similar to: masq rules for LVS

Hi, Is it possible to get Shorewall to reload the static blacklist file without resetting the packet and byte counters? I am following the guide at http://mudy.wordpress.com/2009/02/21/shorewall-blacklist-spamhaus-dshield/ to periodically generate a blacklist, but "shorewall -qq refresh -n blacklst" resets all my accounting. Is there a way to do this without resetting the counters? I

Hi all. There is an interesting project that was called opendpi (originally by ipoque GmbH) and recently been forked and maintained by the ntop guys under the nDPI label. It offers a new and currently maintained layer 7 (L7) packet identification library. It could definitely benefit from more eyes and development effort, but at present it gives much better breakdown of traffic for ntop

Hi, I''d like to use the blktap utils from https://github.com/xen-org/blktap because of the mirror feature, as the blktap utils comming with xen does not support this. Could anybody explain why there are two different blktap utils (one in git and one comming with xen source) and how to compile the one from git so that it works with libxl ? Any pointers greatly appreciated ;-) Thanks

Using 10G interfaces on kernel 3.2 + xen 4.1.2 we''re seeing: dom0 ~9.2Gbps domU *~2.5Gbps* dmesg on domU: XENBUS: Device with no driver: device/vif/0 Is this normal? Thanks Kristoffer -- View this message in context: http://xen.1045712.n5.nabble.com/10gig-in-domU-tp5634876p5634876.html Sent from the Xen - User mailing list archive at Nabble.com.

Hi, I''m trying to clarify if it''s at all possible to live resize a disk image. After trying and failing it seems that the reason a disk image cannot be resized - is that domU is only able to detect changes in partitions (eg. partprobe), not in block devices as the xvd driver lacks a rescan feature. My domU sees disk images as blockdevices - that is without a partition table,

Hey guys, I've got another C7 problem I was hoping to solve. I installed appdynamics-php-agent-4.0.5.0-1.x86_64 on a C7.1 host. It's failing to communicate with it's controller on another host. And this is the interesting part. Whether or not I have SELinux enabled, I have apache reporting SELinux problems. [root at web1:~] #getenforce Permissive May 10 20:47:56 web1 python[25735]:

> > If rpm is configured for _that_ location of log files, I would remove the > repository this rpm comes from from configuration and will remember to > never-never ever use that repository for anything. > > Just my $0.02 > Yeah I completely get where you're coming from there. However it's not an RPM from a repo. I downloaded the rpm from the appdynamics site itself.

Well, I was having a heck of a time with the rpm install in terms of customizing the install directory. So I thought the easy way out might be to go for a source install. Which I tried and this was the output from the install: [root at web1:/opt/AppDynamics/appdynamics-php-agent] #./install.sh appd.jokefire.com 443 beta.jokefire.com "Web Front End" web1.jokefire.com Install script for

Hi Tom, Thanks for the feedback about my Shorewall evaluation I''ve published a blog today covering general things I''ve observed about the way to combine Shorewall with strongSwan: http://danielpocock.com/practical-linux-vpns-with-strongswan-shorewall-and-openwrt Please let me know if anything is inaccurate or if there is anything substantial that I missed and I''ll

> > That's a rather odd (personally, I think bad) place for a log (or > even logfile lock) and I'm not at all surprised that selinux is > keeping your application from writing there. I would check to see if > there is a setup/configuration option for your application to put > the log files and related in a more standard location (/var/log, > /var/run), where it is less

Hi, I am trying to do the simplest configuration of traffic shaping. So I did: shorewall.conf TC_ENABLED=Simple tcinterfaces eth0.2 External 500kbit tcdevices eth0.2 500kbit 200kbit And I am testing the speed on that interface - whether I did it ok or not, and my speed is still 4mbit/512kbit. So the question is - How to reduce the speed on interface connected

I''m experiencing a problem with masquerade downloads saturating my internet connection. I''ve implemented an IFB and now am looking into flow keys. Although I''ve read the documentation, I''m not sure I have this right. Can someone help? /etc/shorewall/params: MID_IF=eth0 MID_IF_TC=1 INET1_IF=eth1 INET1_IF_TC=2 INET1_IFB_IF=ifb0 INET1_IFB_TC=3 Note: MID_IF

Hello, running plain samba 3.023c on debian, I'm trying to connect to a samba share from within a stored procedure. This works as long as samba is in "share" mode: [2006/09/29 14:53:01, 5] auth/auth.c:check_ntlm_password(309) check_ntlm_password: guest authentication for user [] -> [] -> [nobody] succeeded When I try to attach samba share manually when logged in as the

Hi, I''ve been successfully using shorewall in our K12 school since the 2.x days initially on Mandrake and now on Debian. Because of that my config has got quite complicated. The firewall has a working MultiISP setup with four interfaces (I''ve renamed them with udev to easy their identification): lan-if, dmz-if, snt-if and dnt-if (one of the providers (the one on dnt-if) is a DSL

Hello, Is it possible to split a port direction so it goes to one server or another? For example, I want abc.com to be routed to server X and def.com to go to server Y. Is it also possible to have e-mail addresses going to one server or another in the same concept so joe@abc.com will to server E and jane@abc.com goes to server F? If any of this is possible, what is the name of the

Hi all, I''m tring to convert some manually written iptables rules into a shorewall configuration but I''m facing some issue with mode statistic. In our outgoing smtp we balance the source IP address of outgoing connections originating from the firewall between 4 alias configured on eth0 interface: eth0 inet addr:xxx.xxx.xxx.18 Bcast:xxx.xxx.xxx.255 Mask:255.255.255.0 eth0:1

hi I''ve got the situation that I have a virtual shorewall firewall/router which will get different single ip''s on one interface in different subnets with different gateways which need to be nat''ed to the inside network. I''d really love to do proxy arp but the provider isn''t able to give me an ip range (cloud computing hooray). If I understand it

I''m attaching a few changes that are specific to Arch Linux and are motivated by our recent switch to systemd. System V init scripts are no longer used/supported on Arch Linux and, therefore, the Arch Linux init scripts can be removed from Shorewall. The two patches that follow are based against master; if it''s possible to apply them to the upcoming Shorewall 4.5.13 as well,

i''m running SW v4.5.14 i''ve created a basic /rules set, referencing a single action: cat /etc/shorewall/rules ############################################################################################################################################### #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS

Hi all I have a CentOS6 box with shorewall-4.5.21. If I have IPSET= in shorewall.conf and I issue the command "shorewall add ppp:192.168.33.3 ptp", I get the error: /usr/share/shorewall/lib.cli: line 585: [: too many arguments ERROR: Zone ptp, interface ppp does not have a dynamic host list The error is corrected setting the actual path to ipset in shorewall.conf, or via the patch: