol xports xcports xaddress
+ expandv xclients xservers xprotocol xports xcports xaddress
+ local varval
+ ''['' 6 -gt 0 '']''
+ eval ''varval=$xclients''
++ varval=fw
+ eval ''xclients="fw"''
++ xclients=fw
+ shift
+ ''['' 5 -gt 0 '']''
+ eval ''varval=$xservers''
++ varval=wan
+ eval ''xservers="wan"''
++ xservers=wan
+ shift
+ ''['' 4 -gt 0 '']''
+ eval ''varval=$xprotocol''
++ varval=udp
+ eval ''xprotocol="udp"''
++ xprotocol=udp
+ shift
+ ''['' 3 -gt 0 '']''
+ eval ''varval=$xports''
++ varval=53
+ eval ''xports="53"''
++ xports=53
+ shift
+ ''['' 2 -gt 0 '']''
+ eval ''varval=$xcports''
++ varval+ eval ''xcports=""''
++ xcports+ shift
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$xaddress''
++ varval+ eval ''xaddress=""''
++ xaddress+ shift
+ ''['' 0 -gt 0 '']''
+ ''['' xfw = xall '']''
+ ''['' xwan = xall '']''
+ process_rule ACCEPT fw wan udp 53
+ local target=ACCEPT
+ local clients=fw
+ local servers=wan
+ local protocol=udp
+ local ports=53
+ local cports+ local address++ echo ACCEPT fw wan udp 53
+ local ''rule=ACCEPT fw wan udp 53''
+ ''['' ACCEPT = ACCEPT '']''
+ loglevel+ logtarget=ACCEPT
+ dnat_only+ ''['' x = x- '']''
+ ''['' fw = fw '']''
+ clientzone=fw
+ clients+ ''['' fw = fw '']''
+ excludezones+ validate_zone fw
+ list_search fw wan lan fw
+ local e=fw
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xfw = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xfw = xlan '']''
+ ''['' 2 -gt 1 '']''
+ shift
+ ''['' xfw = xfw '']''
+ return 0
+ source=fw
+ ''['' fw = fw '']''
+ source_hosts+ ''['' wan = wan '']''
+ serverzone=wan
+ servers+ serverport+ validate_zone wan
+ list_search wan wan lan fw
+ local e=wan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xwan = xwan '']''
+ return 0
+ dest=wan
+ chain=fw2wan
+ eval ''policy=$fw2wan_policy''
++ policy+ ''['' = NONE '']''
/usr/share/shorewall/firewall: line 2174: [: =: unary operator expected
+ ''['' check = check '']''
+ ''['' xfw2wan = xfw2fw '']''
+ ''['' check = check '']''
++ list_count 53
+++ separate_list 53
+++ local list
+++ local part
+++ local newlist
+++ list=53
+++ part=53
+++ newlist=53
+++ ''['' x53 ''!='' x53 '']''
+++ echo 53
++ arg_count 53
++ echo 1
++ list_count
+++ separate_list
+++ local list
+++ local part
+++ local newlist
+++ list+++ part+++ newlist+++ ''['' x ''!='' x
'']''
+++ echo ''''
++ arg_count
++ echo 0
+ ''['' -n Yes -a 53 = 53 -a '''' =
'''' -a 1 -le 15 -a 0 -le 15 '']''
+ multioption=-m multiport
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
+ port=53
+ cport=-
+ add_a_rule
+ cli+ ''['' -n - '']''
+ dest_interface+ serv+ ''['' -n - '']''
+ sports+ dports+ state=-m state --state NEW
+ proto=udp
+ addr+ servport+ multiport+ ''['' -n 53 -a x53
''!='' x- '']''
+ dports=--dport
+ ''['' -n ''-m multiport'' -a 53
''!='' 53 '']''
+ dports=--dport 53
+ ''['' -n - -a x- ''!='' x-
'']''
+ proto=-p udp
+ ''['' -z ''-p udp'' -a -z ''''
-a -z '''' -a -z '''' '']''
+ ''['' -n '''' '']''
+ ''['' -n '''' '']''
+ ''['' check ''!='' check '']''
+ ''['' check = check '']''
+ echo ''   Rule "ACCEPT fw wan udp 53" checked.''
+ read xtarget xclients xservers xprotocol xports xcports xaddress
+ expandv xclients xservers xprotocol xports xcports xaddress
+ local varval
+ ''['' 6 -gt 0 '']''
+ eval ''varval=$xclients''
++ varval=fw
+ eval ''xclients="fw"''
++ xclients=fw
+ shift
+ ''['' 5 -gt 0 '']''
+ eval ''varval=$xservers''
++ varval=lan
+ eval ''xservers="lan"''
++ xservers=lan
+ shift
+ ''['' 4 -gt 0 '']''
+ eval ''varval=$xprotocol''
++ varval=udp
+ eval ''xprotocol="udp"''
++ xprotocol=udp
+ shift
+ ''['' 3 -gt 0 '']''
+ eval ''varval=$xports''
++ varval=514
+ eval ''xports="514"''
++ xports=514
+ shift
+ ''['' 2 -gt 0 '']''
+ eval ''varval=$xcports''
++ varval+ eval ''xcports=""''
++ xcports+ shift
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$xaddress''
++ varval+ eval ''xaddress=""''
++ xaddress+ shift
+ ''['' 0 -gt 0 '']''
+ ''['' xfw = xall '']''
+ ''['' xlan = xall '']''
+ process_rule ACCEPT fw lan udp 514
+ local target=ACCEPT
+ local clients=fw
+ local servers=lan
+ local protocol=udp
+ local ports=514
+ local cports+ local address++ echo ACCEPT fw lan udp 514
+ local ''rule=ACCEPT fw lan udp 514''
+ ''['' ACCEPT = ACCEPT '']''
+ loglevel+ logtarget=ACCEPT
+ dnat_only+ ''['' x = x- '']''
+ ''['' fw = fw '']''
+ clientzone=fw
+ clients+ ''['' fw = fw '']''
+ excludezones+ validate_zone fw
+ list_search fw wan lan fw
+ local e=fw
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xfw = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xfw = xlan '']''
+ ''['' 2 -gt 1 '']''
+ shift
+ ''['' xfw = xfw '']''
+ return 0
+ source=fw
+ ''['' fw = fw '']''
+ source_hosts+ ''['' lan = lan '']''
+ serverzone=lan
+ servers+ serverport+ validate_zone lan
+ list_search lan wan lan fw
+ local e=lan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xlan = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xlan = xlan '']''
+ return 0
+ dest=lan
+ chain=fw2lan
+ eval ''policy=$fw2lan_policy''
++ policy+ ''['' = NONE '']''
/usr/share/shorewall/firewall: line 2174: [: =: unary operator expected
+ ''['' check = check '']''
+ ''['' xfw2lan = xfw2fw '']''
+ ''['' check = check '']''
++ list_count 514
+++ separate_list 514
+++ local list
+++ local part
+++ local newlist
+++ list=514
+++ part=514
+++ newlist=514
+++ ''['' x514 ''!='' x514 '']''
+++ echo 514
++ arg_count 514
++ echo 1
++ list_count
+++ separate_list
+++ local list
+++ local part
+++ local newlist
+++ list+++ part+++ newlist+++ ''['' x ''!='' x
'']''
+++ echo ''''
++ arg_count
++ echo 0
+ ''['' -n Yes -a 514 = 514 -a '''' =
'''' -a 1 -le 15 -a 0 -le 15 '']''
+ multioption=-m multiport
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
+ port=514
+ cport=-
+ add_a_rule
+ cli+ ''['' -n - '']''
+ dest_interface+ serv+ ''['' -n - '']''
+ sports+ dports+ state=-m state --state NEW
+ proto=udp
+ addr+ servport+ multiport+ ''['' -n 514 -a x514
''!='' x- '']''
+ dports=--dport
+ ''['' -n ''-m multiport'' -a 514
''!='' 514 '']''
+ dports=--dport 514
+ ''['' -n - -a x- ''!='' x-
'']''
+ proto=-p udp
+ ''['' -z ''-p udp'' -a -z ''''
-a -z '''' -a -z '''' '']''
+ ''['' -n '''' '']''
+ ''['' -n '''' '']''
+ ''['' check ''!='' check '']''
+ ''['' check = check '']''
+ echo ''   Rule "ACCEPT fw lan udp 514" checked.''
+ read xtarget xclients xservers xprotocol xports xcports xaddress
+ expandv xclients xservers xprotocol xports xcports xaddress
+ local varval
+ ''['' 6 -gt 0 '']''
+ eval ''varval=$xclients''
++ varval=lan
+ eval ''xclients="lan"''
++ xclients=lan
+ shift
+ ''['' 5 -gt 0 '']''
+ eval ''varval=$xservers''
++ varval=fw
+ eval ''xservers="fw"''
++ xservers=fw
+ shift
+ ''['' 4 -gt 0 '']''
+ eval ''varval=$xprotocol''
++ varval=tcp
+ eval ''xprotocol="tcp"''
++ xprotocol=tcp
+ shift
+ ''['' 3 -gt 0 '']''
+ eval ''varval=$xports''
++ varval=22,53,3128,3185
+ eval ''xports="22,53,3128,3185"''
++ xports=22,53,3128,3185
+ shift
+ ''['' 2 -gt 0 '']''
+ eval ''varval=$xcports''
++ varval+ eval ''xcports=""''
++ xcports+ shift
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$xaddress''
++ varval+ eval ''xaddress=""''
++ xaddress+ shift
+ ''['' 0 -gt 0 '']''
+ ''['' xlan = xall '']''
+ ''['' xfw = xall '']''
+ process_rule ACCEPT lan fw tcp 22,53,3128,3185
+ local target=ACCEPT
+ local clients=lan
+ local servers=fw
+ local protocol=tcp
+ local ports=22,53,3128,3185
+ local cports+ local address++ echo ACCEPT lan fw tcp 22,53,3128,3185
+ local ''rule=ACCEPT lan fw tcp 22,53,3128,3185''
+ ''['' ACCEPT = ACCEPT '']''
+ loglevel+ logtarget=ACCEPT
+ dnat_only+ ''['' x = x- '']''
+ ''['' lan = lan '']''
+ clientzone=lan
+ clients+ ''['' lan = lan '']''
+ excludezones+ validate_zone lan
+ list_search lan wan lan fw
+ local e=lan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xlan = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xlan = xlan '']''
+ return 0
+ source=lan
+ ''['' lan = fw '']''
+ eval ''source_hosts="$lan_hosts"''
++ source_hosts=eth0:0.0.0.0/0 eth1:0.0.0.0/0
+ ''['' fw = fw '']''
+ serverzone=fw
+ servers+ serverport+ validate_zone fw
+ list_search fw wan lan fw
+ local e=fw
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xfw = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xfw = xlan '']''
+ ''['' 2 -gt 1 '']''
+ shift
+ ''['' xfw = xfw '']''
+ return 0
+ dest=fw
+ chain=lan2fw
+ eval ''policy=$lan2fw_policy''
++ policy+ ''['' = NONE '']''
/usr/share/shorewall/firewall: line 2174: [: =: unary operator expected
+ ''['' check = check '']''
+ ''['' xlan2fw = xfw2fw '']''
+ ''['' check = check '']''
++ list_count 22,53,3128,3185
+++ separate_list 22,53,3128,3185
+++ local list
+++ local part
+++ local newlist
+++ list=22,53,3128,3185
+++ part=22
+++ newlist=22
+++ ''['' x22 ''!='' x22,53,3128,3185
'']''
+++ list=53,3128,3185
+++ part=53
+++ newlist=22 53
+++ ''['' x53 ''!='' x53,3128,3185
'']''
+++ list=3128,3185
+++ part=3128
+++ newlist=22 53 3128
+++ ''['' x3128 ''!='' x3128,3185
'']''
+++ list=3185
+++ part=3185
+++ newlist=22 53 3128 3185
+++ ''['' x3185 ''!='' x3185
'']''
+++ echo ''22 53 3128 3185''
++ arg_count 22 53 3128 3185
++ echo 4
++ list_count
+++ separate_list
+++ local list
+++ local part
+++ local newlist
+++ list+++ part+++ newlist+++ ''['' x ''!='' x
'']''
+++ echo ''''
++ arg_count
++ echo 0
+ ''['' -n Yes -a 22,53,3128,3185 = 22,53,3128,3185 -a
'''' = '''' -a 4 -le 15 -a 0 -le 15
'']''
+ multioption=-m multiport
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
+ port=22,53,3128,3185
+ cport=-
+ add_a_rule
+ cli+ ''['' -n - '']''
+ dest_interface+ serv+ ''['' -n - '']''
+ sports+ dports+ state=-m state --state NEW
+ proto=tcp
+ addr+ servport+ multiport+ ''['' -n 22,53,3128,3185 -a
x22,53,3128,3185 ''!='' x- '']''
+ dports=--dport
+ ''['' -n ''-m multiport'' -a 22,53,3128,3185
''!='' 22,53,3128 '']''
+ multiport=-m multiport
+ dports=--dports
+ dports=--dports 22,53,3128,3185
+ ''['' -n - -a x- ''!='' x-
'']''
+ proto=-p tcp
+ ''['' -z ''-p tcp'' -a -z ''''
-a -z '''' -a -z '''' '']''
+ ''['' -n '''' '']''
+ ''['' -n '''' '']''
+ ''['' check ''!='' check '']''
+ ''['' check = check '']''
+ echo ''   Rule "ACCEPT lan fw tcp 22,53,3128,3185"
checked.''
+ read xtarget xclients xservers xprotocol xports xcports xaddress
+ expandv xclients xservers xprotocol xports xcports xaddress
+ local varval
+ ''['' 6 -gt 0 '']''
+ eval ''varval=$xclients''
++ varval=lan
+ eval ''xclients="lan"''
++ xclients=lan
+ shift
+ ''['' 5 -gt 0 '']''
+ eval ''varval=$xservers''
++ varval=fw
+ eval ''xservers="fw"''
++ xservers=fw
+ shift
+ ''['' 4 -gt 0 '']''
+ eval ''varval=$xprotocol''
++ varval=udp
+ eval ''xprotocol="udp"''
++ xprotocol=udp
+ shift
+ ''['' 3 -gt 0 '']''
+ eval ''varval=$xports''
++ varval=53
+ eval ''xports="53"''
++ xports=53
+ shift
+ ''['' 2 -gt 0 '']''
+ eval ''varval=$xcports''
++ varval+ eval ''xcports=""''
++ xcports+ shift
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$xaddress''
++ varval+ eval ''xaddress=""''
++ xaddress+ shift
+ ''['' 0 -gt 0 '']''
+ ''['' xlan = xall '']''
