similar to: [Fwd: [Shorewall-devel] Getting confused by IPv6 addresses]

10/30/2003 - Shorewall 1.4.8 RC1 Given the small number of new features and the relatively few lines of code that were changed, there will be no Beta for 1.4.8. I am particularly interested in people testing: a) The interface to ''ftwall'' b) Handling of <zone>_frwd chains (those of you who had problems with 1.4.7b or that have reported extra rules in these chains).

Currently at: http://shorewall.net/pub/shorewall/shorewall-1.4.8 ftp://shorewall.net/pub/shorewall/shorewall-1.4.8 Coming soon to a mirror near you. This is a minor release of Shorewall. Problems Corrected since version 1.4.7: 1) Tuomo Soini has supplied a correction to a problem that occurs using some versions of ''ash''. The symptom is that "shorewall start"

This fixes a problem discovered by Antonio Pallua. If ADD_SNAT_ALIASES=Yes, then the following entry in /etc/shorewall/masq generates a startup error: eth0 eth1 212.103.200.20-212.103.200.24 The problem also exists in 1.4.7 Beta 1 -- the ''firewall'' and ''functions'' scripts in CVS correct the problem in that version and I will include the fix in

Hi there, Shorewall 1.4.6b will emit an error message if you configure static NAT entries (in the "nat" file) on an interface that has IPv6 addresses assigned. Here''s the error message from "shorewall restart": [...] Activating Rules... Adding IP Addresses... /usr/share/shorewall/firewall: line 244: 0 | fe80::20d:48ff:fe17:58 : syntax error in expression (error

Carl Raeside wrote: > Tom, > > How is it going? Quick questions. > > 1. the link to the Mandrake rpms seems to not have the shorewall rpm in > it. http://www.monkeynoodle.org/comp/net/shorewall/ > > 2. this link seems to be dead any other sources ? Iproute ? > > Iproute ("ip" utility). The iproute package is included with most > distributions

"Dark Ryder" has reported a bug in Shorewall 1.4.7; this bug is also present in Shorewall 1.4.8. The effect of the bug is that in DNAT rules that specify SNAT, the SNAT address can be effectively ignored in some cases. I have created corrected versions of the ''firewall'' script for both 1.4.7 (based on 1.4.7c) and 1.4.8; these corrections may be downloaded from the

On Tue, 2004-11-30 at 12:17 +0700, Matthew Hodgett wrote: > > As for the 169.254 issue I tried to search the archives but got nothing. > I then tried to search on generic words, nothing. I then tried some > really common words like ''help'', ''initiated'', ''masq'' - nothing. I think > the index might be corrupt because I get no

Ok -- I''m wearing the brown bag tonight (I''ve airmailed one to Tuomas as well :-) ). The IPTABLES patch had some problems when IPTABLES was not set in /etc/shorewall/shorewall.conf. Beta 6 fixes those (I hope) and also corrects a rather obscure problem with "shorewall add" when the "mss" option appears in /etc/shorewall/ipsec. -Tom -- Tom Eastep \

This version: a) Corrects a missing "#" in the rules file. b) Corrects problems in both "shorewall add" and "shorewall delete". Thanks to Stijn Jonker for finding these problems. c) Provides a way to install on Slackware. Thanks to David Fletcher for his help. http://shorewall.net/pub/shorewall/Beta ftp://shorewall.net/pub/shorewall/Beta -Tom -- Tom Eastep \

http://www.shorewall.net/pub/shorewall/3.2/shorewall-3.2.3 ftp://ftp.shorewall.net/pub/shorewall/3.2/shorewall-3.2.3 I''m releasing this now because it corrects a number of important problems. See the attached release notes (both the Shorewall and Shorewall Lite notes are attached). Note: The release notes are compressed so that my total post size is under the list-servers''s

http://www.shorewall.net/pub/shorewall/shorewall-1.4.10d ftp://www.shorewall.net/pub/shorewall/shorewall-1.4.10d This release corrects the problem whereby rules involving user-defined actions often produce a warning. Note that the documentation packages have not been updated for this bugfix release. -Tom -- Tom Eastep \ Nothing is foolproof to a sufficiently talented fool Shoreline, \

On Tue, 2004-11-30 at 12:17 +0700, Matthew Hodgett wrote: > > As for the 169.254 issue I tried to search the archives but got nothing. > I then tried to search on generic words, nothing. I then tried some > really common words like ''help'', ''initiated'', ''masq'' - nothing. I think > the index might be corrupt because I get no

If you encounter strange problems with 2.1.2 and are using a shell other than bash, you might try installing the ''functions'' file from CVS Shorewall2/. It corrects a problem that I ran into with ''ash''. -Tom -- Tom Eastep \ Nothing is foolproof to a sufficiently talented fool Shoreline, \ http://shorewall.net Washington USA \ teastep@shorewall.net

This bugfix release corrects two problems: a) Temporary restore files were not being removed from /var/lib/shorewall. These files have names of the form ''restore-nnnnn''. You can remove files that have accumulated with the command: rm -f /var/lib/shorewall/restore-[0-9]* b) The restore script did not load kernel modules. The result was that after a cold load, applications

And the bugs just keep appearing... FWIW, the changes from 2.0.0 to 2.0.1 are more extensive and more complex than those between 1.4.10 and 2.0.0. This RC corrects two problems: a) The ''routeback'' option in the /etc/shorewall/hosts file had been broken. b) When two bridge ports were assigned to the same zone, Shorewall did not create a rule to allow traffic between the

This bugfix release corrects a problem where the MANGLE_ENABLED variable was being tested before it was set producing the error message: ERROR: Traffic Control requires Mangle The release is available now at: http://shorewall.net/pub/shorewall ftp://shorewall.net/pub/shorewall and will be available at the other download sites shortly. For those who wish to patch your firewall script, save

This version primarily corrects the documentation included in the .tgz and in the .rpm. In addition: 1) (This change is in 1.4.3 but is not documented) If you are running iptables 1.2.7a and kernel 2.4.20, then Shorewall will return reject replies as follows: a) tcp - RST b) udp - ICMP port unreachable c) icmp - ICMP host unreachable d) Otherwise - ICMP host prohibited If you are

My description of the incorrect use of the term ''SNAT'' on the Static NAT Webmin page was apparently misunderstood. Attached is a patch against the Webmin-1.070 Shorewall module that corrects this problem and also adds the ''DNAT-'' action for rules. To apply the patch, you will need the ''patch'' utility: cd <webmin shorewall directory - on

In addition to the Beta 1 content, this version corrects numerous problems with VLAN devices of the form $dev.$vid (e.g., eth0.1). Available from: http://www.shorewall.net/pub/shorewall/Beta ftp://ftp.shorewall.net/pub/shorewall/Beta -Tom -- Tom Eastep \ Shorewall - iptables made easy Shoreline, \ http://www.shorewall.net Washington USA \ teastep@shorewall.net

http://shorewall.net/pub/shorewall/Beta ftp://shorewall.net/pub/shorewall/Beta Problems corrected since RC1: 1) The documentation of the USERSETS column in the rules file has been corrected. 2) If there is no policy defined for the zones specified in a rule, the firewall script previously encountered a shell syntax error: [: NONE: unexpected operator Now, the absence of a