Re: CONNMARK Target: Not available

Jerry Vonau
Wed, 08 Feb 2006 17:38:21 -0000

Russel wrote:
> Tom and Fernando are probably both right that it is a waste of time to
> work with RH8.  RH8 is about 4 years old by now, so unless you''ve
got
> something running on your firewall that you can''t move to another
> distro, I would dump RH8.
How is the 3-in-one working?

My firewalls are very old, P1 233 or less, I don''t recompile anything
if
I don''t have too. ;-)

>
> IIRC, FC4 doesn''t support CONNMARK out of the box.  Neither does
Debian
> 3.1.
>
Sorry Russel, I have to call BS....

Maybe the kernel or iptables that was first installed didn''t have the
support, sorry was abit slow to upgrade to fc4, not totally sure. All
kernels that I have and are later than 2.6.10 do have the support, even
for FC3. See for your self:

[jerry@shore ~]$ locate CONNMARK.ko

/lib/modules/2.6.12-1.1398_FC4/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko
/lib/modules/2.6.10-1.770_FC3/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko
/lib/modules/2.6.11-1.27_FC3/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko
/lib/modules/2.6.12-1.1447_FC4/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko
/lib/modules/2.6.12-1.1456_FC4/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko
/lib/modules/2.6.12-1.1387_FC4/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko
/lib/modules/2.6.13-1.1526_FC4/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko
/lib/modules/2.6.12-1.1390_FC4/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko
/lib/modules/2.6.10-1.770_14.rhfc3.at/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko
/lib/modules/2.6.10-1.766_FC3/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko
/lib/modules/2.6.10-1.760_FC3/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko
/lib/modules/2.6.11-1.14_FC3/kernel/net/ipv4/netfilter/ipt_CONNMARK.ko

You don''t run an un-updated distro do you? The support might just be an
update away.

> To get CONNMARK working you''ll have to do a lot of work: install
kernel
> and iptables sources, install patch-o-matic, run pom to patch the kernel
> and iptables sources, configure your kernel to include CONNMARK,
> re-compile the kernel, re-compile iptables, install the new kernel, and
> install the new iptables.  To complicate things further, your distro may
> install iptables in a not-so-standard location, so you may need to
> fiddle around to get your new version working.  IMO, all these steps are
> much harder than just using a distro that supports CONNMARK out of the
> box.  For what it''s worth, I took the hard route and tried FC4 and
> Debian 3.1 (neither of which support CONNMARK out of the box).
> Eventually I got Debian 3.1 to work, but if I had known that SUSE worked
> out of the box, I would have used it from day 1.
>
>

See above, all I did was a yum update and "poof" instant support.

[root@shore jerry]# /sbin/shorewall show capabilities
Shorewall has detected the following iptables/netfilter capabilities:
    NAT: Available
    Packet Mangling: Available
    Multi-port Match: Available
    Extended Multi-port Match: Available
    Connection Tracking Match: Available
    Packet Type Match: Available
    Policy Match: Not available
    Physdev Match: Available
    IP range Match: Available
    Recent Match: Available
    Owner Match: Available
    Ipset Match: Not available
    CONNMARK Target: Available
    Connmark Match: Available
    Raw Table: Available
    CLASSIFY Target: Available

Jerry