+ ''['' xfw = xall '']''
+ process_rule ACCEPT lan fw udp 53
+ local target=ACCEPT
+ local clients=lan
+ local servers=fw
+ local protocol=udp
+ local ports=53
+ local cports+ local address++ echo ACCEPT lan fw udp 53
+ local ''rule=ACCEPT lan fw udp 53''
+ ''['' ACCEPT = ACCEPT '']''
+ loglevel+ logtarget=ACCEPT
+ dnat_only+ ''['' x = x- '']''
+ ''['' lan = lan '']''
+ clientzone=lan
+ clients+ ''['' lan = lan '']''
+ excludezones+ validate_zone lan
+ list_search lan wan lan fw
+ local e=lan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xlan = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xlan = xlan '']''
+ return 0
+ source=lan
+ ''['' lan = fw '']''
+ eval ''source_hosts="$lan_hosts"''
++ source_hosts=eth0:0.0.0.0/0 eth1:0.0.0.0/0
+ ''['' fw = fw '']''
+ serverzone=fw
+ servers+ serverport+ validate_zone fw
+ list_search fw wan lan fw
+ local e=fw
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xfw = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xfw = xlan '']''
+ ''['' 2 -gt 1 '']''
+ shift
+ ''['' xfw = xfw '']''
+ return 0
+ dest=fw
+ chain=lan2fw
+ eval ''policy=$lan2fw_policy''
++ policy+ ''['' = NONE '']''
/usr/share/shorewall/firewall: line 2174: [: =: unary operator expected
+ ''['' check = check '']''
+ ''['' xlan2fw = xfw2fw '']''
+ ''['' check = check '']''
++ list_count 53
+++ separate_list 53
+++ local list
+++ local part
+++ local newlist
+++ list=53
+++ part=53
+++ newlist=53
+++ ''['' x53 ''!='' x53 '']''
+++ echo 53
++ arg_count 53
++ echo 1
++ list_count
+++ separate_list
+++ local list
+++ local part
+++ local newlist
+++ list+++ part+++ newlist+++ ''['' x ''!='' x
'']''
+++ echo ''''
++ arg_count
++ echo 0
+ ''['' -n Yes -a 53 = 53 -a '''' =
'''' -a 1 -le 15 -a 0 -le 15 '']''
+ multioption=-m multiport
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
+ port=53
+ cport=-
+ add_a_rule
+ cli+ ''['' -n - '']''
+ dest_interface+ serv+ ''['' -n - '']''
+ sports+ dports+ state=-m state --state NEW
+ proto=udp
+ addr+ servport+ multiport+ ''['' -n 53 -a x53
''!='' x- '']''
+ dports=--dport
+ ''['' -n ''-m multiport'' -a 53
''!='' 53 '']''
+ dports=--dport 53
+ ''['' -n - -a x- ''!='' x-
'']''
+ proto=-p udp
+ ''['' -z ''-p udp'' -a -z ''''
-a -z '''' -a -z '''' '']''
+ ''['' -n '''' '']''
+ ''['' -n '''' '']''
+ ''['' check ''!='' check '']''
+ ''['' check = check '']''
+ echo ''   Rule "ACCEPT lan fw udp 53" checked.''
+ read xtarget xclients xservers xprotocol xports xcports xaddress
+ expandv xclients xservers xprotocol xports xcports xaddress
+ local varval
+ ''['' 6 -gt 0 '']''
+ eval ''varval=$xclients''
++ varval=lan
+ eval ''xclients="lan"''
++ xclients=lan
+ shift
+ ''['' 5 -gt 0 '']''
+ eval ''varval=$xservers''
++ varval=wan
+ eval ''xservers="wan"''
++ xservers=wan
+ shift
+ ''['' 4 -gt 0 '']''
+ eval ''varval=$xprotocol''
++ varval=tcp
+ eval ''xprotocol="tcp"''
++ xprotocol=tcp
+ shift
+ ''['' 3 -gt 0 '']''
+ eval ''varval=$xports''
++ varval=21,25,80,110,443
+ eval ''xports="21,25,80,110,443"''
++ xports=21,25,80,110,443
+ shift
+ ''['' 2 -gt 0 '']''
+ eval ''varval=$xcports''
++ varval+ eval ''xcports=""''
++ xcports+ shift
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$xaddress''
++ varval+ eval ''xaddress=""''
++ xaddress+ shift
+ ''['' 0 -gt 0 '']''
+ ''['' xlan = xall '']''
+ ''['' xwan = xall '']''
+ process_rule ACCEPT lan wan tcp 21,25,80,110,443
+ local target=ACCEPT
+ local clients=lan
+ local servers=wan
+ local protocol=tcp
+ local ports=21,25,80,110,443
+ local cports+ local address++ echo ACCEPT lan wan tcp 21,25,80,110,443
+ local ''rule=ACCEPT lan wan tcp 21,25,80,110,443''
+ ''['' ACCEPT = ACCEPT '']''
+ loglevel+ logtarget=ACCEPT
+ dnat_only+ ''['' x = x- '']''
+ ''['' lan = lan '']''
+ clientzone=lan
+ clients+ ''['' lan = lan '']''
+ excludezones+ validate_zone lan
+ list_search lan wan lan fw
+ local e=lan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xlan = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xlan = xlan '']''
+ return 0
+ source=lan
+ ''['' lan = fw '']''
+ eval ''source_hosts="$lan_hosts"''
++ source_hosts=eth0:0.0.0.0/0 eth1:0.0.0.0/0
+ ''['' wan = wan '']''
+ serverzone=wan
+ servers+ serverport+ validate_zone wan
+ list_search wan wan lan fw
+ local e=wan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xwan = xwan '']''
+ return 0
+ dest=wan
+ chain=lan2wan
+ eval ''policy=$lan2wan_policy''
++ policy+ ''['' = NONE '']''
/usr/share/shorewall/firewall: line 2174: [: =: unary operator expected
+ ''['' check = check '']''
+ ''['' xlan2wan = xfw2fw '']''
+ ''['' check = check '']''
++ list_count 21,25,80,110,443
+++ separate_list 21,25,80,110,443
+++ local list
+++ local part
+++ local newlist
+++ list=21,25,80,110,443
+++ part=21
+++ newlist=21
+++ ''['' x21 ''!='' x21,25,80,110,443
'']''
+++ list=25,80,110,443
+++ part=25
+++ newlist=21 25
+++ ''['' x25 ''!='' x25,80,110,443
'']''
+++ list=80,110,443
+++ part=80
+++ newlist=21 25 80
+++ ''['' x80 ''!='' x80,110,443
'']''
+++ list=110,443
+++ part=110
+++ newlist=21 25 80 110
+++ ''['' x110 ''!='' x110,443
'']''
+++ list=443
+++ part=443
+++ newlist=21 25 80 110 443
+++ ''['' x443 ''!='' x443 '']''
+++ echo ''21 25 80 110 443''
++ arg_count 21 25 80 110 443
++ echo 5
++ list_count
+++ separate_list
+++ local list
+++ local part
+++ local newlist
+++ list+++ part+++ newlist+++ ''['' x ''!='' x
'']''
+++ echo ''''
++ arg_count
++ echo 0
+ ''['' -n Yes -a 21,25,80,110,443 = 21,25,80,110,443 -a
'''' = '''' -a 5 -le 15 -a 0 -le 15
'']''
+ multioption=-m multiport
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
+ port=21,25,80,110,443
+ cport=-
+ add_a_rule
+ cli+ ''['' -n - '']''
+ dest_interface+ serv+ ''['' -n - '']''
+ sports+ dports+ state=-m state --state NEW
+ proto=tcp
+ addr+ servport+ multiport+ ''['' -n 21,25,80,110,443 -a
x21,25,80,110,443 ''!='' x- '']''
+ dports=--dport
+ ''['' -n ''-m multiport'' -a 21,25,80,110,443
''!='' 21,25,80,110 '']''
+ multiport=-m multiport
+ dports=--dports
+ dports=--dports 21,25,80,110,443
+ ''['' -n - -a x- ''!='' x-
'']''
+ proto=-p tcp
+ ''['' -z ''-p tcp'' -a -z ''''
-a -z '''' -a -z '''' '']''
+ ''['' -n '''' '']''
+ ''['' -n '''' '']''
+ ''['' check ''!='' check '']''
+ ''['' check = check '']''
+ echo ''   Rule "ACCEPT lan wan tcp 21,25,80,110,443"
checked.''
+ read xtarget xclients xservers xprotocol xports xcports xaddress
+ expandv xclients xservers xprotocol xports xcports xaddress
+ local varval
+ ''['' 6 -gt 0 '']''
+ eval ''varval=$xclients''
++ varval=lan
+ eval ''xclients="lan"''
++ xclients=lan
+ shift
+ ''['' 5 -gt 0 '']''
+ eval ''varval=$xservers''
++ varval=wan
+ eval ''xservers="wan"''
++ xservers=wan
+ shift
+ ''['' 4 -gt 0 '']''
+ eval ''varval=$xprotocol''
++ varval=icmp
+ eval ''xprotocol="icmp"''
++ xprotocol=icmp
+ shift
+ ''['' 3 -gt 0 '']''
+ eval ''varval=$xports''
++ varval=13
+ eval ''xports="13"''
++ xports=13
+ shift
+ ''['' 2 -gt 0 '']''
+ eval ''varval=$xcports''
++ varval+ eval ''xcports=""''
++ xcports+ shift
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$xaddress''
++ varval+ eval ''xaddress=""''
++ xaddress+ shift
+ ''['' 0 -gt 0 '']''
+ ''['' xlan = xall '']''
+ ''['' xwan = xall '']''
+ process_rule ACCEPT lan wan icmp 13
+ local target=ACCEPT
+ local clients=lan
+ local servers=wan
+ local protocol=icmp
+ local ports=13
+ local cports+ local address++ echo ACCEPT lan wan icmp 13
+ local ''rule=ACCEPT lan wan icmp 13''
+ ''['' ACCEPT = ACCEPT '']''
+ loglevel+ logtarget=ACCEPT
+ dnat_only+ ''['' x = x- '']''
+ ''['' lan = lan '']''
+ clientzone=lan
+ clients+ ''['' lan = lan '']''
+ excludezones+ validate_zone lan
+ list_search lan wan lan fw
+ local e=lan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xlan = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xlan = xlan '']''
+ return 0
+ source=lan
+ ''['' lan = fw '']''
+ eval ''source_hosts="$lan_hosts"''
++ source_hosts=eth0:0.0.0.0/0 eth1:0.0.0.0/0
+ ''['' wan = wan '']''
+ serverzone=wan
+ servers+ serverport+ validate_zone wan
+ list_search wan wan lan fw
+ local e=wan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xwan = xwan '']''
+ return 0
+ dest=wan
+ chain=lan2wan
+ eval ''policy=$lan2wan_policy''
++ policy+ ''['' = NONE '']''
/usr/share/shorewall/firewall: line 2174: [: =: unary operator expected
+ ''['' check = check '']''
+ ''['' xlan2wan = xfw2fw '']''
+ ''['' check = check '']''
++ list_count 13
+++ separate_list 13
+++ local list
+++ local part
+++ local newlist
+++ list=13
+++ part=13
+++ newlist=13
+++ ''['' x13 ''!='' x13 '']''
+++ echo 13
++ arg_count 13
++ echo 1
++ list_count
+++ separate_list
+++ local list
+++ local part
+++ local newlist
+++ list+++ part+++ newlist+++ ''['' x ''!='' x
'']''
+++ echo ''''
++ arg_count
++ echo 0
+ ''['' -n Yes -a 13 = 13 -a '''' =
'''' -a 1 -le 15 -a 0 -le 15 '']''
+ multioption=-m multiport
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
+ port=13
+ cport=-
+ add_a_rule
+ cli+ ''['' -n - '']''
+ dest_interface+ serv+ ''['' -n - '']''
+ sports+ dports+ state=-m state --state NEW
+ proto=icmp
+ addr+ servport+ multiport+ ''['' -n 13 '']''
+ ''['' x13 ''!='' x- '']''
+ dports=--icmp-type 13
+ state+ proto=-p icmp
+ ''['' -z ''-p icmp'' -a -z
'''' -a -z '''' -a -z ''''
'']''
+ ''['' -n '''' '']''
+ ''['' -n '''' '']''
+ ''['' check ''!='' check '']''
+ ''['' check = check '']''
+ echo ''   Rule "ACCEPT lan wan icmp 13" checked.''
+ read xtarget xclients xservers xprotocol xports xcports xaddress
+ expandv xclients xservers xprotocol xports xcports xaddress
+ local varval
+ ''['' 6 -gt 0 '']''
+ eval ''varval=$xclients''
++ varval=fw
+ eval ''xclients="fw"''
++ xclients=fw
+ shift
+ ''['' 5 -gt 0 '']''
+ eval ''varval=$xservers''
++ varval=all
+ eval ''xservers="all"''
++ xservers=all
+ shift
+ ''['' 4 -gt 0 '']''
+ eval ''varval=$xprotocol''
++ varval=icmp
+ eval ''xprotocol="icmp"''
++ xprotocol=icmp
+ shift
+ ''['' 3 -gt 0 '']''
+ eval ''varval=$xports''
++ varval=8
+ eval ''xports="8"''
++ xports=8
+ shift
+ ''['' 2 -gt 0 '']''
+ eval ''varval=$xcports''
++ varval+ eval ''xcports=""''
++ xcports+ shift
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$xaddress''
++ varval+ eval ''xaddress=""''
++ xaddress+ shift
+ ''['' 0 -gt 0 '']''
+ ''['' xfw = xall '']''
+ ''['' xall = xall '']''
+ xservers=wan lan fw
+ process_wildcard_rule
+ ''['' fw ''!='' wan '']''
+ process_rule DROP:warn fw wan icmp 8
+ local target=DROP:warn
+ local clients=fw
+ local servers=wan
+ local protocol=icmp
+ local ports=8
+ local cports+ local address++ echo DROP:warn fw wan icmp 8
+ local ''rule=DROP:warn fw wan icmp 8''
+ ''['' DROP:warn = DROP '']''
+ loglevel=warn
+ target=DROP
+ expandv loglevel
+ local varval
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$loglevel''
++ varval=warn
+ eval ''loglevel="warn"''
++ loglevel=warn
+ shift
+ ''['' 0 -gt 0 '']''
+ logtarget=DROP
+ dnat_only+ ''['' x = x- '']''
+ ''['' fw = fw '']''
+ clientzone=fw
+ clients+ ''['' fw = fw '']''
+ excludezones+ validate_zone fw
+ list_search fw wan lan fw
+ local e=fw
