Displaying 20 results from an estimated 3000 matches similar to: "Kernel Panic on Masq Enable with Shorewall 4.4.8 & 2.6.27.45-0.1-default #1 SMP"
2009 Aug 12
6
Shorewall (Openswan) IPSEC VPN MASQ Problem
Hi,
I have setup a IPSEC VPN using Openswan to connect a Draytek router to a
CentOS 5.2/Shorewall 4.2.9 firewall. The VPN establishes OK but I''m
getting a problem with packets from the left hand subnet getting
masqueraded rather than routed down the IPSEC VPN as though they were
going out onto the net. I''ve spent the last day searching Google and so
far I''ve hit a
2005 May 26
11
Quick poll: CVS commits
Hi folks,
I''m conducting a straw poll for your opinions on whether we should send
CVS commit logs (probably with diffs) to the shorewall-devel list, or to
another (new) list?
I can see advantages to both ways: separate lists mean that people who
aren''t contributing code don''t get flooded with code noise, but a single
list will help keep everyone involved in the
2012 Mar 12
8
CentOS6/RHEL6 - net.nf_conntrack_max not applied
2005 May 25
5
Patch to fix dynamic add/delete to zone functinality
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I''m running systems with openswan and modified _updown script supporting
shorewall dynamic hosts. Because on problems with cvs head version of
openswan I found a error from shorewall dynamic hosts support. When host
is already in zone shorewall aborts adding process with error. This is
not good thing(tm).
I found out that deleting host from
2004 Feb 11
2
shorewall-docs-html-1.4.10a bugreport
shorewall-docs-html-1.4.10a is missing following files:
Banner.htm
Shorewall_index_frame.htm
seattle_firewall_index.htm
Or there should be different index.htm in tar. There might be other
missing files but that''s what I found out immidiately when I tried to
check local docs.
--
Tuomo Soini <tis@foobar.fi>
Linux and network services
+358 40 5240030
Foobar Oy
2004 Aug 22
6
LAN to DMZ zone issues.
Hello all,
Name is Andrew and in desperate need of some info.
Setup:
- Mandrake 9.1 with three interfaces
(eth0 --> WAN) C-class /28 network (with tree virtual addresses which I
am DNAT-ing to the DMZ)
(eth1 --> LAN) A-class 10.0.0.0/8
(eth2 --> DMZ) A-class subnet 10.1.123.0/24
- Running stock Shorewall ver: shorewall-1.3.14-3.1.91mdk
Dilemma:
- LAN can not access the DMZ zone
2019 May 21
2
How to get original recipient from Postfix when using LMTP?
Many people prefer to use LMTP for delivery from postfix for better
efficiency but X-Original-to header support still missing after many
years. One affect of this is need to set
sieve_vacation_dont_check_recipient = yes which violate Sieve standard
and cause auto-replyies sent to messages that should not happen. Or
abandon LMTP. or abandon postfix??
So while feature request is stalled are
2002 Dec 19
4
Shorewall 1.3.12 Beta1
The first Beta Version is available at:
http://www.shorewall.net/pub/shorewall/Beta
ftp://ftp.shorewall.net/pub/shorewall/Beta
New features include:
1) "shorewall refresh" now reloads the traffic shaping rules (tcrules
and tcstart).
2) "shorewall debug [re]start" now turns off debugging after an error
occurs. This places the point of the failure near the end of the
2002 Sep 29
7
[Fwd: Building custom _updown script for freeswan to make it talk with shorewall]
Tuomo Soini wrote:
> You don''t happen to read shorewall-devel mailinglist ?
I read it -- I just didn''t know what to make of your post and it arrived
while I was on vacation.
What exactly are you trying to accomplish that Shorewall isn''t doing for
you now?
e.g.
/etc/shorewall/zones
rw Roadwarriors Road Warriors
/etc/shorewall/interfraces
rw ipsec+
2003 Jan 26
7
Bug in shorewall
I just added 802.1Q VLAN support to redhat initscripts. And after
support was ready, I tried to restart shorewall. Well it blew into
pieces. Seems like shorewall can''t handle device names like:
eth0.3 very properly. That''s default naming of vlan devices. eth1 is
master device and 3 is id of my test vlan.
