[Shorewall-users] Shorewall overlapping zone problem

Alain Degreffe
Wed, 29 May 2002 10:12:16 -0000

Hi,

I have a serious problem with shorewall 1.2.6:

I have a loc type zone and a free zone ( some computers in the loc zone )
 with full access to all zones. (defined with host file )

I have added :

free all  ACCEPT

BUT Shorewall isolate my "free" subzone in the FORWARD and OUTPUT
CHAIN.
"free" is able to connect anything BUT the reverse path is blocked due
to the
fact that this stub zone do not follow the parent zone''s rules. (I mean
ZoneX -> loc ACCEPT is not applied to my sub zone "free" )


Each other zone is blocked by rules !!! but loc is able to do more

->The  problem is: A subzone DO NOT follow rules applied to parent zone !!
Exept in INPUT CHAIN. I think you should implement a notion of subzone aka
"children" who follow parent rules and aka "isolated" to
restrict a
subzone....