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xfw = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xfw = xlan '']''
+ ''['' 2 -gt 1 '']''
+ shift
+ ''['' xfw = xfw '']''
+ return 0
+ source=fw
+ ''['' fw = fw '']''
+ source_hosts+ ''['' wan = wan '']''
+ serverzone=wan
+ servers+ serverport+ validate_zone wan
+ list_search wan wan lan fw
+ local e=wan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xwan = xwan '']''
+ return 0
+ dest=wan
+ chain=fw2wan
+ eval ''policy=$fw2wan_policy''
++ policy+ ''['' = NONE '']''
/usr/share/shorewall/firewall: line 2174: [: =: unary operator expected
+ ''['' check = check '']''
+ ''['' xfw2wan = xfw2fw '']''
+ ''['' check = check '']''
++ list_count 8
+++ separate_list 8
+++ local list
+++ local part
+++ local newlist
+++ list=8
+++ part=8
+++ newlist=8
+++ ''['' x8 ''!='' x8 '']''
+++ echo 8
++ arg_count 8
++ echo 1
++ list_count
+++ separate_list
+++ local list
+++ local part
+++ local newlist
+++ list+++ part+++ newlist+++ ''['' x ''!='' x
'']''
+++ echo ''''
++ arg_count
++ echo 0
+ ''['' -n Yes -a 8 = 8 -a '''' =
'''' -a 1 -le 15 -a 0 -le 15 '']''
+ multioption=-m multiport
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
+ port=8
+ cport=-
+ add_a_rule
+ cli+ ''['' -n - '']''
+ dest_interface+ serv+ ''['' -n - '']''
+ sports+ dports+ state=-m state --state NEW
+ proto=icmp
+ addr+ servport+ multiport+ ''['' -n 8 '']''
+ ''['' x8 ''!='' x- '']''
+ dports=--icmp-type 8
+ state+ proto=-p icmp
+ ''['' -z ''-p icmp'' -a -z
'''' -a -z '''' -a -z ''''
'']''
+ ''['' -n '''' '']''
+ ''['' -n '''' '']''
+ ''['' check ''!='' check '']''
+ ''['' check = check '']''
+ echo ''   Rule "DROP:warn fw wan icmp 8" checked.''
+ ''['' fw ''!='' lan '']''
+ process_rule DROP:warn fw lan icmp 8
+ local target=DROP:warn
+ local clients=fw
+ local servers=lan
+ local protocol=icmp
+ local ports=8
+ local cports+ local address++ echo DROP:warn fw lan icmp 8
+ local ''rule=DROP:warn fw lan icmp 8''
+ ''['' DROP:warn = DROP '']''
+ loglevel=warn
+ target=DROP
+ expandv loglevel
+ local varval
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$loglevel''
++ varval=warn
+ eval ''loglevel="warn"''
++ loglevel=warn
+ shift
+ ''['' 0 -gt 0 '']''
+ logtarget=DROP
+ dnat_only+ ''['' x = x- '']''
+ ''['' fw = fw '']''
+ clientzone=fw
+ clients+ ''['' fw = fw '']''
+ excludezones+ validate_zone fw
+ list_search fw wan lan fw
+ local e=fw
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xfw = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xfw = xlan '']''
+ ''['' 2 -gt 1 '']''
+ shift
+ ''['' xfw = xfw '']''
+ return 0
+ source=fw
+ ''['' fw = fw '']''
+ source_hosts+ ''['' lan = lan '']''
+ serverzone=lan
+ servers+ serverport+ validate_zone lan
+ list_search lan wan lan fw
+ local e=lan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xlan = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xlan = xlan '']''
+ return 0
+ dest=lan
+ chain=fw2lan
+ eval ''policy=$fw2lan_policy''
++ policy+ ''['' = NONE '']''
/usr/share/shorewall/firewall: line 2174: [: =: unary operator expected
+ ''['' check = check '']''
+ ''['' xfw2lan = xfw2fw '']''
+ ''['' check = check '']''
++ list_count 8
+++ separate_list 8
+++ local list
+++ local part
+++ local newlist
+++ list=8
+++ part=8
+++ newlist=8
+++ ''['' x8 ''!='' x8 '']''
+++ echo 8
++ arg_count 8
++ echo 1
++ list_count
+++ separate_list
+++ local list
+++ local part
+++ local newlist
+++ list+++ part+++ newlist+++ ''['' x ''!='' x
'']''
+++ echo ''''
++ arg_count
++ echo 0
+ ''['' -n Yes -a 8 = 8 -a '''' =
'''' -a 1 -le 15 -a 0 -le 15 '']''
+ multioption=-m multiport
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
+ port=8
+ cport=-
+ add_a_rule
+ cli+ ''['' -n - '']''
+ dest_interface+ serv+ ''['' -n - '']''
+ sports+ dports+ state=-m state --state NEW
+ proto=icmp
+ addr+ servport+ multiport+ ''['' -n 8 '']''
+ ''['' x8 ''!='' x- '']''
+ dports=--icmp-type 8
+ state+ proto=-p icmp
+ ''['' -z ''-p icmp'' -a -z
'''' -a -z '''' -a -z ''''
'']''
+ ''['' -n '''' '']''
+ ''['' -n '''' '']''
+ ''['' check ''!='' check '']''
+ ''['' check = check '']''
+ echo ''   Rule "DROP:warn fw lan icmp 8" checked.''
+ ''['' fw ''!='' fw '']''
+ continue
+ read xtarget xclients xservers xprotocol xports xcports xaddress
+ expandv xclients xservers xprotocol xports xcports xaddress
+ local varval
+ ''['' 6 -gt 0 '']''
+ eval ''varval=$xclients''
++ varval=all
+ eval ''xclients="all"''
++ xclients=all
+ shift
+ ''['' 5 -gt 0 '']''
+ eval ''varval=$xservers''
++ varval=all
+ eval ''xservers="all"''
++ xservers=all
+ shift
+ ''['' 4 -gt 0 '']''
+ eval ''varval=$xprotocol''
++ varval=icmp
+ eval ''xprotocol="icmp"''
++ xprotocol=icmp
+ shift
+ ''['' 3 -gt 0 '']''
+ eval ''varval=$xports''
++ varval+ eval ''xports=""''
++ xports+ shift
+ ''['' 2 -gt 0 '']''
+ eval ''varval=$xcports''
++ varval+ eval ''xcports=""''
++ xcports+ shift
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$xaddress''
++ varval+ eval ''xaddress=""''
++ xaddress+ shift
+ ''['' 0 -gt 0 '']''
+ ''['' xall = xall '']''
+ xclients=wan lan fw
+ ''['' xall = xall '']''
+ xservers=wan lan fw
+ process_wildcard_rule
+ ''['' wan ''!='' wan '']''
+ ''['' wan ''!='' lan '']''
+ process_rule LOG:warn wan lan icmp
+ local target=LOG:warn
+ local clients=wan
+ local servers=lan
+ local protocol=icmp
+ local ports+ local cports+ local address++ echo LOG:warn wan lan icmp
+ local ''rule=LOG:warn wan lan icmp''
+ ''['' LOG:warn = LOG '']''
+ loglevel=warn
+ target=LOG
+ expandv loglevel
+ local varval
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$loglevel''
++ varval=warn
+ eval ''loglevel="warn"''
++ loglevel=warn
+ shift
+ ''['' 0 -gt 0 '']''
+ logtarget=LOG
+ dnat_only+ ''['' x = x- '']''
+ ''['' wan = wan '']''
+ clientzone=wan
+ clients+ ''['' wan = wan '']''
+ excludezones+ validate_zone wan
+ list_search wan wan lan fw
+ local e=wan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xwan = xwan '']''
+ return 0
+ source=wan
+ ''['' wan = fw '']''
+ eval ''source_hosts="$wan_hosts"''
++ source_hosts=ppp+:0.0.0.0/0
+ ''['' lan = lan '']''
+ serverzone=lan
+ servers+ serverport+ validate_zone lan
+ list_search lan wan lan fw
+ local e=lan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xlan = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xlan = xlan '']''
+ return 0
+ dest=lan
+ chain=wan2lan
+ eval ''policy=$wan2lan_policy''
++ policy+ ''['' = NONE '']''
/usr/share/shorewall/firewall: line 2174: [: =: unary operator expected
+ ''['' check = check '']''
+ ''['' xwan2lan = xfw2fw '']''
+ ''['' check = check '']''
++ list_count
+++ separate_list
+++ local list
+++ local part
+++ local newlist
+++ list+++ part+++ newlist+++ ''['' x ''!='' x
'']''
+++ echo ''''
++ arg_count
++ echo 0
++ list_count
+++ separate_list
+++ local list
+++ local part
+++ local newlist
+++ list+++ part+++ newlist+++ ''['' x ''!='' x
'']''
+++ echo ''''
++ arg_count
++ echo 0
+ ''['' -n Yes -a '''' = '''' -a
'''' = '''' -a 0 -le 15 -a 0 -le 15
'']''
+ multioption=-m multiport
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
+ port=-
+ cport=-
+ add_a_rule
+ cli+ ''['' -n - '']''
+ dest_interface+ serv+ ''['' -n - '']''
+ sports+ dports+ state=-m state --state NEW
+ proto=icmp
+ addr+ servport+ multiport+ ''['' -n - '']''
+ ''['' x- ''!='' x- '']''
+ state+ proto=-p icmp
+ ''['' -z warn '']''
+ ''['' -z ''-p icmp'' -a -z
'''' -a -z '''' -a -z ''''
'']''
+ ''['' -n '''' '']''
+ ''['' -n '''' '']''
+ ''['' check ''!='' check '']''
+ ''['' check = check '']''
+ echo ''   Rule "LOG:warn wan lan icmp" checked.''
+ ''['' wan ''!='' fw '']''
+ process_rule LOG:warn wan fw icmp
+ local target=LOG:warn
+ local clients=wan
+ local servers=fw
+ local protocol=icmp
+ local ports+ local cports+ local address++ echo LOG:warn wan fw icmp
+ local ''rule=LOG:warn wan fw icmp''
+ ''['' LOG:warn = LOG '']''
+ loglevel=warn
+ target=LOG
+ expandv loglevel
+ local varval
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$loglevel''
++ varval=warn
+ eval ''loglevel="warn"''
++ loglevel=warn
+ shift
+ ''['' 0 -gt 0 '']''
+ logtarget=LOG
+ dnat_only+ ''['' x = x- '']''
+ ''['' wan = wan '']''
+ clientzone=wan
+ clients+ ''['' wan = wan '']''
+ excludezones+ validate_zone wan
+ list_search wan wan lan fw
+ local e=wan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xwan = xwan '']''
+ return 0
+ source=wan
+ ''['' wan = fw '']''
+ eval ''source_hosts="$wan_hosts"''
++ source_hosts=ppp+:0.0.0.0/0
+ ''['' fw = fw '']''
+ serverzone=fw
+ servers+ serverport+ validate_zone fw
+ list_search fw wan lan fw
+ local e=fw
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xfw = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xfw = xlan '']''
+ ''['' 2 -gt 1 '']''
+ shift
+ ''['' xfw = xfw '']''
+ return 0
+ dest=fw
+ chain=wan2fw
+ eval ''policy=$wan2fw_policy''
++ policy+ ''['' = NONE '']''
/usr/share/shorewall/firewall: line 2174: [: =: unary operator expected
+ ''['' check = check '']''
+ ''['' xwan2fw = xfw2fw '']''
+ ''['' check = check '']''
++ list_count
+++ separate_list
+++ local list
+++ local part
+++ local newlist
+++ list+++ part+++ newlist+++ ''['' x ''!='' x
'']''
+++ echo ''''
++ arg_count
++ echo 0
++ list_count
+++ separate_list
+++ local list
+++ local part
+++ local newlist
+++ list+++ part+++ newlist+++ ''['' x ''!='' x
'']''
+++ echo ''''
++ arg_count
++ echo 0
+ ''['' -n Yes -a '''' = '''' -a
'''' = '''' -a 0 -le 15 -a 0 -le 15
'']''
+ multioption=-m multiport
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
+ port=-
+ cport=-
+ add_a_rule
+ cli+ ''['' -n - '']''
+ dest_interface+ serv+ ''['' -n - '']''
+ sports+ dports+ state=-m state --state NEW
+ proto=icmp
+ addr+ servport+ multiport+ ''['' -n - '']''
+ ''['' x- ''!='' x- '']''
+ state+ proto=-p icmp
+ ''['' -z warn '']''
+ ''['' -z ''-p icmp'' -a -z
'''' -a -z '''' -a -z ''''
'']''
+ ''['' -n '''' '']''
+ ''['' -n '''' '']''
+ ''['' check ''!='' check '']''
+ ''['' check = check '']''
+ echo ''   Rule "LOG:warn wan fw icmp" checked.''
+ ''['' lan ''!='' wan '']''
+ process_rule LOG:warn lan wan icmp
+ local target=LOG:warn
+ local clients=lan
+ local servers=wan
+ local protocol=icmp
+ local ports+ local cports+ local address++ echo LOG:warn lan wan icmp
+ local ''rule=LOG:warn lan wan icmp''
+ ''['' LOG:warn = LOG '']''
+ loglevel=warn
+ target=LOG
+ expandv loglevel
+ local varval
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$loglevel''
++ varval=warn
+ eval ''loglevel="warn"''
++ loglevel=warn
+ shift
+ ''['' 0 -gt 0 '']''
+ logtarget=LOG
+ dnat_only+ ''['' x = x- '']''
+ ''['' lan = lan '']''
+ clientzone=lan
+ clients+ ''['' lan = lan '']''
+ excludezones+ validate_zone lan
+ list_search lan wan lan fw
+ local e=lan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xlan = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xlan = xlan '']''
+ return 0
+ source=lan
+ ''['' lan = fw '']''
+ eval ''source_hosts="$lan_hosts"''
++ source_hosts=eth0:0.0.0.0/0 eth1:0.0.0.0/0
+ ''['' wan = wan '']''
+ serverzone=wan
