thr3ads.net - Shorewall users - [Shorewall-users] shorewall on RH 9.0 [Jul 2003]

If this information is useful, please help other people find it:
Share via:

Bo Hermannsen

2003-Jul-10 01:35 UTC

[Shorewall-users] shorewall on RH 9.0

is there any spec. thing to be aware off? i just installed shorewall on a
fresh install of RH 9..... it''s is with two NIC''s and i just
can''t get it to
work

regards

bo

2003-Jul-10 01:44 UTC

head link

[Shorewall-users] shorewall on RH 9.0

Quoting Bo Hermannsen <dsl84303@vip.cybercity.dk>:
> is there any spec. thing to be aware off? i just installed shorewall on a
> fresh install of RH 9..... it''s is with two NIC''s and i
just can''t get it
> to
> work

"My car doesnt start, whats wrong with it?"

No, seriously, take a peek at http://www.shorewall.net/support.htm and follw 
the instructions and people will have a much easier time to guide you.

(But since Tom Eastep himself uses RH9, i would say "No, there is nothing
to
be aware of, part from making sure your system has all the prerequisits, and 
you have configiured correctly")

-------------------------------------------------
This mail sent through IMP: http://horde.org/imp/

Bo Hermannsen

2003-Jul-10 02:30 UTC

head link

[Shorewall-users] shorewall on RH 9.0

here is some info i gathered:

[root@dhcppc3 root]# shorewall version
1.4.4b
[root@dhcppc3 root]# ip addr show
1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
    link/ether 00:02:44:48:b1:be brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.5/24 brd 10.0.0.255 scope global eth0
3: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
    link/ether 00:02:44:48:b1:b7 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.0/24 brd 192.168.1.255 scope global eth1
[root@dhcppc3 root]# ip route show
10.0.0.0/24 dev eth0  proto kernel  scope link  src 10.0.0.5
192.168.1.0/24 dev eth1  scope link
169.254.0.0/16 dev eth1  scope link
127.0.0.0/8 dev lo  scope link
default via 10.0.0.1 dev eth0



[H[2JShorewall-1.4.4b Status at dhcppc3 - tor jul 10 11:04:44 CEST 2003

Counters reset Thu Jul 10 10:48:15 CEST 2003

Chain INPUT (policy ACCEPT 46 packets, 3346 bytes)
 pkts bytes target     prot opt in     out     source
destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source
destination

Chain OUTPUT (policy ACCEPT 39 packets, 3550 bytes)
 pkts bytes target     prot opt in     out     source
destination

