Hi all. I use router/firewall based on Centos 6.2 which connected to two ISPs via eth and ppp interfaces. I use shorewall 4.5.4 When i try to enable ISP connected to ppp interface (which was previously disabled by 'shorewall disable ...' command) shorewal shows an error. The piece of trace is here: --- ++ echo ppp0 ++ return + dev=ppp0 + '[' -f /var/lib/shorewall/ppp0_weight ']' ++ cat /var/lib/shorewall/ppp0_weight + weight=4 + route='dev ppp0 weight 4' ******** + run_ip route replace default scope global table 254 dev ppp0 weight 4 nexthop via 81.23.192.113 dev eth1 weight 1 + ip -4 route replace default scope global table 254 dev ppp0 weight 4 nexthop via 81.23.192.113 dev eth1 weight 1 Error: either "to" is duplicate, or "weight" is a garbage. --- iproute needs 'nexthop' keyword before 'dev ppp0'. I wrote a little patch, which works for my case. I hope, i didn't mistake so much. -- Alan. mailto:arj1957@gmail.com ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today''s security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
On 08/15/2012 09:57 PM, Alan Yaryzhenko wrote:> Hi all. > > I use router/firewall based on Centos 6.2 which connected to two ISPs > via eth and ppp interfaces. I use shorewall 4.5.4 > When i try to enable ISP connected to ppp interface (which was > previously disabled by ''shorewall disable ...'' command) shorewal shows > an error. The piece of trace is here: > > --- > ++ echo ppp0 > ++ return > + dev=ppp0 > + ''['' -f /var/lib/shorewall/ppp0_weight '']'' > ++ cat /var/lib/shorewall/ppp0_weight > + weight=4 > + route=''dev ppp0 weight 4'' ******** > + run_ip route replace default scope global table 254 dev ppp0 weight 4 nexthop via 81.23.192.113 dev eth1 weight 1 > + ip -4 route replace default scope global table 254 dev ppp0 weight 4 nexthop via 81.23.192.113 dev eth1 weight 1 > Error: either "to" is duplicate, or "weight" is a garbage. > --- > > iproute needs ''nexthop'' keyword before ''dev ppp0''. > > I wrote a little patch, which works for my case. I hope, i > didn''t mistake so much.Hi Alan, Thanks for the patch. While it works in the particular case that you tried, I don''t think that it works correctly if you try ''shorewall disable eth1; shorewall enable eth1''. Please try the attached alternative patch. Thanks! -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________ ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today''s security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
On Thu, Aug 16, 2012 at 8:53:38 PM, Tom Eastep <teastep@shorewall.net> wrote:> On 08/15/2012 09:57 PM, Alan Yaryzhenko wrote: >> Hi all. >> >> I use router/firewall based on Centos 6.2 which connected to two ISPs >> via eth and ppp interfaces. I use shorewall 4.5.4 >> When i try to enable ISP connected to ppp interface (which was >> previously disabled by 'shorewall disable ...' command) shorewal shows >> an error. The piece of trace is here: >> >> --- >> ++ echo ppp0 >> ++ return >> + dev=ppp0 >> + '[' -f /var/lib/shorewall/ppp0_weight ']' >> ++ cat /var/lib/shorewall/ppp0_weight >> + weight=4 >> + route='dev ppp0 weight 4' ******** >> + run_ip route replace default scope global table 254 dev ppp0 weight 4 nexthop via 81.23.192.113 dev eth1 weight 1 >> + ip -4 route replace default scope global table 254 dev ppp0 weight 4 nexthop via 81.23.192.113 dev eth1 weight 1 >> Error: either "to" is duplicate, or "weight" is a garbage. >> --- >> >> iproute needs 'nexthop' keyword before 'dev ppp0'. >> >> I wrote a little patch, which works for my case. I hope, i >> didn't mistake so much.> Hi Alan,> Thanks for the patch. While it works in the particular case that you > tried, I don't think that it works correctly if you try 'shorewall > disable eth1; shorewall enable eth1'.> Please try the attached alternative patch.> Thanks! > -TomHi Tom, Thanks for your answer. I tested 'enable' and 'disable' commands in Shorewall. They work correctly after patch in all my particular cases: with ppp0 and with eth1 interfaces (the traces are in attach). I tried 'ip route replace' manually and looked for example in LARTC (http://lartc.org/howto/lartc.rpdb.multiple-links.html). 'ip route' command needs 'nexthop' keyword before each part of multipath default route, though in ip manpages 'nexthop' needn't for first part. -- Thanks! Alan ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today''s security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
On 08/22/2012 03:47 AM, Александр Ярыженко wrote:> Thanks for your answer. > I tested 'enable' and 'disable' commands in Shorewall. They work > correctly after patch in all my particular cases: with ppp0 and with > eth1 interfaces (the traces are in attach). I tried 'ip route > replace' manually and looked for example in LARTC > (http://lartc.org/howto/lartc.rpdb.multiple-links.html). > 'ip route' command needs 'nexthop' keyword before each part of > multipath default route, though in ip manpages 'nexthop' needn't for > first part. >Thanks, Alan -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________ ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ Shorewall-users mailing list Shorewall-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/shorewall-users