On Thu, 2003-07-03 at 15:24, Bharath Sankaranarayan
wrote:> Tom,
> Thanks for your suggestions. What I am not able to find on the upgrade
> issues is, I had used one of the 2 interfaces sample on the Shorewall
> website when I installed 1.2 and I want to make sure that the upgrade will
> be compatible with the rules and the policies. I could not find the 2
> interfaces updated for 1.4.x.
http://www.shorewall.net/pub/shorewall/Samples
> May be I am not looking in the right places.
> For example we have a VPN server behind our Shorewall 1.2 Firewall but the
> PPTP page says that I need to add DNAT command which does not work in 1.2
> version. As our firewall works well for our purpose I don''t want
to upgrade
> and break what is working.
Upgrading always involves risks, especially when you choose to skip one
entire major release of a product.
> Unfortunately we don''t have a spare box to test.
> This was the starting point for the upgrade, also we are unable to connect
> and external VPN ( one session is ok but not multiple simultaneous) I am
> aware that I need to do VPN masq but the notes on masq site is confusing
for
> me. Sorry for rambling and going astray but I thought it will be beneficial
> to explain why I am trying to do what I am doing.
You will need the PPTP connection tracking kernel patch from
netfilter.org (Patch-O-Matic). Unfortunately, using Patch-O-Matic is not
for the novices (or for faint of heart veterans for that matter).
-Tom
--
Tom Eastep \ Shorewall - iptables made easy
Shoreline, \ http://www.shorewall.net
Washington USA \ teastep@shorewall.net