Re: Example/Crash bug in /etc/masq

Tom Eastep
Tue, 30 Aug 2005 13:52:42 -0000

> #       SUBNET -- Subnet that you wish to masquerade. You can specify this

Please note: This part of the comments is describing the SUBNET COLUMN!!!

> #
> #                 Example: eth1!192.168.1.4,192.168.32.0/27
> #
>
> Well last night I found the example to be grievously mistaken; for when I
> entered this:
>
> eth1!192.168.4.0/24     eth0

You decided to use the syntax for the SUBNET column in the INTERFACE column.

>
> ...in my config, it promptly crashed shorewall on restart.  This
effectively
> cut me off from my remote firewall making me a less than happy camper.

Shorewall contains ample facilities for preventing you from sawing off
the limb you are sitting on but you have to use them.

> I found the resolution to the problem was to add a colon:
>
> eth1:!192.168.4.0/24     eth0
>
> I don''t know if this works as intended, but at very least
shorewall doesn''t
> crash when I do it.

That is the correct syntax. From the masq file:

#       INTERFACE -- Outgoing interface. This is usually your internet
#                    interface. If ADD_SNAT_ALIASES=Yes in
#                    /etc/shorewall/shorewall.conf, you may add ":"
and
#                    a digit to indicate that you want the alias added with
#                    that name (e.g., eth0:0). This will allow the alias to
#                    be displayed with ifconfig. THAT IS THE ONLY USE FOR
#                    THE ALIAS NAME AND IT MAY NOT APPEAR IN ANY OTHER
#                    PLACE IN YOUR SHOREWALL CONFIGURATION.
#
#                    This may be qualified by adding the character
#                    ":" followed by a destination host or subnet.

Note that a colon (":") is required when you qualify the interface
name.

>
> I checked with the 2.4.3 normal release, and the example remains the same
as
> with the Debian package.  Unless this was fixed very recently, I think it
> would be an issue that needs to be addressed globally.

Right....