+ servers+ serverport+ validate_zone wan
+ list_search wan wan lan fw
+ local e=wan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xwan = xwan '']''
+ return 0
+ dest=wan
+ chain=lan2wan
+ eval ''policy=$lan2wan_policy''
++ policy+ ''['' = NONE '']''
/usr/share/shorewall/firewall: line 2174: [: =: unary operator expected
+ ''['' check = check '']''
+ ''['' xlan2wan = xfw2fw '']''
+ ''['' check = check '']''
++ list_count
+++ separate_list
+++ local list
+++ local part
+++ local newlist
+++ list+++ part+++ newlist+++ ''['' x ''!='' x
'']''
+++ echo ''''
++ arg_count
++ echo 0
++ list_count
+++ separate_list
+++ local list
+++ local part
+++ local newlist
+++ list+++ part+++ newlist+++ ''['' x ''!='' x
'']''
+++ echo ''''
++ arg_count
++ echo 0
+ ''['' -n Yes -a '''' = '''' -a
'''' = '''' -a 0 -le 15 -a 0 -le 15
'']''
+ multioption=-m multiport
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
+ port=-
+ cport=-
+ add_a_rule
+ cli+ ''['' -n - '']''
+ dest_interface+ serv+ ''['' -n - '']''
+ sports+ dports+ state=-m state --state NEW
+ proto=icmp
+ addr+ servport+ multiport+ ''['' -n - '']''
+ ''['' x- ''!='' x- '']''
+ state+ proto=-p icmp
+ ''['' -z warn '']''
+ ''['' -z ''-p icmp'' -a -z
'''' -a -z '''' -a -z ''''
'']''
+ ''['' -n '''' '']''
+ ''['' -n '''' '']''
+ ''['' check ''!='' check '']''
+ ''['' check = check '']''
+ echo ''   Rule "LOG:warn lan wan icmp" checked.''
+ ''['' lan ''!='' lan '']''
+ ''['' lan ''!='' fw '']''
+ process_rule LOG:warn lan fw icmp
+ local target=LOG:warn
+ local clients=lan
+ local servers=fw
+ local protocol=icmp
+ local ports+ local cports+ local address++ echo LOG:warn lan fw icmp
+ local ''rule=LOG:warn lan fw icmp''
+ ''['' LOG:warn = LOG '']''
+ loglevel=warn
+ target=LOG
+ expandv loglevel
+ local varval
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$loglevel''
++ varval=warn
+ eval ''loglevel="warn"''
++ loglevel=warn
+ shift
+ ''['' 0 -gt 0 '']''
+ logtarget=LOG
+ dnat_only+ ''['' x = x- '']''
+ ''['' lan = lan '']''
+ clientzone=lan
+ clients+ ''['' lan = lan '']''
+ excludezones+ validate_zone lan
+ list_search lan wan lan fw
+ local e=lan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xlan = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xlan = xlan '']''
+ return 0
+ source=lan
+ ''['' lan = fw '']''
+ eval ''source_hosts="$lan_hosts"''
++ source_hosts=eth0:0.0.0.0/0 eth1:0.0.0.0/0
+ ''['' fw = fw '']''
+ serverzone=fw
+ servers+ serverport+ validate_zone fw
+ list_search fw wan lan fw
+ local e=fw
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xfw = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xfw = xlan '']''
+ ''['' 2 -gt 1 '']''
+ shift
+ ''['' xfw = xfw '']''
+ return 0
+ dest=fw
+ chain=lan2fw
+ eval ''policy=$lan2fw_policy''
++ policy+ ''['' = NONE '']''
/usr/share/shorewall/firewall: line 2174: [: =: unary operator expected
+ ''['' check = check '']''
+ ''['' xlan2fw = xfw2fw '']''
+ ''['' check = check '']''
++ list_count
+++ separate_list
+++ local list
+++ local part
+++ local newlist
+++ list+++ part+++ newlist+++ ''['' x ''!='' x
'']''
+++ echo ''''
++ arg_count
++ echo 0
++ list_count
+++ separate_list
+++ local list
+++ local part
+++ local newlist
+++ list+++ part+++ newlist+++ ''['' x ''!='' x
'']''
+++ echo ''''
++ arg_count
++ echo 0
+ ''['' -n Yes -a '''' = '''' -a
'''' = '''' -a 0 -le 15 -a 0 -le 15
'']''
+ multioption=-m multiport
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
+ port=-
+ cport=-
+ add_a_rule
+ cli+ ''['' -n - '']''
+ dest_interface+ serv+ ''['' -n - '']''
+ sports+ dports+ state=-m state --state NEW
+ proto=icmp
+ addr+ servport+ multiport+ ''['' -n - '']''
+ ''['' x- ''!='' x- '']''
+ state+ proto=-p icmp
+ ''['' -z warn '']''
+ ''['' -z ''-p icmp'' -a -z
'''' -a -z '''' -a -z ''''
'']''
+ ''['' -n '''' '']''
+ ''['' -n '''' '']''
+ ''['' check ''!='' check '']''
+ ''['' check = check '']''
+ echo ''   Rule "LOG:warn lan fw icmp" checked.''
+ ''['' fw ''!='' wan '']''
+ process_rule LOG:warn fw wan icmp
+ local target=LOG:warn
+ local clients=fw
+ local servers=wan
+ local protocol=icmp
+ local ports+ local cports+ local address++ echo LOG:warn fw wan icmp
+ local ''rule=LOG:warn fw wan icmp''
+ ''['' LOG:warn = LOG '']''
+ loglevel=warn
+ target=LOG
+ expandv loglevel
+ local varval
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$loglevel''
++ varval=warn
+ eval ''loglevel="warn"''
++ loglevel=warn
+ shift
+ ''['' 0 -gt 0 '']''
+ logtarget=LOG
+ dnat_only+ ''['' x = x- '']''
+ ''['' fw = fw '']''
+ clientzone=fw
+ clients+ ''['' fw = fw '']''
+ excludezones+ validate_zone fw
+ list_search fw wan lan fw
+ local e=fw
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xfw = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xfw = xlan '']''
+ ''['' 2 -gt 1 '']''
+ shift
+ ''['' xfw = xfw '']''
+ return 0
+ source=fw
+ ''['' fw = fw '']''
+ source_hosts+ ''['' wan = wan '']''
+ serverzone=wan
+ servers+ serverport+ validate_zone wan
+ list_search wan wan lan fw
+ local e=wan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xwan = xwan '']''
+ return 0
+ dest=wan
+ chain=fw2wan
+ eval ''policy=$fw2wan_policy''
++ policy+ ''['' = NONE '']''
/usr/share/shorewall/firewall: line 2174: [: =: unary operator expected
+ ''['' check = check '']''
+ ''['' xfw2wan = xfw2fw '']''
+ ''['' check = check '']''
++ list_count
+++ separate_list
+++ local list
+++ local part
+++ local newlist
+++ list+++ part+++ newlist+++ ''['' x ''!='' x
'']''
+++ echo ''''
++ arg_count
++ echo 0
++ list_count
+++ separate_list
+++ local list
+++ local part
+++ local newlist
+++ list+++ part+++ newlist+++ ''['' x ''!='' x
'']''
+++ echo ''''
++ arg_count
++ echo 0
+ ''['' -n Yes -a '''' = '''' -a
'''' = '''' -a 0 -le 15 -a 0 -le 15
'']''
+ multioption=-m multiport
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
+ port=-
+ cport=-
+ add_a_rule
+ cli+ ''['' -n - '']''
+ dest_interface+ serv+ ''['' -n - '']''
+ sports+ dports+ state=-m state --state NEW
+ proto=icmp
+ addr+ servport+ multiport+ ''['' -n - '']''
+ ''['' x- ''!='' x- '']''
+ state+ proto=-p icmp
+ ''['' -z warn '']''
+ ''['' -z ''-p icmp'' -a -z
'''' -a -z '''' -a -z ''''
'']''
+ ''['' -n '''' '']''
+ ''['' -n '''' '']''
+ ''['' check ''!='' check '']''
+ ''['' check = check '']''
+ echo ''   Rule "LOG:warn fw wan icmp" checked.''
+ ''['' fw ''!='' lan '']''
+ process_rule LOG:warn fw lan icmp
+ local target=LOG:warn
+ local clients=fw
+ local servers=lan
+ local protocol=icmp
+ local ports+ local cports+ local address++ echo LOG:warn fw lan icmp
+ local ''rule=LOG:warn fw lan icmp''
+ ''['' LOG:warn = LOG '']''
+ loglevel=warn
+ target=LOG
+ expandv loglevel
+ local varval
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$loglevel''
++ varval=warn
+ eval ''loglevel="warn"''
++ loglevel=warn
+ shift
+ ''['' 0 -gt 0 '']''
+ logtarget=LOG
+ dnat_only+ ''['' x = x- '']''
+ ''['' fw = fw '']''
+ clientzone=fw
+ clients+ ''['' fw = fw '']''
+ excludezones+ validate_zone fw
+ list_search fw wan lan fw
+ local e=fw
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xfw = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xfw = xlan '']''
+ ''['' 2 -gt 1 '']''
+ shift
+ ''['' xfw = xfw '']''
+ return 0
+ source=fw
+ ''['' fw = fw '']''
+ source_hosts+ ''['' lan = lan '']''
+ serverzone=lan
+ servers+ serverport+ validate_zone lan
+ list_search lan wan lan fw
+ local e=lan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xlan = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xlan = xlan '']''
+ return 0
+ dest=lan
+ chain=fw2lan
+ eval ''policy=$fw2lan_policy''
++ policy+ ''['' = NONE '']''
/usr/share/shorewall/firewall: line 2174: [: =: unary operator expected
+ ''['' check = check '']''
+ ''['' xfw2lan = xfw2fw '']''
+ ''['' check = check '']''
++ list_count
+++ separate_list
+++ local list
+++ local part
+++ local newlist
+++ list+++ part+++ newlist+++ ''['' x ''!='' x
'']''
+++ echo ''''
++ arg_count
++ echo 0
++ list_count
+++ separate_list
+++ local list
+++ local part
+++ local newlist
+++ list+++ part+++ newlist+++ ''['' x ''!='' x
'']''
+++ echo ''''
++ arg_count
++ echo 0
+ ''['' -n Yes -a '''' = '''' -a
'''' = '''' -a 0 -le 15 -a 0 -le 15
'']''
+ multioption=-m multiport
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
+ port=-
+ cport=-
+ add_a_rule
+ cli+ ''['' -n - '']''
+ dest_interface+ serv+ ''['' -n - '']''
+ sports+ dports+ state=-m state --state NEW
+ proto=icmp
+ addr+ servport+ multiport+ ''['' -n - '']''
+ ''['' x- ''!='' x- '']''
+ state+ proto=-p icmp
+ ''['' -z warn '']''
+ ''['' -z ''-p icmp'' -a -z
'''' -a -z '''' -a -z ''''
'']''
+ ''['' -n '''' '']''
+ ''['' -n '''' '']''
+ ''['' check ''!='' check '']''
+ ''['' check = check '']''
+ echo ''   Rule "LOG:warn fw lan icmp" checked.''
+ ''['' fw ''!='' fw '']''
+ continue
+ read xtarget xclients xservers xprotocol xports xcports xaddress
+ expandv xclients xservers xprotocol xports xcports xaddress
+ local varval
+ ''['' 6 -gt 0 '']''
+ eval ''varval=$xclients''
++ varval=fw
+ eval ''xclients="fw"''
++ xclients=fw
+ shift
+ ''['' 5 -gt 0 '']''
+ eval ''varval=$xservers''
++ varval=lan
+ eval ''xservers="lan"''
++ xservers=lan
+ shift
+ ''['' 4 -gt 0 '']''
+ eval ''varval=$xprotocol''
++ varval=icmp
+ eval ''xprotocol="icmp"''
++ xprotocol=icmp
+ shift
+ ''['' 3 -gt 0 '']''
+ eval ''varval=$xports''
++ varval+ eval ''xports=""''
++ xports+ shift
+ ''['' 2 -gt 0 '']''
+ eval ''varval=$xcports''
++ varval+ eval ''xcports=""''
++ xcports+ shift
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$xaddress''
++ varval+ eval ''xaddress=""''
++ xaddress+ shift
+ ''['' 0 -gt 0 '']''
+ ''['' xfw = xall '']''
+ ''['' xlan = xall '']''
+ process_rule ACCEPT fw lan icmp
+ local target=ACCEPT
+ local clients=fw
+ local servers=lan
+ local protocol=icmp
+ local ports+ local cports+ local address++ echo ACCEPT fw lan icmp
+ local ''rule=ACCEPT fw lan icmp''
+ ''['' ACCEPT = ACCEPT '']''
+ loglevel+ logtarget=ACCEPT
+ dnat_only+ ''['' x = x- '']''
+ ''['' fw = fw '']''
+ clientzone=fw
+ clients+ ''['' fw = fw '']''
+ excludezones+ validate_zone fw
+ list_search fw wan lan fw
+ local e=fw
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xfw = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xfw = xlan '']''
+ ''['' 2 -gt 1 '']''
+ shift
+ ''['' xfw = xfw '']''
+ return 0
+ source=fw
+ ''['' fw = fw '']''
+ source_hosts+ ''['' lan = lan '']''
+ serverzone=lan
+ servers+ serverport+ validate_zone lan
+ list_search lan wan lan fw
+ local e=lan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xlan = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xlan = xlan '']''
+ return 0
+ dest=lan
+ chain=fw2lan
+ eval ''policy=$fw2lan_policy''
++ policy+ ''['' = NONE '']''
/usr/share/shorewall/firewall: line 2174: [: =: unary operator expected
+ ''['' check = check '']''
+ ''['' xfw2lan = xfw2fw '']''
+ ''['' check = check '']''
++ list_count
+++ separate_list
+++ local list
+++ local part
+++ local newlist
+++ list+++ part+++ newlist+++ ''['' x ''!='' x
'']''
