[Shorewall-users] Shorewall overlapping zone problem

Alain Degreffe
Wed, 29 May 2002 10:15:07 -0000

Hi,


I have a serious problem with shorewall 1.2.6:


I have a loc type zone and a free zone ( some computers in the loc zone )
with=20
full access to all zones. (defined with host file )


I have added :


free all  ACCEPT


BUT Shorewall isolate my "free" subzone in the FORWARD and OUTPUT
CHAIN.
"free" is able to connect anything BUT the reverse path is blocked due
to the=20
fact that this stub zone do not follow the parent zone''s rules. (I mean
=20
ZoneX -> loc ACCEPT is not applied to my sub zone "free" )



Each other zone is blocked by rules !!! but loc is able to do more=20


->The  problem is: A subzone DO NOT follow rules applied to parent zone !!=20
Exept in INPUT CHAIN. I think you should implement a notion of subzone aka=20
"children" who follow parent rules and aka "isolated" to
restrict a=20
subzone....