Shorewall users - Jul 2003 - to update or not to update

I have been using Shorewall for quite sometime now and had been upgrading 
fairly regularly, sometimes just cause it seemed the right thing to do. I am 
currently at ver 1.4.2 on my SuSE 8.2 machine.

I have a relatively simple two interface setup.   My subnet consists of two 
linux laptops, one Windows laptop, 2 desktops on Linux and one on Windows.
I also have a Cisco ATA86 connecting me to the Vonage VoIP phone system.  They 
all have been working quite well for the past 4 months.  My main machine acts 
as my router, gateway with Shorewall doing the Firewall honors.

I am interested in doing some VNC and VPN in the near future. I am also 
considering using an old 150 meg laptop as my router/firewall system.
Because the only phone system in my home is the VoIP system I am reluctant to 
play with my main machine like I use to.

I know that Tom puts in a lot of time improving Shorewall and his improvements 
are genereally good to have whether they are presently used or not.

Now my question!

Given that my system has become fairly important and I really need it to be 
reliable, would it be wise for me to mess with a stable setup by upgrading 
Shorewall.  Will an upgrade buy me anything given that I  am planning to 
start using VPN and VNC?

Any coments or suggestions, anyone?

TIA
Richard

On Mon, 2003-07-14 at 15:41, Richard wrote:
> Given that my system has become fairly important and I really need it to be
> reliable, would it be wise for me to mess with a stable setup by upgrading 
> Shorewall.  Will an upgrade buy me anything given that I  am planning to 
> start using VPN and VNC?
> 
> Any comments or suggestions, anyone?
> 
I see upgrades as a "pay me now or pay me later" trade off. Upgrading
regularly spreads out the pain into small doses. If you get a long way
behind and then suddenly discover that you need a feature that isn''t
available in your release, you will have to wade through lots of
"Upgrade Issues" and try to decipher which of the issues apply to you
and which don''t.

With respect to your current release (1.4.2) and VPN/VNC:

a) VNC is a simple TCP application; the only thing remotely tricky about
it is that as with X, the VNC port number varies with the display
number.

b) There have been no VPN-specific changes since 1.4.2.

Finally, when upgrading after you get behind I recommend that you don''t
pick the current release (especially if it has just come out) and of
course don''t pick a release that had disastrous bugs that required an
immediate follow-on release to correct (yes, I have produced several of
those).

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net