+++ echo ''''
++ arg_count
++ echo 0
++ list_count
+++ separate_list
+++ local list
+++ local part
+++ local newlist
+++ list+++ part+++ newlist+++ ''['' x ''!='' x
'']''
+++ echo ''''
++ arg_count
++ echo 0
+ ''['' -n Yes -a '''' = '''' -a
'''' = '''' -a 0 -le 15 -a 0 -le 15
'']''
+ multioption=-m multiport
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
++ separate_list -
++ local list
++ local part
++ local newlist
++ list=-
++ part=-
++ newlist=-
++ ''['' x- ''!='' x- '']''
++ echo -
+ port=-
+ cport=-
+ add_a_rule
+ cli+ ''['' -n - '']''
+ dest_interface+ serv+ ''['' -n - '']''
+ sports+ dports+ state=-m state --state NEW
+ proto=icmp
+ addr+ servport+ multiport+ ''['' -n - '']''
+ ''['' x- ''!='' x- '']''
+ state+ proto=-p icmp
+ ''['' -z ''-p icmp'' -a -z
'''' -a -z '''' -a -z ''''
'']''
+ ''['' -n '''' '']''
+ ''['' -n '''' '']''
+ ''['' check ''!='' check '']''
+ ''['' check = check '']''
+ echo ''   Rule "ACCEPT fw lan icmp" checked.''
+ read xtarget xclients xservers xprotocol xports xcports xaddress
+ echo ''Validating policy file...''
+ validate_policy
+ local clientwild
+ local serverwild
+ local zone
+ local zone1
+ local pc
+ local chain
+ local policy
+ local loglevel
+ local synparams
+ all_policy_chains+ strip_file policy
+ local fname
+ ''['' 1 = 1 '']''
++ find_file policy
++ ''['' -n '''' -a -f /policy
'']''
++ echo /etc/shorewall/policy
+ fname=/etc/shorewall/policy
+ ''['' -f /etc/shorewall/policy '']''
+ cut -d# -f1 /etc/shorewall/policy
+ grep -v ''^[[:space:]]*$''
+ read client server policy loglevel synparams
+ expandv client server policy loglevel synparams
+ local varval
+ ''['' 5 -gt 0 '']''
+ eval ''varval=$client''
++ varval=lan
+ eval ''client="lan"''
++ client=lan
+ shift
+ ''['' 4 -gt 0 '']''
+ eval ''varval=$server''
++ varval=lan
+ eval ''server="lan"''
++ server=lan
+ shift
+ ''['' 3 -gt 0 '']''
+ eval ''varval=$policy''
++ varval=ACCEPT
+ eval ''policy="ACCEPT"''
++ policy=ACCEPT
+ shift
+ ''['' 2 -gt 0 '']''
+ eval ''varval=$loglevel''
++ varval+ eval ''loglevel=""''
++ loglevel+ shift
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$synparams''
++ varval+ eval ''synparams=""''
++ synparams+ shift
+ ''['' 0 -gt 0 '']''
+ clientwild+ serverwild+ validate_zone lan
+ list_search lan wan lan fw
+ local e=lan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xlan = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xlan = xlan '']''
+ return 0
+ validate_zone lan
+ list_search lan wan lan fw
+ local e=lan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xlan = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xlan = xlan '']''
+ return 0
+ chain=lan2lan
+ ''['' xlan2lan = xfw2fw '']''
+ is_policy_chain lan2lan
+ eval test ''"$lan2lan_is_policy"'' = Yes
++ test '''' = Yes
+ ''['' x = x- '']''
+ chain=lan2lan
+ ''['' ACCEPT = NONE '']''
+ all_policy_chains= lan2lan
+ eval lan2lan_is_policy=Yes
++ lan2lan_is_policy=Yes
+ eval lan2lan_policy=ACCEPT
++ lan2lan_policy=ACCEPT
+ eval lan2lan_loglevel++ lan2lan_loglevel+ eval lan2lan_synparams++
lan2lan_synparams+ ''['' -n ''''
'']''
+ ''['' -n '''' '']''
+ eval lan2lan_policychain=lan2lan
++ lan2lan_policychain=lan2lan
+ print_policy lan lan
+ ''['' check ''!='' check '']''
+ ''['' lan = lan '']''
+ read client server policy loglevel synparams
+ expandv client server policy loglevel synparams
+ local varval
+ ''['' 5 -gt 0 '']''
+ eval ''varval=$client''
++ varval=wan
+ eval ''client="wan"''
++ client=wan
+ shift
+ ''['' 4 -gt 0 '']''
+ eval ''varval=$server''
++ varval=fw
+ eval ''server="fw"''
++ server=fw
+ shift
+ ''['' 3 -gt 0 '']''
+ eval ''varval=$policy''
++ varval=DROP
+ eval ''policy="DROP"''
++ policy=DROP
+ shift
+ ''['' 2 -gt 0 '']''
+ eval ''varval=$loglevel''
++ varval=warn
+ eval ''loglevel="warn"''
++ loglevel=warn
+ shift
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$synparams''
++ varval+ eval ''synparams=""''
++ synparams+ shift
+ ''['' 0 -gt 0 '']''
+ clientwild+ serverwild+ validate_zone wan
+ list_search wan wan lan fw
+ local e=wan
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xwan = xwan '']''
+ return 0
+ validate_zone fw
+ list_search fw wan lan fw
+ local e=fw
+ ''['' 4 -gt 1 '']''
+ shift
+ ''['' xfw = xwan '']''
+ ''['' 3 -gt 1 '']''
+ shift
+ ''['' xfw = xlan '']''
+ ''['' 2 -gt 1 '']''
+ shift
+ ''['' xfw = xfw '']''
+ return 0
+ chain=wan2fw
+ ''['' xwan2fw = xfw2fw '']''
+ is_policy_chain wan2fw
+ eval test ''"$wan2fw_is_policy"'' = Yes
++ test '''' = Yes
+ ''['' xwarn = x- '']''
+ chain=wan2fw
+ ''['' DROP = NONE '']''
+ all_policy_chains= lan2lan wan2fw
+ eval wan2fw_is_policy=Yes
++ wan2fw_is_policy=Yes
+ eval wan2fw_policy=DROP
++ wan2fw_policy=DROP
+ eval wan2fw_loglevel=warn
++ wan2fw_loglevel=warn
+ eval wan2fw_synparams++ wan2fw_synparams+ ''['' -n
'''' '']''
+ ''['' -n '''' '']''
+ eval wan2fw_policychain=wan2fw
++ wan2fw_policychain=wan2fw
+ print_policy wan fw
+ ''['' check ''!='' check '']''
+ ''['' wan = fw '']''
+ ''['' wan = all '']''
+ ''['' fw = all '']''
+ echo ''   Policy for wan to fw is DROP''
+ read client server policy loglevel synparams
+ expandv client server policy loglevel synparams
+ local varval
+ ''['' 5 -gt 0 '']''
+ eval ''varval=$client''
++ varval=all
+ eval ''client="all"''
++ client=all
+ shift
+ ''['' 4 -gt 0 '']''
+ eval ''varval=$server''
++ varval=all
+ eval ''server="all"''
++ server=all
+ shift
+ ''['' 3 -gt 0 '']''
+ eval ''varval=$policy''
++ varval=DROP
+ eval ''policy="DROP"''
++ policy=DROP
+ shift
+ ''['' 2 -gt 0 '']''
+ eval ''varval=$loglevel''
++ varval=warn
+ eval ''loglevel="warn"''
++ loglevel=warn
+ shift
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$synparams''
++ varval+ eval ''synparams=""''
++ synparams+ shift
+ ''['' 0 -gt 0 '']''
+ clientwild+ serverwild+ clientwild=Yes
+ serverwild=Yes
+ chain=all2all
+ ''['' xall2all = xfw2fw '']''
+ is_policy_chain all2all
+ eval test ''"$all2all_is_policy"'' = Yes
++ test '''' = Yes
+ ''['' xwarn = x- '']''
+ chain=all2all
+ ''['' DROP = NONE '']''
+ all_policy_chains= lan2lan wan2fw all2all
+ eval all2all_is_policy=Yes
++ all2all_is_policy=Yes
+ eval all2all_policy=DROP
++ all2all_policy=DROP
+ eval all2all_loglevel=warn
++ all2all_loglevel=warn
+ eval all2all_synparams++ all2all_synparams+ ''['' -n Yes
'']''
+ ''['' -n Yes '']''
+ eval ''pc=$wan2wan_policychain''
++ pc+ ''['' -z '''' '']''
+ eval wan2wan_policychain=all2all
++ wan2wan_policychain=all2all
+ eval wan2wan_policy=DROP
++ wan2wan_policy=DROP
+ print_policy wan wan
+ ''['' check ''!='' check '']''
+ ''['' wan = wan '']''
+ eval ''pc=$wan2lan_policychain''
++ pc+ ''['' -z '''' '']''
+ eval wan2lan_policychain=all2all
++ wan2lan_policychain=all2all
+ eval wan2lan_policy=DROP
++ wan2lan_policy=DROP
+ print_policy wan lan
+ ''['' check ''!='' check '']''
+ ''['' wan = lan '']''
+ ''['' wan = all '']''
+ ''['' lan = all '']''
+ echo ''   Policy for wan to lan is DROP''
+ eval ''pc=$wan2fw_policychain''
++ pc=wan2fw
+ ''['' -z wan2fw '']''
+ eval ''pc=$wan2all_policychain''
++ pc+ ''['' -z '''' '']''
+ eval wan2all_policychain=all2all
++ wan2all_policychain=all2all
+ eval wan2all_policy=DROP
++ wan2all_policy=DROP
+ print_policy wan all
+ ''['' check ''!='' check '']''
+ ''['' wan = all '']''
+ ''['' wan = all '']''
+ ''['' all = all '']''
+ eval ''pc=$lan2wan_policychain''
++ pc+ ''['' -z '''' '']''
+ eval lan2wan_policychain=all2all
++ lan2wan_policychain=all2all
+ eval lan2wan_policy=DROP
++ lan2wan_policy=DROP
+ print_policy lan wan
+ ''['' check ''!='' check '']''
+ ''['' lan = wan '']''
+ ''['' lan = all '']''
+ ''['' wan = all '']''
+ echo ''   Policy for lan to wan is DROP''
+ eval ''pc=$lan2lan_policychain''
++ pc=lan2lan
+ ''['' -z lan2lan '']''
+ eval ''pc=$lan2fw_policychain''
++ pc+ ''['' -z '''' '']''
+ eval lan2fw_policychain=all2all
++ lan2fw_policychain=all2all
+ eval lan2fw_policy=DROP
++ lan2fw_policy=DROP
+ print_policy lan fw
+ ''['' check ''!='' check '']''
+ ''['' lan = fw '']''
+ ''['' lan = all '']''
+ ''['' fw = all '']''
+ echo ''   Policy for lan to fw is DROP''
+ eval ''pc=$lan2all_policychain''
++ pc+ ''['' -z '''' '']''
+ eval lan2all_policychain=all2all
++ lan2all_policychain=all2all
+ eval lan2all_policy=DROP
++ lan2all_policy=DROP
+ print_policy lan all
+ ''['' check ''!='' check '']''
+ ''['' lan = all '']''
+ ''['' lan = all '']''
+ ''['' all = all '']''
+ eval ''pc=$fw2wan_policychain''
++ pc+ ''['' -z '''' '']''
+ eval fw2wan_policychain=all2all
++ fw2wan_policychain=all2all
+ eval fw2wan_policy=DROP
++ fw2wan_policy=DROP
+ print_policy fw wan
+ ''['' check ''!='' check '']''
+ ''['' fw = wan '']''
+ ''['' fw = all '']''
+ ''['' wan = all '']''
+ echo ''   Policy for fw to wan is DROP''
+ eval ''pc=$fw2lan_policychain''
++ pc+ ''['' -z '''' '']''
+ eval fw2lan_policychain=all2all
++ fw2lan_policychain=all2all
+ eval fw2lan_policy=DROP
++ fw2lan_policy=DROP
+ print_policy fw lan
+ ''['' check ''!='' check '']''
+ ''['' fw = lan '']''
+ ''['' fw = all '']''
+ ''['' lan = all '']''
+ echo ''   Policy for fw to lan is DROP''
+ eval ''pc=$fw2fw_policychain''
++ pc+ ''['' -z '''' '']''
+ eval fw2fw_policychain=all2all
++ fw2fw_policychain=all2all
+ eval fw2fw_policy=DROP
++ fw2fw_policy=DROP
+ print_policy fw fw
+ ''['' check ''!='' check '']''
+ ''['' fw = fw '']''
+ eval ''pc=$fw2all_policychain''
++ pc+ ''['' -z '''' '']''
+ eval fw2all_policychain=all2all
++ fw2all_policychain=all2all
+ eval fw2all_policy=DROP
++ fw2all_policy=DROP
+ print_policy fw all
+ ''['' check ''!='' check '']''
+ ''['' fw = all '']''
+ ''['' fw = all '']''
+ ''['' all = all '']''
+ eval ''pc=$all2wan_policychain''
++ pc+ ''['' -z '''' '']''
+ eval all2wan_policychain=all2all
++ all2wan_policychain=all2all
+ eval all2wan_policy=DROP
++ all2wan_policy=DROP
+ print_policy all wan
+ ''['' check ''!='' check '']''
+ ''['' all = wan '']''
+ ''['' all = all '']''
+ eval ''pc=$all2lan_policychain''
++ pc+ ''['' -z '''' '']''
+ eval all2lan_policychain=all2all
++ all2lan_policychain=all2all
+ eval all2lan_policy=DROP
++ all2lan_policy=DROP
+ print_policy all lan
+ ''['' check ''!='' check '']''
+ ''['' all = lan '']''
+ ''['' all = all '']''
+ eval ''pc=$all2fw_policychain''
++ pc+ ''['' -z '''' '']''
+ eval all2fw_policychain=all2all
++ all2fw_policychain=all2all
+ eval all2fw_policy=DROP
++ all2fw_policy=DROP
+ print_policy all fw
+ ''['' check ''!='' check '']''
+ ''['' all = fw '']''
+ ''['' all = all '']''
+ eval ''pc=$all2all_policychain''
++ pc+ ''['' -z '''' '']''
+ eval all2all_policychain=all2all
++ all2all_policychain=all2all
+ eval all2all_policy=DROP
++ all2all_policy=DROP
+ print_policy all all
+ ''['' check ''!='' check '']''
+ ''['' all = all '']''
+ read client server policy loglevel synparams
+ rm -rf /tmp/shorewall-4655
+ echo ''Configuration Validated''
+ disclaimer
+ echo
+ echo ''WARNING: THE
''\''''check''\'''' COMMAND IS
TOTALLY UNSUPPORTED AND PROBLEM''
+ echo ''         REPORTS COMPLAINING ABOUT ERRORS THAT IT
DIDN''\''''T CATCH''
+ echo ''         WILL NOT BE ACCEPTED''
+ echo

