RC 1 is now available for testing.
Problems corrected in this release:
1) Corrected a problem in optimize level 4 that resulted in the
following compile-time failure.
Can''t use an undefined value as an ARRAY reference at
/usr/share/shorewall/Shorewall/Chains.pm line 862.
2) If a DNAT or REDIRECT rule applied to a source zone with an
interface defined with ''physical=+'', then the nat table
''dnat''
chain might have been created but not referenced. This prevented
the DNAT or REDIRECT rule from working correctly.
3) Previously, if a variable set in /etc/shorewall/params was given a
value containing shell metacharacters, then the compiled script
would contain syntax errors.
New Features:
1) The contents of the Netfilter mangle table are now included in the
output from ''shorewall show tc''.
2) Simple traffic shaping can now have a common configuration between
IPv4 and IPv6. To do that:
- Set TC_ENABLED=Simple in both /etc/shorewall/shorewall.conf and
/etc/shorewall6/shorewall6.conf
- Configure /etc/shorewall/tcinterfaces.
- Leave /etc/shorewall6/tcinterfaces empty.
- Configure /etc/shorewall/tcpri (if desired)
- Configure /etc/shorewall6/tcpri (if desired)
Thank you for testing,
-Tom
--
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
------------------------------------------------------------------------------
Xperia(TM) PLAY
It''s a major breakthrough. An authentic gaming
smartphone on the nation''s most reliable network.
And it wants your games.
http://p.sf.net/sfu/verizon-sfdev
Tom Rule: DROP $FW net !0 Produces the following iptables rule: -A fw2net ! -p 0 -j DROP Which produces the following iptabes-restore error: iptables-restore v1.4.2: rule would never match protocol ------------------------------------------------------------------------------------------ Shorewall allows a ''-'' to be specified within a protcol list: DROP $FW net 1,-,2 Is this intended? Steven. ------------------------------------------------------------------------------ Forrester Wave Report - Recovery time is now measured in hours and minutes not days. Key insights are discussed in the 2010 Forrester Wave Report as part of an in-depth evaluation of disaster recovery service providers. Forrester found the best-in-class provider in terms of services and vision. Read this report now! http://p.sf.net/sfu/ibm-webcastpromo
On Apr 11, 2011, at 2:38 PM, Steven Jan Springl wrote:> Tom > > Rule: > > DROP $FW net !0 > > Produces the following iptables rule: > > -A fw2net ! -p 0 -j DROP > > Which produces the following iptabes-restore error: > > iptables-restore v1.4.2: rule would never match protocolThe attached patch seems to catch this.> > ------------------------------------------------------------------------------------------ > > Shorewall allows a ''-'' to be specified within a protcol list: > > DROP $FW net 1,-,2 > > Is this intended?While including ''-'' in a list is silly, it doesn''t make a lot of sense to reject it since ''-'' by itself is valid in that column. I think I''ll leave it. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________ ------------------------------------------------------------------------------ Forrester Wave Report - Recovery time is now measured in hours and minutes not days. Key insights are discussed in the 2010 Forrester Wave Report as part of an in-depth evaluation of disaster recovery service providers. Forrester found the best-in-class provider in terms of services and vision. Read this report now! http://p.sf.net/sfu/ibm-webcastpromo
On Monday 11 April 2011 23:58:23 Tom Eastep wrote:> On Apr 11, 2011, at 2:38 PM, Steven Jan Springl wrote: > > Tom > > > > Rule: > > > > DROP $FW net !0 > > > > Produces the following iptables rule: > > > > -A fw2net ! -p 0 -j DROP > > > > Which produces the following iptabes-restore error: > > > > iptables-restore v1.4.2: rule would never match protocol > > The attached patch seems to catch this.Tom Confirmed. The patch fixes the problem. Steven. ------------------------------------------------------------------------------ Forrester Wave Report - Recovery time is now measured in hours and minutes not days. Key insights are discussed in the 2010 Forrester Wave Report as part of an in-depth evaluation of disaster recovery service providers. Forrester found the best-in-class provider in terms of services and vision. Read this report now! http://p.sf.net/sfu/ibm-webcastpromo
Tom Rule: DROP $FW net 256 Produces the following error message: iptables-restore v1.4.2: unknown protocol `256'' specified Note, the following iana web page states that protocol can be from 0 to 255 (a one byte field). http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xml Steven. ------------------------------------------------------------------------------ Forrester Wave Report - Recovery time is now measured in hours and minutes not days. Key insights are discussed in the 2010 Forrester Wave Report as part of an in-depth evaluation of disaster recovery service providers. Forrester found the best-in-class provider in terms of services and vision. Read this report now! http://p.sf.net/sfu/ibm-webcastpromo
On Apr 11, 2011, at 4:35 PM, Steven Jan Springl wrote:> Tom > > Rule: > > DROP $FW net 256 > > Produces the following error message: > > iptables-restore v1.4.2: unknown protocol `256'' specifiedThis should fix it. -Tom Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________ ------------------------------------------------------------------------------ Forrester Wave Report - Recovery time is now measured in hours and minutes not days. Key insights are discussed in the 2010 Forrester Wave Report as part of an in-depth evaluation of disaster recovery service providers. Forrester found the best-in-class provider in terms of services and vision. Read this report now! http://p.sf.net/sfu/ibm-webcastpromo
On Apr 11, 2011, at 5:05 PM, Tom Eastep wrote:> > This should fix it. >And thank you, Steven -Tom Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________ ------------------------------------------------------------------------------ Forrester Wave Report - Recovery time is now measured in hours and minutes not days. Key insights are discussed in the 2010 Forrester Wave Report as part of an in-depth evaluation of disaster recovery service providers. Forrester found the best-in-class provider in terms of services and vision. Read this report now! http://p.sf.net/sfu/ibm-webcastpromo
On Tuesday 12 April 2011 01:05:44 Tom Eastep wrote:> On Apr 11, 2011, at 4:35 PM, Steven Jan Springl wrote: > > Tom > > > > Rule: > > > > DROP $FW net 256 > > > > Produces the following error message: > > > > iptables-restore v1.4.2: unknown protocol `256'' specified > > This should fix it. > > -TomTom Confirmed, the patch fixes the problem. Thanks. Steven. ------------------------------------------------------------------------------ Forrester Wave Report - Recovery time is now measured in hours and minutes not days. Key insights are discussed in the 2010 Forrester Wave Report as part of an in-depth evaluation of disaster recovery service providers. Forrester found the best-in-class provider in terms of services and vision. Read this report now! http://p.sf.net/sfu/ibm-webcastpromo
On Apr 12, 2011, at 3:12 AM, Steven Jan Springl wrote:> > Confirmed, the patch fixes the problem. Thanks. >Thank you, Steven -Tom Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________ ------------------------------------------------------------------------------ Forrester Wave Report - Recovery time is now measured in hours and minutes not days. Key insights are discussed in the 2010 Forrester Wave Report as part of an in-depth evaluation of disaster recovery service providers. Forrester found the best-in-class provider in terms of services and vision. Read this report now! http://p.sf.net/sfu/ibm-webcastpromo