So when I added to interfaces line:
home eth0.3 detect
seems like
2005 Jul 04
5
SysV install problem in FC4
After a fresh install, I noticed that shorewall 2.4.0 wasn''t starting
automatically under FC4. The startup script installs properly from the
rpm:
/etc/rc.d/init.d/shorewall
... but the post install "/sbin/chkconfig --add shorewall" produces
this in the runlevel symlink directories:
/etc/rc.d/rc5.d/S-1shorewall
/etc/rc.d/rc0.d/K-1shorewall
/etc/rc.d/rc6.d/K-1shorewall
2003 Jan 06
3
ipsec nat-traversal
It seems to me that ipsecnat tunnel type is not complete.
Latest drafts of ipsec nat-traversal use udp port 4500 for nat-traversal
communications. (It''s called port floating). That is needed to get rid
of ugly ipsec passthru devices.
Now ipsecnat opens port udp/500 from any source port.
And I think ipsecnat won''t work at all with gw zone defined? I''m not
sure about
2003 Oct 08
2
Problem with /bin/ash
I have /bin/ash from rh8 installation and I have following error when I
tried to change using ash instead of sh with shorewall-1.4.7:
+ eval options=$tap0_options
+ options=
+ list_search newnotsyn
+ local e=newnotsyn
+ [ 1 -gt 1 ]
+ return 1
+ run_user_exit newnotsyn
+ find_file newnotsyn
+ [ -n -a -f /newnotsyn ]
+ echo /etc/shorewall/newnotsyn
+ local user_exit=/etc/shorewall/newnotsyn
+ [
2005 May 27
5
Problems with dynamic zones
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I found out problems with dynamic add of hosts to zones. If somebody has
idea how to fix it, please do tell. My head is not working on this on
properly. Hope you get idea from this message. I''m trying to simplify
this as much as possible to get problem clear.
Problem is:
Zones:
vpn
wlan
net
Interfaces:
net eth0
wlan eth1
Policies:
vpn all
2010 May 04
7
Packet Not 100% Received
I have problem with my shorewall. We are now doing some stress test with a http application behind the shorewall. Firstly we send 10.000 requests to a http based application with no firewall. It can received 100% requests. But when we put shorewall in front of it then it stats to loose requests. Is there any packet limitation from shorewall all it''s about conntrack? Thanks for the reply.
2003 Mar 20
11
Opinions Please
Although 1.4 is now released, there is one aspect of Shorewall''s design
that I''m still quite unhappy with. It involves two areas:
a) when and when not to create rules to allow inbound traffic on an
interface to be routed back out that same interface.
b) intrazone traffic.
I''m currently running 1.4.0 plus a change that:
a) Allows intrazone traffic unconditionally --
2023 Mar 20
2
NSD zone file GENERATE directive
On 3/20/23 13:41, Anand Buddhdev via nsd-users wrote:
> Hi Robert,
>
> NSD doesn't understand the GENERATE directive. You'll have to create
> your zone files using a script or template engine.
Understood but certainly not helpful with large dynamic IPv6 PTR's...
Not that dynamic hosts NEED PTR's, but would still be nice to have.
--
inoc.net!rblayzor
XMPP:
2002 Nov 12
3
''all'' in rules file
I have implemented the ability to specify ''all'' in the SOURCE and
DESTINATION columns of the rules file and I''m not sure I like the result.
The code is in CVS if any of you are interested in giving it a try. If you
do try it, please let me know what you think.
If you specify ''all'' in those columns it must not be qualified (may not be
followed by
2011 Jan 07
3
4.4.16 RC 1 Testing Status?
Do those of you who are testing 4.4.16 RC 1 plan to do additional
testing or can we consider 4.4.16 ready for release? Please let me know
by close of business on Tuesday, Jan 11 if you plan additional testing.
Thank you for helping with the testing effort,
-Tom
--
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not
2011 Jan 07
3
4.4.16 RC 1 Testing Status?
Do those of you who are testing 4.4.16 RC 1 plan to do additional
testing or can we consider 4.4.16 ready for release? Please let me know
by close of business on Tuesday, Jan 11 if you plan additional testing.
Thank you for helping with the testing effort,
-Tom
--
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not