Tom Eastep

2003-Mar-23 15:43 UTC

head link

[Shorewall-users] Shorewall 1.4.1

On Sun, 23 Mar 2003, Tom Eastep wrote:
> On Sun, 23 Mar 2003, Steven Jan Springl wrote:
> 
> > Tom;
> >          After upgrading from Shorewall 1.4.0 to 1.4.1, I receive the 
> > following messages during a "shorewall check"
> >          
> > Validating rules file...
> > /usr/share/shorewall/firewall: line 2174: [: =: unary operator
expected
> > Rule "ACCEPT fw wan tcp  21,53,80" checked. 
> > 
> > The error message is issued for every rule in the rules file.
> > 
> > I have not tried it with a Shorewall start or restart.
> > If you need any further information, please let me know.
> > 
> 
> Please send a trace...
> 
I''ve reproduced the problem -- it only occurs on
''check'' and is harmless.

You may correct the problem using the firewall script at:

	ftp://ftp1.shorewall.net/pub/shorewall/errata/1.4.1

Install that script in /usr/share/shorewall/firewall.

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
Shoreline,     \ http://shorewall.sf.net
Washington USA  \ teastep@shorewall.net

Steven Jan Springl

2003-Mar-23 16:13 UTC

head link

[Shorewall-users] Shorewall 1.4.1

On Sunday 23 March 2003 23:43, you wrote:> On Sun, 23 Mar 2003, Tom Eastep wrote:
> > On Sun, 23 Mar 2003, Steven Jan Springl wrote:
> > > Tom;
> > >          After upgrading from Shorewall 1.4.0 to 1.4.1, I receive
the
> > > following messages during a "shorewall check"
> > >
> > > Validating rules file...
> > > /usr/share/shorewall/firewall: line 2174: [: =: unary operator
expected
> > > Rule "ACCEPT fw wan tcp  21,53,80" checked.
> > >
> > > The error message is issued for every rule in the rules file.
> > >
> > > I have not tried it with a Shorewall start or restart.
> > > If you need any further information, please let me know.
> >
> > Please send a trace...
>
> I''ve reproduced the problem -- it only occurs on
''check'' and is harmless.
>
> You may correct the problem using the firewall script at:
>
> 	ftp://ftp1.shorewall.net/pub/shorewall/errata/1.4.1
>
> Install that script in /usr/share/shorewall/firewall.
>
> -Tom
Thanks Tom, I will install the new script and do some further testing.

 Steven.

Paul Chambers

2003-Mar-23 17:57 UTC

head link

[Shorewall-users] Shorewall 1.4.1

Tom, would you expect 1.4.1 to work correctly with iptables 1.2.7a?

I have been running shorewall 1.3.12 for some time with no problems. I
upgraded the machine to iptables 1.2.7a (part of bringing up
snort-inline) and 1.3.12 then failed to start. As does 1.3.14, and
1.4.1.

The error I see specifically is ''iptables: Invalid Argument''
right after
''Masqueraded Subnets and Hosts:'' appears. Checking my masq
file, it has
the one non-comment line ''eth1  192.168.1.0/24'' in it (eth1 is
my wan
interface).

I generated the trace using ''shorewall debug start'', and tried
typing
the command it complained about at the command line, and received no
''invalid argument'' error message:

  iptables -t nat -A eth1_masq -s 192.168.1.0/24 -d 0.0.0.0/0 -j
MASQUERADE

(I had to do ''iptables -t nat -N eth1_masq'' first, obviously).

The entire capture of ''shorewall debug start'' is 128k, so
I''ve attached
only the last 500 lines. If you need the whole thing, I''ll be glad to
send it to you directly, along with any other config files you''d like
to
see (pretty basic stuff, nothing exotic).

I''m running kernel 2.4.18-15clx (''Celestix'' - a
derivative of Mandrake).
Given the choice, I install most things via RPMs (usually Mandrake or
Mandrake Cooker versions), shorewall and iptables included. I had to use
--nodeps on shorewall as Mandrake calls iproute ''iproute2'' in
their RPM,
but otherwise everything went smoothly. Just to be clear, I am not using
the MNF version of shorewall, I am using RPMs obtained from
shorewall.net.

This one has me scratching my head. It must be iptables-related, since
shorewall 1.3.12 had been working perfectly beforehand. That''ll teach
me
for messing with something that was working...

Any help much appreciated. I''ve had to revert to a previous firewall
script, and I''m feeling rather naked...

