similar to: IP range Match: Not available

Hi Guys, Good Day! My firewall that running shorewall 3.1.0 was hung due to this problem, I was force to shutdown my server due to the system is not responding. Based on the syslog this is the error: dst cache overflow... Please advice on this... Thanks a lot! Regards, Owel --------------------------------- Yahoo! Mail goes everywhere you do. Get it on

Thankyou the information provided was informative to say the most. Quote "Shorewall Masqurading made simple ?" I will not comment any futher about my simple question as I see nothing but backtracking information. Maybe all the usless information is somthing to do with the below, Linux how it works! First you must remember that 98% of linux programmers are kids or they have been

Hello ! I have a performance issue with Kernel 2.6.X and policy match support as suggested in http://shorewall.net/IPSEC-2.6.html. My IPSEC performance doesn''t exeed about 30kbyte/sec even if my downlink is 1024kbit/sec and should reach more than 100kbyte/sec. No, its not the cpu''s performance (AMD Barton 2500+) and no it''s not the gateway (CELERON 600 Mhz) on the

I would like to add a rule allowing only the address 192.168.150.20 and the range of addresses from 192.169.150.100 to 192.168.150.150 in zone dmz0 to connect to two terminal servers in the local zone. Is there a syntax that can specify a range of addresses in the rules file? Do I have to enter each one separately? -- Stephen Carville Unix and Network Adminstrator DPSI 6033 W.Century Blvd.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 claas@rootdir.de wrote: > Hello, > > > I am trying to get ipsec with kernel 2.6.8.1 and shorewall 2.1.9 running, > but I still have a problem: > > Validating hosts file... > Error: Your kernel and/or iptables does not not support policy match: ipsec > > I had a look for netfilter patch-o-matic, but I did not find the

when i start or restart syslog-ng, i''ve above message. Can this be a shorewall or iptables synchro ? mess-mate -- April 1 This is the day upon which we are reminded of what we are on the other three hundred and sixty-four. -- Mark Twain, "Pudd''nhead Wilson''s Calendar"

I have problem with IP public, my Network configuration [wireless] <------> [Router] <------ > [ Linux proxy ] < ------ > [Client ] IP configuration [202.123.123.1] <------->[202.123.123.2 and 192.168.0.1] < ------ > [192.168.0.2 and 202.123.123.3] < ------ > [202.123.123.4] this configuration will use IP 202.123.123.2 on internet how to config my network

(excuse me for my english) why mark range in tcrules is 1-255 ? iptables support marks > 255. Leandro.

I''m trying to setup Shorewall 2.0.8 with the one-interface settings on my LFS (kernel 2.6.5) system. I''ve read the troubleshooting guide, recompiled my kernel with just about every netfilter/iptables module I could find, but I''m still getting this error: # tail /tmp/trace + prefix=Shorewall:smurfs:DROP: + ''['' 22 -gt 29 '']'' +

Hello Shorewall gurus, as outlined on the shorewall site I have done the following after failure to install shorewall via the rpm: I have read all of the FAQ. I have read the quickstart guide with particular attention directed at the Mandrake solution. I have searched the mailing list archives (all old replies). I have studied the documentation index. I have previous experience using shorewall

Hi, I''ve to restart shorewall when my dynamic IP was changed from my ISP. Of course i can with a shell script do it automatically, but the question is still there.. why ? mess-mate -- "I understand this is your first dead client," Sabian was saying. The absurdity of the statement made me want to laugh but they don''t call me Deadpan

Robin Lynn Frank wrote: > I have an entire /8 blacklisted. The problem is there is a single IP in > it I want to exempt from this. Searching the web site, I note there > used to be (circa version 1.3) a whitelist feature, but I couldn''t find > a simple solution to what I want to do. > > What would be the bes/easiest way to accomplish this? I can''t think of a

Cristian and Alex, Both of you have asked about this. A routing table can only have one default route so when the second link comes up, adding the second default route will fail. So in general, Shorewall can only reliably detect the gateway for P-T-P connections which is what the CVS current code does. -Tom -- Tom Eastep \ Nothing is foolproof to a sufficiently talented fool Shoreline, \

I have had Shorewall 2.0.8 up and running for a month or so. Now I need to change some things around. Currently I am running on a private IP scheme and Shorewall is setup based on the 3 interface guide. Now I want to change to a public scheme on my "loc" zone. I have a /24 block of public IP''s. I need my private scheme and public to co-exist so I currently have is eth1 (local)

I''ve found the below rule, is it possible to use it with shorewall? I see how to setup the timing/rates but how to perform loggin of such action (a separate rule?). as an additional question is i possible to dynamically add hosts to blacklist and persist this between restarts? " SSH -A PREROUTING -m tcp -p tcp -d $EXTERNAL --dport 22 -m recent --rcheck --hitcount 3 --seconds 600 -j

Hi, I''m running RH9 Linux and I''m having a slight problem with shorewall, i originally set it up as a two card configuration, but i have now bridged the connections in an attempt to get my WiFi network communicating with the wired network (eth0 and wlan0). I have followed the instructions for bridging from http://www.shorewall.net/bridge.html but when I activate shorewall i get

Hello All, I am using shorewall 2.0.7. first i give you my config here and will tell you my problem. ProxyARP: 203.77.204.85 eth1 eth0 no Interface: net eth0 203.77.204.87 loc eth1 192.168.0.255 routeback Masq : eth0 192.168.0.0/24 203.77.204.86 Rules: # Squid access REDIRECT loc 8080 tcp

We are using Shorewall 2.0.8 with SuSE 9.1 and have built a bridging firewall primarily to defend against syn flood and smurf DoS attacks. We are a small ISP using Cisco routers for a total of 5-6 subnets. Since bridges are based on use of MAC addresses, if we could use one bridging firewall system instead of 5-6 ... is this possible? practical? (Other than introducing a single point of failure

Tom Eastep wrote: > | Have you applied the ipsec+netfilter patches ? Without them, packets > are > | only seen encrypted in the OUTPUT chain. > | > Yes -- the ipsec+netfilter patches are applied. Here is the same test > with the bridge removed and the local ip address transfered to one of > the network cards: The problem is ipv4_sabotage_out in the briding code. It

I have a few IP addresses attached to an interface without problems. I also have some chrooted environments attached to these IP addresses. Is there a way to make connections (telnet) from these environments look like they are coming from the aliased IP''s rather than the main IP address? Thanks for any help Kevin.