Jul 10 10:53:22 logdrop:DROP:IN=eth0 OUT= SRC=10.0.0.1 DST=10.0.0.255 LEN=72
TOS=0x00 PREC=0x00 TTL=1 ID=59954 PROTO=UDP SPT=520 DPT=520 LEN=52
Jul 10 10:53:52 logdrop:DROP:IN=eth0 OUT= SRC=10.0.0.1 DST=10.0.0.255 LEN=72
TOS=0x00 PREC=0x00 TTL=1 ID=59955 PROTO=UDP SPT=520 DPT=520 LEN=52
Jul 10 10:54:22 logdrop:DROP:IN=eth0 OUT= SRC=10.0.0.1 DST=10.0.0.255 LEN=72
TOS=0x00 PREC=0x00 TTL=1 ID=59956 PROTO=UDP SPT=520 DPT=520 LEN=52
Jul 10 10:54:52 logdrop:DROP:IN=eth0 OUT= SRC=10.0.0.1 DST=10.0.0.255 LEN=72
TOS=0x00 PREC=0x00 TTL=1 ID=59957 PROTO=UDP SPT=520 DPT=520 LEN=52
Jul 10 10:55:22 logdrop:DROP:IN=eth0 OUT= SRC=10.0.0.1 DST=10.0.0.255 LEN=72
TOS=0x00 PREC=0x00 TTL=1 ID=59959 PROTO=UDP SPT=520 DPT=520 LEN=52
Jul 10 10:55:52 logdrop:DROP:IN=eth0 OUT= SRC=10.0.0.1 DST=10.0.0.255 LEN=72
TOS=0x00 PREC=0x00 TTL=1 ID=59960 PROTO=UDP SPT=520 DPT=520 LEN=52
Jul 10 10:56:02 logdrop:DROP:IN=eth0 OUT= SRC=10.0.0.2 DST=10.0.0.5 LEN=48
TOS=0x00 PREC=0x00 TTL=128 ID=9154 DF PROTO=TCP SPT=1424 DPT=22 WINDOW=16384
RES=0x00 SYN URGP=0
Jul 10 10:56:05 logdrop:DROP:IN=eth0 OUT= SRC=10.0.0.2 DST=10.0.0.5 LEN=48
TOS=0x00 PREC=0x00 TTL=128 ID=9155 DF PROTO=TCP SPT=1424 DPT=22 WINDOW=16384
RES=0x00 SYN URGP=0
Jul 10 10:56:22 logdrop:DROP:IN=eth0 OUT= SRC=10.0.0.1 DST=10.0.0.255 LEN=72
TOS=0x00 PREC=0x00 TTL=1 ID=59961 PROTO=UDP SPT=520 DPT=520 LEN=52
Jul 10 10:56:52 logdrop:DROP:IN=eth0 OUT= SRC=10.0.0.1 DST=10.0.0.255 LEN=72
TOS=0x00 PREC=0x00 TTL=1 ID=59962 PROTO=UDP SPT=520 DPT=520 LEN=52
Jul 10 10:57:22 logdrop:DROP:IN=eth0 OUT= SRC=10.0.0.1 DST=10.0.0.255 LEN=72
TOS=0x00 PREC=0x00 TTL=1 ID=60073 PROTO=UDP SPT=520 DPT=520 LEN=52
Jul 10 10:57:36 logdrop:DROP:IN=eth0 OUT= SRC=10.0.0.2 DST=10.0.0.255 LEN=78
TOS=0x00 PREC=0x00 TTL=128 ID=9442 PROTO=UDP SPT=137 DPT=137 LEN=58
Jul 10 10:57:36 logdrop:DROP:IN=eth0 OUT= SRC=10.0.0.2 DST=10.0.0.255 LEN=78
TOS=0x00 PREC=0x00 TTL=128 ID=9443 PROTO=UDP SPT=137 DPT=137 LEN=58
Jul 10 10:57:37 logdrop:DROP:IN=eth0 OUT= SRC=10.0.0.2 DST=10.0.0.255 LEN=78
TOS=0x00 PREC=0x00 TTL=128 ID=9444 PROTO=UDP SPT=137 DPT=137 LEN=58
Jul 10 10:57:43 logdrop:DROP:IN=eth0 OUT= SRC=10.0.0.2 DST=10.0.0.255
LEN=229 TOS=0x00 PREC=0x00 TTL=128 ID=9451 PROTO=UDP SPT=138 DPT=138 LEN=209
Jul 10 10:57:52 logdrop:DROP:IN=eth0 OUT= SRC=10.0.0.1 DST=10.0.0.255 LEN=72
TOS=0x00 PREC=0x00 TTL=1 ID=60074 PROTO=UDP SPT=520 DPT=520 LEN=52
Jul 10 10:58:18 logdrop:DROP:IN=eth0 OUT= SRC=10.0.0.2 DST=10.0.0.5 LEN=48
TOS=0x00 PREC=0x00 TTL=128 ID=9511 DF PROTO=TCP SPT=1439 DPT=22 WINDOW=16384
RES=0x00 SYN URGP=0
Jul 10 10:58:21 logdrop:DROP:IN=eth0 OUT= SRC=10.0.0.2 DST=10.0.0.5 LEN=48
TOS=0x00 PREC=0x00 TTL=128 ID=9517 DF PROTO=TCP SPT=1439 DPT=22 WINDOW=16384
RES=0x00 SYN URGP=0
Jul 10 10:58:22 logdrop:DROP:IN=eth0 OUT= SRC=10.0.0.1 DST=10.0.0.255 LEN=72
TOS=0x00 PREC=0x00 TTL=1 ID=60075 PROTO=UDP SPT=520 DPT=520 LEN=52
Jul 10 10:58:52 logdrop:DROP:IN=eth0 OUT= SRC=10.0.0.1 DST=10.0.0.255 LEN=72
TOS=0x00 PREC=0x00 TTL=1 ID=60076 PROTO=UDP SPT=520 DPT=520 LEN=52

NAT Table

Chain PREROUTING (policy ACCEPT 10 packets, 855 bytes)
 pkts bytes target     prot opt in     out     source
destination

Chain POSTROUTING (policy ACCEPT 3 packets, 204 bytes)
 pkts bytes target     prot opt in     out     source
destination

Chain OUTPUT (policy ACCEPT 3 packets, 204 bytes)
 pkts bytes target     prot opt in     out     source
destination

Mangle Table

Chain PREROUTING (policy ACCEPT 55 packets, 3926 bytes)
 pkts bytes target     prot opt in     out     source
destination

Chain INPUT (policy ACCEPT 55 packets, 3926 bytes)
 pkts bytes target     prot opt in     out     source
destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source
destination

Chain OUTPUT (policy ACCEPT 48 packets, 4064 bytes)
 pkts bytes target     prot opt in     out     source
destination

Chain POSTROUTING (policy ACCEPT 48 packets, 4064 bytes)
 pkts bytes target     prot opt in     out     source
destination

udp      17 6 src=10.0.0.1 dst=10.0.0.255 sport=520 dport=520 [UNREPLIED]
src=10.0.0.255 dst=10.0.0.1 sport=520 dport=520 use=1
tcp      6 431998 ESTABLISHED src=10.0.0.2 dst=10.0.0.5 sport=1444 dport=22
src=10.0.0.5 dst=10.0.0.2 sport=22 dport=1444 [ASSURED] use=1