Paul

-------------- next part --------------
+ run_iptables -N wrk2all
+ iptables -N wrk2all
+ ''['' yes = yes '']''
+ state=ESTABLISHED,RELATED
+ run_iptables -A wrk2all -m state --state ESTABLISHED,RELATED -j ACCEPT
+ iptables -A wrk2all -m state --state ESTABLISHED,RELATED -j ACCEPT
+ ''['' -z '''' '']''
+ run_iptables -A wrk2all -m state --state NEW -p tcp ''!''
--syn -j newnotsyn
+ iptables -A wrk2all -m state --state NEW -p tcp ''!'' --syn -j
newnotsyn
+ eval wrk2all_exists=Yes
++ wrk2all_exists=Yes
+ policy_rules wrk2all CONTINUE
+ local target=CONTINUE
+ target+ ''['' 2 -eq 3 -a x ''!='' x-
'']''
+ ''['' -n '''' '']''
+ ''['' -n '''' '']''
+ eval ''policy=$net2all_policy''
++ policy=DROP
+ eval ''loglevel=$net2all_loglevel''
++ loglevel=info
+ eval ''synparams=$net2all_synparams''
++ synparams+ ''['' -n ''''
'']''
+ havechain net2all
+ eval test ''"$net2all_exists"'' = Yes
++ test '''' = Yes
+ createchain net2all yes
+ run_iptables -N net2all
+ iptables -N net2all
+ ''['' yes = yes '']''
+ state=ESTABLISHED,RELATED
+ run_iptables -A net2all -m state --state ESTABLISHED,RELATED -j ACCEPT
+ iptables -A net2all -m state --state ESTABLISHED,RELATED -j ACCEPT
+ ''['' -z '''' '']''
+ run_iptables -A net2all -m state --state NEW -p tcp ''!''
--syn -j newnotsyn
+ iptables -A net2all -m state --state NEW -p tcp ''!'' --syn -j
newnotsyn
+ eval net2all_exists=Yes
++ net2all_exists=Yes
+ policy_rules net2all DROP info
+ local target=DROP
+ run_iptables -A net2all -j common
+ iptables -A net2all -j common
+ ''['' 3 -eq 3 -a xinfo ''!='' x-
'']''
+ ''['' info = ULOG '']''
+ run_iptables -A net2all -j LOG --log-prefix Shorewall:net2all:DROP:
--log-level info
+ iptables -A net2all -j LOG --log-prefix Shorewall:net2all:DROP: --log-level
info
+ ''['' -n DROP '']''
+ run_iptables -A net2all -j DROP
+ iptables -A net2all -j DROP
+ ''['' -n '''' '']''
+ eval ''policy=$all2all_policy''
++ policy=REJECT
+ eval ''loglevel=$all2all_loglevel''
++ loglevel=info
+ eval ''synparams=$all2all_synparams''
++ synparams+ ''['' -n ''''
'']''
+ havechain all2all
+ eval test ''"$all2all_exists"'' = Yes
++ test '''' = Yes
+ createchain all2all yes
+ run_iptables -N all2all
+ iptables -N all2all
+ ''['' yes = yes '']''
+ state=ESTABLISHED,RELATED
+ run_iptables -A all2all -m state --state ESTABLISHED,RELATED -j ACCEPT
+ iptables -A all2all -m state --state ESTABLISHED,RELATED -j ACCEPT
+ ''['' -z '''' '']''
+ run_iptables -A all2all -m state --state NEW -p tcp ''!''
--syn -j newnotsyn
+ iptables -A all2all -m state --state NEW -p tcp ''!'' --syn -j
newnotsyn
+ eval all2all_exists=Yes
++ all2all_exists=Yes
+ policy_rules all2all REJECT info
+ local target=REJECT
+ run_iptables -A all2all -j common
+ iptables -A all2all -j common
+ target=reject
+ ''['' 3 -eq 3 -a xinfo ''!='' x-
'']''
+ ''['' info = ULOG '']''
+ run_iptables -A all2all -j LOG --log-prefix Shorewall:all2all:REJECT:
--log-level info
+ iptables -A all2all -j LOG --log-prefix Shorewall:all2all:REJECT: --log-level
info
+ ''['' -n reject '']''
+ run_iptables -A all2all -j reject
+ iptables -A all2all -j reject
+ ''['' -n '''' '']''
+ chain=fw2fw
+ havechain fw2fw
+ eval test ''"$fw2fw_exists"'' = Yes
++ test '''' = Yes
+ chain=fw2wrk
+ havechain fw2wrk
+ eval test ''"$fw2wrk_exists"'' = Yes
++ test '''' = Yes
+ chain=fw2net
+ havechain fw2net
+ eval test ''"$fw2net_exists"'' = Yes
++ test Yes = Yes
+ run_user_exit fw2net
++ find_file fw2net
++ ''['' -n '''' -a -f /fw2net
'']''
++ echo /etc/shorewall/fw2net
+ local user_exit=/etc/shorewall/fw2net
+ ''['' -f /etc/shorewall/fw2net '']''
+ default_policy fw net
+ local chain=fw2net
+ local policy+ local loglevel+ local chain1
+ eval ''chain1=$fw2net_policychain''
++ chain1=fw2net
+ ''['' -n fw2net '']''
+ apply_default fw net
+ eval ''policy=$fw2net_policy''
++ policy=ACCEPT
+ eval ''loglevel=$fw2net_loglevel''
++ loglevel+ eval ''synparams=$fw2net_synparams''
++ synparams+ ''['' fw2net = fw2net '']''
+ policy_rules fw2net ACCEPT
+ local target=ACCEPT
+ ''['' 2 -eq 3 -a x ''!='' x-
'']''
+ ''['' -n ACCEPT '']''
+ run_iptables -A fw2net -j ACCEPT
+ iptables -A fw2net -j ACCEPT
+ echo ''   Policy ACCEPT for fw to net using chain fw2net''
+ chain=fw2dmz
+ havechain fw2dmz
+ eval test ''"$fw2dmz_exists"'' = Yes
++ test '''' = Yes
+ chain=fw2loc
+ havechain fw2loc
+ eval test ''"$fw2loc_exists"'' = Yes
++ test Yes = Yes
+ run_user_exit fw2loc
++ find_file fw2loc
++ ''['' -n '''' -a -f /fw2loc
'']''
++ echo /etc/shorewall/fw2loc
+ local user_exit=/etc/shorewall/fw2loc
+ ''['' -f /etc/shorewall/fw2loc '']''
+ default_policy fw loc
+ local chain=fw2loc
+ local policy+ local loglevel+ local chain1
+ eval ''chain1=$fw2loc_policychain''
++ chain1=fw2loc
+ ''['' -n fw2loc '']''
+ apply_default fw loc
+ eval ''policy=$fw2loc_policy''
++ policy=ACCEPT
+ eval ''loglevel=$fw2loc_loglevel''
++ loglevel+ eval ''synparams=$fw2loc_synparams''
++ synparams+ ''['' fw2loc = fw2loc '']''
+ policy_rules fw2loc ACCEPT
+ local target=ACCEPT
+ ''['' 2 -eq 3 -a x ''!='' x-
'']''
+ ''['' -n ACCEPT '']''
+ run_iptables -A fw2loc -j ACCEPT
+ iptables -A fw2loc -j ACCEPT
+ echo ''   Policy ACCEPT for fw to loc using chain fw2loc''
+ chain=wrk2fw
+ havechain wrk2fw
+ eval test ''"$wrk2fw_exists"'' = Yes
++ test Yes = Yes
+ run_user_exit wrk2fw
++ find_file wrk2fw
++ ''['' -n '''' -a -f /wrk2fw
'']''
++ echo /etc/shorewall/wrk2fw
+ local user_exit=/etc/shorewall/wrk2fw
+ ''['' -f /etc/shorewall/wrk2fw '']''
+ default_policy wrk fw
+ local chain=wrk2fw
+ local policy+ local loglevel+ local chain1
+ eval ''chain1=$wrk2fw_policychain''
++ chain1=wrk2all
+ ''['' -n wrk2all '']''
+ apply_default wrk fw
+ eval ''policy=$wrk2all_policy''
++ policy=CONTINUE
+ eval ''loglevel=$wrk2all_loglevel''
++ loglevel+ eval ''synparams=$wrk2all_synparams''
++ synparams+ ''['' wrk2fw = wrk2all '']''
+ ''['' -n '''' '']''
+ policy_rules wrk2fw CONTINUE
+ local target=CONTINUE
+ target+ ''['' 2 -eq 3 -a x ''!='' x-
'']''
+ ''['' -n '''' '']''
+ echo ''   Policy CONTINUE for wrk to fw using chain wrk2fw''
+ chain=wrk2wrk
+ havechain wrk2wrk
+ eval test ''"$wrk2wrk_exists"'' = Yes
++ test Yes = Yes
+ run_user_exit wrk2wrk
++ find_file wrk2wrk
++ ''['' -n '''' -a -f /wrk2wrk
'']''
++ echo /etc/shorewall/wrk2wrk
+ local user_exit=/etc/shorewall/wrk2wrk
+ ''['' -f /etc/shorewall/wrk2wrk '']''
+ default_policy wrk wrk
+ local chain=wrk2wrk
+ local policy+ local loglevel+ local chain1
+ eval ''chain1=$wrk2wrk_policychain''
++ chain1=wrk2wrk
+ ''['' -n wrk2wrk '']''
+ apply_default wrk wrk
+ eval ''policy=$wrk2wrk_policy''
++ policy=DROP
+ eval ''loglevel=$wrk2wrk_loglevel''
++ loglevel+ eval ''synparams=$wrk2wrk_synparams''
++ synparams+ ''['' wrk2wrk = wrk2wrk '']''
+ policy_rules wrk2wrk DROP
+ local target=DROP
+ run_iptables -A wrk2wrk -j common
+ iptables -A wrk2wrk -j common
+ ''['' 2 -eq 3 -a x ''!='' x-
'']''
+ ''['' -n DROP '']''
+ run_iptables -A wrk2wrk -j DROP
+ iptables -A wrk2wrk -j DROP
+ echo ''   Policy DROP for wrk to wrk using chain wrk2wrk''
+ chain=wrk2net
+ havechain wrk2net
+ eval test ''"$wrk2net_exists"'' = Yes
++ test '''' = Yes
+ chain=wrk2dmz
+ havechain wrk2dmz
+ eval test ''"$wrk2dmz_exists"'' = Yes
++ test '''' = Yes
+ chain=wrk2loc
+ havechain wrk2loc
+ eval test ''"$wrk2loc_exists"'' = Yes
++ test '''' = Yes
+ chain=net2fw
+ havechain net2fw
+ eval test ''"$net2fw_exists"'' = Yes
++ test Yes = Yes
+ run_user_exit net2fw
++ find_file net2fw
++ ''['' -n '''' -a -f /net2fw
'']''
++ echo /etc/shorewall/net2fw
+ local user_exit=/etc/shorewall/net2fw
+ ''['' -f /etc/shorewall/net2fw '']''
+ default_policy net fw
+ local chain=net2fw
+ local policy+ local loglevel+ local chain1
+ eval ''chain1=$net2fw_policychain''
++ chain1=net2all
+ ''['' -n net2all '']''
+ apply_default net fw
+ eval ''policy=$net2all_policy''
++ policy=DROP
+ eval ''loglevel=$net2all_loglevel''
++ loglevel=info
+ eval ''synparams=$net2all_synparams''
++ synparams+ ''['' net2fw = net2all '']''
+ ''['' -n '''' '']''
+ jump_to_policy_chain
+ run_iptables -A net2fw -j net2all
+ iptables -A net2fw -j net2all
+ chain=net2all
+ echo ''   Policy DROP for net to fw using chain net2all''
+ chain=net2wrk
+ havechain net2wrk
+ eval test ''"$net2wrk_exists"'' = Yes
++ test '''' = Yes
+ chain=net2net
+ havechain net2net
+ eval test ''"$net2net_exists"'' = Yes
++ test '''' = Yes
+ chain=net2dmz
+ havechain net2dmz
+ eval test ''"$net2dmz_exists"'' = Yes
++ test '''' = Yes
+ chain=net2loc
+ havechain net2loc
+ eval test ''"$net2loc_exists"'' = Yes
++ test '''' = Yes
+ chain=dmz2fw
+ havechain dmz2fw
+ eval test ''"$dmz2fw_exists"'' = Yes
++ test Yes = Yes
+ run_user_exit dmz2fw
++ find_file dmz2fw
++ ''['' -n '''' -a -f /dmz2fw
'']''
++ echo /etc/shorewall/dmz2fw
+ local user_exit=/etc/shorewall/dmz2fw
+ ''['' -f /etc/shorewall/dmz2fw '']''
+ default_policy dmz fw
+ local chain=dmz2fw
+ local policy+ local loglevel+ local chain1
+ eval ''chain1=$dmz2fw_policychain''
++ chain1=all2all
+ ''['' -n all2all '']''
+ apply_default dmz fw
+ eval ''policy=$all2all_policy''
++ policy=REJECT
+ eval ''loglevel=$all2all_loglevel''
++ loglevel=info
+ eval ''synparams=$all2all_synparams''
++ synparams+ ''['' dmz2fw = all2all '']''
+ ''['' -n '''' '']''
+ jump_to_policy_chain
+ run_iptables -A dmz2fw -j all2all
+ iptables -A dmz2fw -j all2all
+ chain=all2all
+ echo ''   Policy REJECT for dmz to fw using chain all2all''
+ chain=dmz2wrk
+ havechain dmz2wrk
+ eval test ''"$dmz2wrk_exists"'' = Yes
++ test '''' = Yes
+ chain=dmz2net
+ havechain dmz2net
+ eval test ''"$dmz2net_exists"'' = Yes
++ test '''' = Yes
+ chain=dmz2dmz
+ havechain dmz2dmz
+ eval test ''"$dmz2dmz_exists"'' = Yes
++ test '''' = Yes
+ chain=dmz2loc
+ havechain dmz2loc
+ eval test ''"$dmz2loc_exists"'' = Yes
++ test '''' = Yes
+ chain=loc2fw
+ havechain loc2fw
+ eval test ''"$loc2fw_exists"'' = Yes
++ test Yes = Yes
+ run_user_exit loc2fw
++ find_file loc2fw
++ ''['' -n '''' -a -f /loc2fw
'']''
++ echo /etc/shorewall/loc2fw
+ local user_exit=/etc/shorewall/loc2fw
+ ''['' -f /etc/shorewall/loc2fw '']''
+ default_policy loc fw
+ local chain=loc2fw
+ local policy+ local loglevel+ local chain1
+ eval ''chain1=$loc2fw_policychain''
++ chain1=loc2fw
+ ''['' -n loc2fw '']''
+ apply_default loc fw
+ eval ''policy=$loc2fw_policy''
++ policy=ACCEPT
+ eval ''loglevel=$loc2fw_loglevel''
++ loglevel+ eval ''synparams=$loc2fw_synparams''
++ synparams+ ''['' loc2fw = loc2fw '']''
+ policy_rules loc2fw ACCEPT
+ local target=ACCEPT
+ ''['' 2 -eq 3 -a x ''!='' x-
'']''
+ ''['' -n ACCEPT '']''
+ run_iptables -A loc2fw -j ACCEPT
+ iptables -A loc2fw -j ACCEPT
+ echo ''   Policy ACCEPT for loc to fw using chain loc2fw''
+ chain=loc2wrk
+ havechain loc2wrk
+ eval test ''"$loc2wrk_exists"'' = Yes
++ test '''' = Yes
+ chain=loc2net
+ havechain loc2net
+ eval test ''"$loc2net_exists"'' = Yes
++ test Yes = Yes
+ run_user_exit loc2net
++ find_file loc2net
++ ''['' -n '''' -a -f /loc2net
'']''
++ echo /etc/shorewall/loc2net
+ local user_exit=/etc/shorewall/loc2net
+ ''['' -f /etc/shorewall/loc2net '']''
+ default_policy loc net
+ local chain=loc2net
+ local policy+ local loglevel+ local chain1
+ eval ''chain1=$loc2net_policychain''
++ chain1=loc2net
+ ''['' -n loc2net '']''
+ apply_default loc net
+ eval ''policy=$loc2net_policy''
++ policy=ACCEPT
+ eval ''loglevel=$loc2net_loglevel''
++ loglevel+ eval ''synparams=$loc2net_synparams''
++ synparams+ ''['' loc2net = loc2net '']''
+ policy_rules loc2net ACCEPT
+ local target=ACCEPT
+ ''['' 2 -eq 3 -a x ''!='' x-
'']''
+ ''['' -n ACCEPT '']''
+ run_iptables -A loc2net -j ACCEPT
+ iptables -A loc2net -j ACCEPT
+ echo ''   Policy ACCEPT for loc to net using chain loc2net''
+ chain=loc2dmz
+ havechain loc2dmz
+ eval test ''"$loc2dmz_exists"'' = Yes
++ test '''' = Yes
+ chain=loc2loc
+ havechain loc2loc
+ eval test ''"$loc2loc_exists"'' = Yes
++ test '''' = Yes
++ find_file masq
++ ''['' -n '''' -a -f /masq
'']''
++ echo /etc/shorewall/masq
+ masq=/etc/shorewall/masq
+ ''['' -f /etc/shorewall/masq '']''
+ setup_masq /etc/shorewall/masq
+ strip_file masq /etc/shorewall/masq
+ local fname
+ ''['' 2 = 1 '']''
+ fname=/etc/shorewall/masq
+ ''['' -f /etc/shorewall/masq '']''
+ cut -d# -f1 /etc/shorewall/masq
+ grep -v ''^[[:space:]]*$''
+ ''['' -n Yes '']''
+ echo ''Masqueraded Subnets and Hosts:''
+ read fullinterface subnet address
+ expandv fullinterface subnet address
+ local varval
+ ''['' 3 -gt 0 '']''
+ eval ''varval=$fullinterface''
++ varval=eth1
+ eval ''fullinterface="eth1"''
++ fullinterface=eth1
+ shift
+ ''['' 2 -gt 0 '']''
+ eval ''varval=$subnet''
++ varval=192.168.1.0/24
+ eval ''subnet="192.168.1.0/24"''
++ subnet=192.168.1.0/24
+ shift
+ ''['' 1 -gt 0 '']''
+ eval ''varval=$address''
++ varval+ eval ''address=""''
++ address+ shift
+ ''['' 0 -gt 0 '']''
+ ''['' -n Yes '']''
+ setup_one
+ local using
+ destnet=0.0.0.0/0
+ interface=eth1
+ list_search eth1 eth1 eth0 eth2 eth3
+ local e=eth1
+ ''['' 5 -gt 1 '']''
+ shift
+ ''['' xeth1 = xeth1 '']''
+ return 0
+ ''['' 192.168.1.0/24 = 192.168.1.0/24 '']''
+ nomasq++ masq_chain eth1
+++ chain_base eth1
+++ local c=eth1
+++ echo eth1
++ echo eth1_masq
+ chain=eth1_masq
+ iface+ source=192.168.1.0/24
+ ''['' -n '''' -a -n ''''
'']''
+ destination=0.0.0.0/0
+ ''['' -n '''' '']''
+ destnet=-d 0.0.0.0/0
+ ''['' -n 192.168.1.0/24 '']''
+ ''['' -n '''' '']''
+ addnatrule eth1_masq -s 192.168.1.0/24 -d 0.0.0.0/0 -j MASQUERADE
+ ensurenatchain eth1_masq
+ havenatchain eth1_masq
+ eval test ''"$eth1_masq_nat_exists"'' = Yes
++ test '''' = Yes
+ createnatchain eth1_masq
+ run_iptables -t nat -N eth1_masq
+ iptables -t nat -N eth1_masq
+ eval eth1_masq_nat_exists=Yes
++ eth1_masq_nat_exists=Yes
+ run_iptables2 -t nat -A eth1_masq -s 192.168.1.0/24 -d 0.0.0.0/0 -j MASQUERADE
+ ''['' ''x-t nat -A eth1_masq -s 192.168.1.0/24 -d
0.0.0.0/0 -j MASQUERADE'' = ''x-t nat -A eth1_masq -s
192.168.1.0/24 -d 0.0.0.0/0 -j MASQUERADE'' '']''
+ run_iptables -t nat -A eth1_masq -s 192.168.1.0/24 -d 0.0.0.0/0 -j MASQUERADE
+ iptables -t nat -A eth1_masq -s 192.168.1.0/24 -d 0.0.0.0/0 -j MASQUERADE
iptables: Invalid argument
+ ''['' -z '''' '']''
+ stop_firewall
+ set +x

