[Shorewall-users] Opportunistic encryption

Homer Parker
Wed, 30 Oct 2002 16:43:07 -0000

--1b=.''0HVP7lLi5FJ
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Wed, 30 Oct 2002 10:35:33 -0600 Homer Parker <hparker@homershut.net>
wrote....

> On Wed, 30 Oct 2002 06:21:35 -0800 Tom Eastep <teastep@shorewall.net>
> wrote....
>
>
> > To eliminate the above messages, you could simply add a static rule
> > such as:
> >
> > ACCEPT	fw	vpn	udp	53
> >
> > Where ''vpn'' is the zone used for the remote
client/network.
>
> 	That fixed that error.... Brought in a whole slew of new ones ;)
> 	These
> are from klips, so I''ll chase them through FreeS/WAN first ;) But,
I did
> come up with a couple I don''t remember seeing before:
>
> Oct 30 10:36:45 linux kernel: Shorewall:all2all:REJECT:IN= OUT=eth1
> SRC=64.216.105.3 DST=128.63.2.52 LEN=52 TOS=0x00 PREC=0x00 TTL=255
> ID=13040 PROTO=ICMP TYPE=0 CODE=0 ID=43520 SEQ=24
> Oct 30 10:36:48 linux kernel: NET: 12 messages suppressed.
> Oct 30 10:36:48 linux kernel: klips_error:ipsec_tunnel_start_xmit:
> ip_send() failed, err=1
> Oct 30 10:36:48 linux kernel: Shorewall:all2all:REJECT:IN= OUT=eth1
> SRC=64.216.105.3 DST=128.63.2.52 LEN=52 TOS=0x00 PREC=0x00 TTL=255
> ID=13041 PROTO=ICMP TYPE=0 CODE=0 ID=43520 SEQ=24
>
> 	Looks to me like pings to see if the root servers are alive?

	Talking to myself again ;) A quick google turned up this:

----- Begin cut-n-paste -----
There was a question, what is:

> Nov 16 14:30:33 tunnelwien kernel:
> klips_error:ipsec_tunnel_start_xmit:ip_send(
>) failed, err=-1

  I must assume that this is 2.4.
  It would appear it is because a NetFilter local output filter declined
to
forward the packet. I''d need a full barf to know more.
----- End cut-n-paste -----

	Where do I go from here?

---
Homer Parker

http://www.homershut.net
telnet://bbs.homershut.net

This e-mail message is 100% Microsoft free!

WARNING: THIS ACCOUNT BELONGS TO A RABID
ANTI-SPAMMER NET-NAZI DOT-COMMUNIST.

   /"\
   \ /     ASCII Ribbon Campaign
    X      Against HTML Mail
   / \

--1b=.''0HVP7lLi5FJ
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE9wAwdrgrN227HZ+8RAmEAAKCiYH3Z5P64hDCNa1zU/i/KGyZLlwCfe1bH
gZQQ6OBTrjSt/QFNAijp0CY=x6dU
-----END PGP SIGNATURE-----

--1b=.''0HVP7lLi5FJ--