Julian Church

2003-Jul-10 02:40 UTC

head link

[Shorewall-users] shorewall on RH 9.0

On Thu, 10 Jul 2003 10:34:26 +0200, Bo Hermannsen 
<dsl84303@vip.cybercity.dk> wrote:
> is there any spec. thing to be aware off? i just installed shorewall on a
> fresh install of RH 9..... it''s is with two NIC''s and i
just can''t get it
> to
> work
There are no specific issues I''m aware of regarding Shorewall on RH9.0.
I
don''t think Shorewall generally works without a small amount of human 
attention.  Have a look at the highly comprehensive documentation at 
www.shorewall.net.

Start with

http://www.shorewall.net/two-interface.htm

Still having problems after that?

http://www.shorewall.net/troubleshoot.htm

then

http://www.shorewall.net/support.htm

which includes instructions on how to ask effective questions here.

cheers

Julian

Tom Eastep

2003-Jul-10 06:12 UTC

head link

[Shorewall-users] shorewall on RH 9.0

On Thu, 10 Jul 2003 11:29:20 +0200, Bo Hermannsen 
<dsl84303@vip.cybercity.dk> wrote:

>
>
> [H[2JShorewall-1.4.4b Status at dhcppc3 - tor jul 10 11:04:44 CEST 2003
>
> Counters reset Thu Jul 10 10:48:15 CEST 2003
>
> Chain INPUT (policy ACCEPT 46 packets, 3346 bytes)
> pkts bytes target     prot opt in     out     source
> destination
>
> Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
> pkts bytes target     prot opt in     out     source
> destination
>
Shorewall works a lot better if you start it.

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
Shoreline,     \ http://www.shorewall.net
Washington USA  \ teastep@shorewall.net

Tom Eastep

2003-Jul-10 06:57 UTC

head link

[Shorewall-users] shorewall on RH 9.0

On Thu, 2003-07-10 at 06:11, Tom Eastep wrote:
> 
> Shorewall works a lot better if you start it.
You *did* follow the instructions at
http://shorewall.net/two-interface.htm, right?

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net

ian

2003-Jul-10 07:20 UTC

head link

[Shorewall-users] shorewall on RH 9.0

No problems here running in RH9.. .Installed the RPM and away we went 
after configuring shorewall.  Got it going on 6 interfaces.  :)

ian


Bo Hermannsen wrote:> is there any spec. thing to be aware off? i just installed shorewall on a
> fresh install of RH 9..... it''s is with two NIC''s and i
just can''t get it to
> work
> 
> regards
> 
> bo
> 
> _______________________________________________
> Shorewall-users mailing list
> Post: Shorewall-users@lists.shorewall.net
> Subscribe/Unsubscribe:
http://lists.shorewall.net/mailman/listinfo/shorewall-users
> Support: http://www.shorewall.net/support.htm
> FAQ: http://www.shorewall.net/FAQ.htm

Nick Sklavenitis

2003-Jul-10 13:07 UTC

head link

[Shorewall-users] shorewall on RH 9.0

I bet he used the redhat config default firewall rules.
if that is the case make sure service iptables is stopped.
then try starting your shorewall assuming it properly configured.

Tom Eastep

2003-Jul-10 15:23 UTC

head link

[Shorewall-users] shorewall on RH 9.0

On Thu, 2003-07-10 at 12:56, Bo Hermannsen wrote:> yes i did... and still no local clients is able to obtain a ip from the
dhcp
> server on the firewall
> 
All that is required to support DHCP is to specify ''dhcp'' as
an option
for your local interface in /etc/shorewall/interfaces.

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net

Tom Eastep

2003-Jul-10 15:31 UTC

head link

[Shorewall-users] shorewall on RH 9.0

On Thu, 2003-07-10 at 13:06, Nick Sklavenitis wrote:> I bet he used the redhat config default firewall rules.
> if that is the case make sure service iptables is stopped.
> then try starting your shorewall assuming it properly configured.
Also make sure that the ipchains service is stopped *and disabled*.

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net

Shorewall users - Jul 2003 - shorewall on RH 9.0

[Shorewall-users] shorewall on RH 9.0

[Shorewall-users] shorewall on RH 9.0

[Shorewall-users] shorewall on RH 9.0

[Shorewall-users] shorewall on RH 9.0

[Shorewall-users] shorewall on RH 9.0

[Shorewall-users] shorewall on RH 9.0

[Shorewall-users] shorewall on RH 9.0

[Shorewall-users] shorewall on RH 9.0

[Shorewall-users] shorewall on RH 9.0

[Shorewall-users] shorewall on RH 9.0