Tom Eastep

2003-Mar-23 18:02 UTC

head link

[Shorewall-users] Shorewall 1.4.1

On Sun, 23 Mar 2003, Paul Chambers wrote:
> Tom, would you expect 1.4.1 to work correctly with iptables 1.2.7a?
>
Hope so -- that''s what I run.

[root@gateway root]# iptables -V
iptables v1.2.7a
[root@gateway root]#

 > I have been running shorewall 1.3.12 for some time with no problems. I
> upgraded the machine to iptables 1.2.7a (part of bringing up
> snort-inline) and 1.3.12 then failed to start. As does 1.3.14, and
> 1.4.1.
> 
> The error I see specifically is ''iptables: Invalid
Argument'' right after
> ''Masqueraded Subnets and Hosts:'' appears. Checking my
masq file, it has
> the one non-comment line ''eth1  192.168.1.0/24'' in it
(eth1 is my wan
> interface).
>
Do a "shorewall clear". Then:

iptables -t nat -A POSTROUTING -o eth1 -s 192.168.1.0/24 -j MASQUERADE

Does that work?> 
> This one has me scratching my head. It must be iptables-related, since
> shorewall 1.3.12 had been working perfectly beforehand. That''ll
teach me
> for messing with something that was working...
>
And upgrading multiple components at the same time.

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
Shoreline,     \ http://shorewall.sf.net
Washington USA  \ teastep@shorewall.net

Tom Eastep

2003-Mar-23 18:10 UTC

head link

[Shorewall-users] Shorewall 1.4.1

On Sun, 23 Mar 2003, Tom Eastep wrote:
> On Sun, 23 Mar 2003, Paul Chambers wrote:
> 
> > 
> > This one has me scratching my head. It must be iptables-related, since
> > shorewall 1.3.12 had been working perfectly beforehand.
That''ll teach me
> > for messing with something that was working...
> >
> 
> And upgrading multiple components at the same time.
> 
And is your kernel compatible with the 1.2.7a?

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
Shoreline,     \ http://shorewall.sf.net
Washington USA  \ teastep@shorewall.net

Paul Chambers

2003-Mar-23 19:34 UTC

head link

[Shorewall-users] Shorewall 1.4.1

> -----Original Message-----
> From: Tom Eastep [mailto:teastep@shorewall.net] 
> On Sun, 23 Mar 2003, Paul Chambers wrote:
> > Tom, would you expect 1.4.1 to work correctly with iptables 1.2.7a?
> 
> Hope so -- that''s what I run.
> 
> [root@gateway root]# iptables -V
> iptables v1.2.7a
Yep, same result this end. 

<snip>> Do a "shorewall clear". Then:
> 
> iptables -t nat -A POSTROUTING -o eth1 -s 192.168.1.0/24 -j MASQUERADE
> 
> Does that work?
Nope, ''invalid argument'' again. Seems something''s not
kosher with my
iptables install. 
> > That''ll teach me for messing with something that
> > was working...
> 
> And upgrading multiple components at the same time.
Yeah, you''d think I know better. Especially since I''m laid up
sick and
not thinking clearly...
> And is your kernel compatible with the 1.2.7a?
Should be:

[root@home log]# uname -r
2.4.18-15clx

Which is recent enough, as I understand netfilter.org.

It is working with an older iptables script that Celestix ships on the
box (or I wouldn''t be able to send email...). Is there something
specific I should check for?

Paul

Tom Eastep

2003-Mar-24 06:37 UTC

head link

[Shorewall-users] Shorewall 1.4.1

On Sun, 23 Mar 2003, Paul Chambers wrote:
> 
> It is working with an older iptables script that Celestix ships on the
> box (or I wouldn''t be able to send email...). Is there something
> specific I should check for?
> 
When you compile and install your own iptables, by default it is installed 
in /usr/local -- in other words it usually doesn''t overwrite your old 
configuration. I suspect that the Celestix script is using the full path 
name for ''iptables'' while Shorewall uses the PATH (defined in 
shorewall.conf). I suspect that the two are running different versions of 
the code.

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
Shoreline,     \ http://shorewall.sf.net
Washington USA  \ teastep@shorewall.net

Paul Chambers

2003-Mar-24 10:40 UTC

head link

[Shorewall-users] Shorewall 1.4.1

> From: Tom Eastep [mailto:teastep@shorewall.net] 
>
> On Sun, 23 Mar 2003, Paul Chambers wrote:
> > It is working with an older iptables script that Celestix 
> > ships on the box (or I wouldn''t be able to send email...).
> > Is there something specific I should check for?
> 
> When you compile and install your own iptables, by default it 
> is installed in /usr/local -- in other words it usually
> doesn''t overwrite your old configuration. I suspect that the
> Celestix script is using the full path name for
''iptables''
> while Shorewall uses the PATH (defined in shorewall.conf). I
> suspect that the two are running different versions of 
> the code.
If I''d used the tarball, you''d be right, but I''d
built an RPM from the
source RPM, and installed that. So the iptables executable was in /sbin.
I had wondered the same thing, and done a ''which -a iptables''
just to be
sure...

Anyhow, I seemed to have resolved whatever the issue was by cleaning out
the various iptables binaries manually, rebuilding the RPM from the
source RPM, and reinstalling it with --force. Rather a brutal solution,
but whatever was mismatched or otherwise messed up doesn''t seem to be
any longer. And shorewall seems to be happy again.

I appreciate your willingness to help out with a non-shorewall issue -
much appreciated.

Paul

sunil shah

2003-Apr-04 05:17 UTC

head link

[Shorewall-users] Shorewall 1.4.1

Hi :

  I have internal network with 10.4.10.0/24 and I have router with 3
real ips.  One of the ip I have used for my firewall and that is
209.21.100.174 with 255.255.255.0.  My 2nd network card is using
10.4.10.102 and 255.255.255.0.  I have downloaded all the files for two
intework interface and installed them under /etc/shorewall directory.
As it mentioned I have enable ping.  I am able to ping my internal
network which is 10.4.10.104.  But if I try to ping 10.4.10.102 or
209.21.100.174  which is my firewall 2 nic I can not ping any of the
network card.  I also try to put my workstation machine default gateway
10.4.10.102 that is my firewall I can not get out on internet from the
work station via firewall.   Would you pleas tell me where I am wrong.
Any help will appreciate.  Thank you in advance.

            Shorewall Version          1.4.1a

 

            Uname -a                     Linux firewall.cicatelli.org
2.1.18-8.1mdksecure #1 SMP Mon Jun 24 11:39:25 MDT 2002 i686 unknown

 

            Ip addr show                  1: lo: <LOOPBACK,UP> mtu 16436
qdisc noqueue

                                                   Link/loopback
00:00:00:00:00:00 brb 00:00:00:00:00:00

                                                   Inet 127.0.0.1/8 brb
127.255.255.255 scope host lo

                                                2: eth0:
<BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100

                                                   link/ether
00:02:b3:03:27:9b brb ff:ff:ff:ff:ff:ff

                                                   inet 10.4.10.102/204
brb          10.4.10.255 scope global eth0

                                                3: eht1:
<BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100

                                                    LINK.ETHER
00:50:04:a4:62:a4 brb ff:ff:ff:ff:ff:ff

                                                    Inet
209.21.100.174/24 brb 209.21.100.255 scope global eth1

 

            Ip route show                 209.21.100.0/24 dev eth1 scope
link

                                                10.4.10.0/24 dev eth0
scope link

                                                127.0.0.0/8 dev lo scope
link

                                                default dev eth1 scope
link

 

            lsmod                           Module
size                  used by Not Tainted

                                                ipt_TOS
1248                 12         (autoclean)

                                                ipt_MASQUERADE
1600                 1          (autoclean)

                                                ipt_LOG
3776                 7          (autoclean)

                                                ipt_REJECT
3296                 6          (autoclean)

                                                ipt_state
864                  28         (autoclean)

iptable_mangle                          2336                 1
(autoclean)

ip_nat_irc                                  2944                 0
(unused)

ip_nat_ftp                                  3552                 0
(unused)

iptable_nat                                17108               3
[ipt_MASQUERADE ip_nat_irc ip_nat_ftp]

ip_conntract_irc                         2976                 0
[ip_nat_irc]

ip_conntract_ftp                         3872                 0
[ip_nat_ftp]

ip_conntrack                              16844               4
[ipt_MASQUERADE ipt_state ip_nat_irc ip_nat_ftp iptable_nat
ipconntrack_irc ip_conntrack_ftp]

iptable_filter                               1952                 1
(autoclean)

ip_tables                                   12256               10
[ipt_TOS ipt_MASQUERADE ipt_LOG ipt_REJECT ipt_state iptable_mangle
iptable_nat iptable_filter]

ppp_async                                6912                 0
(unused)

ppp_generic                               22792               0
[ppp_asunc]

slhc                                          5088                 0
[ppp_generic]

af_packet                                  13896               0
(autoclean)

usb-uhci                                    22692               0
(unused)

usbcore                                     62080               1
[usb-uhci]

3c59x                                       26536               1
(autoclean)

eepro100                                   18640               1
(autoclean)

rtc                                            6680                 0
(autoclean)

ext3                                          65292               1

jbd                                            42716               1
[ext3]

 

Sunil Shah

Network Engineer

Cicatelli Associates Inc.

505 8th Ave. 16th Floor

New York, NY 10018

Maybe Matching Threads

Search for more seemingly similar threads

Shorewall announce - Mar 2003 - Shorewall 1.4.1

[Shorewall-users] Shorewall 1.4.1

[Shorewall-users] Shorewall 1.4.1

[Shorewall-users] Shorewall 1.4.1

[Shorewall-users] Shorewall 1.4.1

[Shorewall-users] Shorewall 1.4.1

[Shorewall-users] Shorewall 1.4.1

[Shorewall-users] Shorewall 1.4.1

[Shorewall-users] Shorewall 1.4.1

[Shorewall-users] Shorewall 1.4.1

[Shorewall-users] Shorewall 1.4.1

[Shorewall-users] Shorewall 1.4.1

[Shorewall-users] Shorewall 1.4.1

[Shorewall-users] Shorewall 1.4.1

Maybe Matching Threads