Re: CONNMARK Target: Not available

Russel
Wed, 08 Feb 2006 16:12:43 -0000

Tom and Fernando are probably both right that it is a waste of time to
work with RH8.  RH8 is about 4 years old by now, so unless you''ve got
something running on your firewall that you can''t move to another
distro, I would dump RH8.

IIRC, FC4 doesn''t support CONNMARK out of the box.  Neither does Debian
3.1.

To get CONNMARK working you''ll have to do a lot of work: install kernel
and iptables sources, install patch-o-matic, run pom to patch the kernel
and iptables sources, configure your kernel to include CONNMARK,
re-compile the kernel, re-compile iptables, install the new kernel, and
install the new iptables.  To complicate things further, your distro may
install iptables in a not-so-standard location, so you may need to
fiddle around to get your new version working.  IMO, all these steps are
much harder than just using a distro that supports CONNMARK out of the
box.  For what it''s worth, I took the hard route and tried FC4 and
Debian 3.1 (neither of which support CONNMARK out of the box).
Eventually I got Debian 3.1 to work, but if I had known that SUSE worked
out of the box, I would have used it from day 1.


RUSSEL RILEY
----- Original Message -----
From: "Tom Eastep" <teastep@shorewall.net>
To: <shorewall-users@lists.sourceforge.net>
Sent: Tuesday, February 07, 2006 8:13 PM
Subject: Re: [Shorewall-users] CONNMARK Target: Not available