Re: why ADD_DNAT_ALIASES missing?

Farkas Levente
Tue, 10 Aug 2004 20:49:07 -0000

On Tue, 2004-08-10 at 21:44, Tom Eastep wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Farkas Levente wrote:
> | hi,
> | is there any reason why there is no such thing as ADD_DNAT_ALIASES in
> | shorewall.conf or in rules (or am i just missed it)?
>
> The answer hasn''t changed since I answered your question this
morning!
>
> | and some related questions:
> | - is a line in masq file automaticaly add an accept rule too? eg. in
> | msaq file
> | eth0 <internal ip>
>
> No.
>
> | allow connection from <internal ip> (local zona) to the net zone
(eth0''s
> | zone)?
> | - is a line in the nat file automaticaly add an accept rule too? eg. in
> | nat file:
>
> No.

thanks for these answers:-)

> | <external ip> eth0:5  <internal ip>
> | allow connection from BOTH <internal ip> (local zona) to the net
zone
> | (eth0''s zone) and from the net zone to the <internal ip>?
> | or should i also have to add these to the rules file?
> | i try to read all doc but these are not documented very well. some kind
> | of advanced documentation would be useful for those how know the ip and
> | iptables command .eg. "a dnat rule add such an iptables
command" etc.
>
> Those who know now IP and iptables work can study the output of
> "shorewall status" with the help of these two documents:
>
> a) http://shorewall.net/PacketHandling.html
> b) http://shorewall.net/NetfilterOverview.html

some thing "shorewall generate" would be useful which create a file
what
can be feed to iptables (best would be iptables-save/restore compatible
format) WITHOUT appling it. afair "shorewall status" is only useable
on
a running shorewall ie. after appling it, but before i use it i''d like
to look into what i will do and when something goes wrong than i''d like
to see what''g going wrong.