Re: CONNMARK Target: Not available

Russel
Wed, 08 Feb 2006 22:09:51 -0000

Jerry -
The 3-in-1 is working great.  (Mostly thanks to your input.)  I''ve made
some changes and expanded its functionality a bit, but everything is
what I want.  At least everything is good for now.  There are more
future upgrades in the works :-)

>> IIRC, FC4 doesn''t support CONNMARK out of the box.  Neither
does
>> Debian 3.1.
>>
> Sorry Russel, I have to call BS....

I guess I should have been more specific.  By out of the box, I meant
right off the installation CD without any updates.  Also, I have run
mostly just 2.4 kernels (all though I don''t remember why now).

> You don''t run an un-updated distro do you? The support might just
be
> an update away.

I have kept my distro updated (Debian), but using apt instead of yum.
I''m mostly staying in the stable branch for now.

> My firewalls are very old, P1 233 or less, I don''t recompile
anything
> if I don''t have too. ;-)
My firewall is a Celeron 333, so not too fast either.  I used MS Virtual
PC running Debian on my main desktop (Athlon XP 2800+) to re-compile the
kernel for CONNMARK support.  It took a while to setup, but the time I
saved in trying to recompile 5-6 times was well worth it.  If I had it
all to do over, I would definately go for something that didn''t require
re-compiling.

RUSSEL RILEY
----- Original Message -----
From: "Jerry Vonau" <jvonau@shaw.ca>
To: <shorewall-users@lists.sourceforge.net>
Sent: Wednesday, February 08, 2006 10:38 AM
Subject: Re: [Shorewall-users] CONNMARK Target: Not available


> Russel wrote:
>> Tom and Fernando are probably both right that it is a waste of time
>> to work with RH8.  RH8 is about 4 years old by now, so unless
you''ve
>> got something running on your firewall that you can''t move to
another
>> distro, I would dump RH8.
> How is the 3-in-one working?
>
> My firewalls are very old, P1 233 or less, I don''t recompile
anything
> if I don''t have too. ;-)
>
>>
>> IIRC, FC4 doesn''t support CONNMARK out of the box.  Neither
does
>> Debian 3.1.
>>
> Sorry Russel, I have to call BS....
>
> Maybe the kernel or iptables that was first installed didn''t have
the
> support, sorry was abit slow to upgrade to fc4, not totally sure. All
> kernels that I have and are later than 2.6.10 do have the support,
> even for FC3. See for your self:
>
> [jerry@shore ~]$ locate CONNMARK.ko
>
> /lib/modules/2.6.12-1.1398_FC4/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko
> /lib/modules/2.6.10-1.770_FC3/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko
> /lib/modules/2.6.11-1.27_FC3/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko
> /lib/modules/2.6.12-1.1447_FC4/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko
> /lib/modules/2.6.12-1.1456_FC4/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko
> /lib/modules/2.6.12-1.1387_FC4/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko
> /lib/modules/2.6.13-1.1526_FC4/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko
> /lib/modules/2.6.12-1.1390_FC4/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko
>
/lib/modules/2.6.10-1.770_14.rhfc3.at/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko
> /lib/modules/2.6.10-1.766_FC3/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko
> /lib/modules/2.6.10-1.760_FC3/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko
> /lib/modules/2.6.11-1.14_FC3/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko
>
> You don''t run an un-updated distro do you? The support might just
be
> an update away.
>
>> To get CONNMARK working you''ll have to do a lot of work:
install
>> kernel and iptables sources, install patch-o-matic, run pom to patch
>> the kernel and iptables sources, configure your kernel to include
>> CONNMARK, re-compile the kernel, re-compile iptables, install the new
>> kernel, and install the new iptables.  To complicate things further,
>> your distro may install iptables in a not-so-standard location, so
>> you may need to fiddle around to get your new version working.  IMO,
>> all these steps are much harder than just using a distro that
>> supports CONNMARK out of the box.  For what it''s worth, I took
the
>> hard route and tried FC4 and Debian 3.1 (neither of which support
>> CONNMARK out of the box). Eventually I got Debian 3.1 to work, but if
>> I had known that SUSE worked out of the box, I would have used it
>> from day 1.
>>
>>
>
> See above, all I did was a yum update and "poof" instant support.
>
> [root@shore jerry]# /sbin/shorewall show capabilities
> Shorewall has detected the following iptables/netfilter capabilities:
>    NAT: Available
>    Packet Mangling: Available
>    Multi-port Match: Available
>    Extended Multi-port Match: Available
>    Connection Tracking Match: Available
>    Packet Type Match: Available
>    Policy Match: Not available
>    Physdev Match: Available
>    IP range Match: Available
>    Recent Match: Available
>    Owner Match: Available
>    Ipset Match: Not available
>    CONNMARK Target: Available
>    Connmark Match: Available
>    Raw Table: Available
>    CLASSIFY Target: Available
>
> Jerry