Re: Shorewall HOW-TO & VPS Question

Andrew Allen
Mon, 21 Jun 2004 21:21:52 -0000

I''ve tried your suggestion, but that does not work either.

I''ve did find the following post on SWsoft''s forums:

"In Virtuozzo prior 2.6 (which is scheduled for general availability at
the end
of May) we do not compile in connection tracking modules and that''s why
you
cannot use state module as well, it depends on connection tracking. However,
you can achive the same result by using --syn flag, i.e. by blocking incoming
packets with SYN flag set and allowing them in otherwise. Moreover, i would
suggest to use --syn method even in Virtuozzo 2.6, since keeping the state of
all connections is kernel resource wastage and with SYN flag you do the
same on
by packet basis."

Does what''s said hold true? Can shorewall support this rather than
state
matching, or is it not recommended?

Thanks!

Andrew Allen

Quoting Tom Eastep <teastep@shorewall.net>:

> Copy of post send to the mailing list.
>
> Tom Eastep wrote:
>
>>> + iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j
ACCEPT
>>> iptables: No chain/target/match by that name
>>>
>>
>> Looks like there is no state match support in the kernel --
>> Shorewall won''t run without it.
>
> It may be that module autoloading is disabled in the kernel -- try
> "modprobe ipt_state"; if that works, you can add:
>
> 	loadmodule ipt_state
>
> to /etc/shorewall/modules (you will probably have to add more as you go
> along).
>
> -Tom
> --
> Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
> Shoreline,     \ http://shorewall.net
> Washington USA  \ teastep@shorewall.net
>
> _______________________________________________
> Shorewall-users mailing list
> Post: Shorewall-users@lists.shorewall.net
> Subscribe/Unsubscribe:
> https://lists.shorewall.net/mailman/listinfo/shorewall-users
> Support: http://www.shorewall.net/support.htm
> FAQ: http://www.shorewall.net/FAQ.htm