Displaying 20 results from an estimated 10000 matches similar to: "SMB Problem"
2004 Dec 30
12
Multi-Hop VPN Issue looking for Solutions
I''ve just discovered that I do not have access to the remote gateways
for a set of IPsec tunnels to remote networks. This prevents me from
changing the routing table on those gateways.
I need "roadwarrior" systems connecting to me local network using
OpenVPN (tun) to be able to access those systems. Since the remote
gateways don''t know about 10.100.1.0/24, where my
2004 Dec 30
19
OpenVPN tun Interface
I have a zone "rw" defined as tun0 in interfaces.
From that zone, pings to zone "loc" succeed but pings to remote
networks (On IPsec VPNs) are rejected in the all2all chain. From my
point of view, these pings should be in the rw2cctc chain. (rw to cctc
is ACCEPTed in policy.)
I must have a hole in my config, where would it be?
Thanks,
A.
2005 Jan 26
9
Proxy-ARP on Same Segment
I have had to replace an existing setup which has a bunch of IPs
Proxy-NAT''ed onto the loc segment. While I do eventually want to move
them to their own segment, I have to deal with this for the next few weeks.
My problem is that from a loc system I can ping the public IP of a
system being proxy-ARP''d but I can''t hit it via HTTP. Nothing is being
blocked according
2007 Jul 06
8
interop with strongswan / ipsec
I see support in shorewall for the KAME-tools, how about strongswan ?
I have setup shorewall 3.4.4 and strongswan 4.1.3, making this my
vpn-gateway for the subnet behind it.
# Shorewall version 3.4 - Zones File
#ZONE TYPE OPTIONS IN OUT
# OPTIONS OPTIONS
fw firewall
fil ipsec mode=tunnel mss=1400
net ipv4
2004 Dec 19
6
IPSEC vs OpenVPN
While I have concentrated on support for 2.6 native IPSEC in release
2.2.0, I am still of the opinion that unless you absolutely need IPSEC
compatibility that OpenVPN is a much easier (and in the case of
roadwarriors, a much better) solution.
Having already generated all of the required X.509 certificates, it took
me less than 1/2 hr to replace my IPSEC testbed with an OpenVPN one
using the new
2005 Feb 02
1
Shorewall 2.0.16
This release back-ports the DROPINVALID shorewall.conf option from 2.2.0.
1) Recent 2.6 kernels include code that evaluates TCP packets based on
TCP Window analysis. This can cause packets that were previously
classified as NEW or ESTABLISHED to be classified as INVALID.
The new kernel code can be disabled by including this command in
your /etc/shorewall/init file:
echo 1
2005 Jun 29
3
Is Load Balanced VPN possible?
All,
With the dual-ISP support in the latest versions of Shorewall, is it
also possible to setup dual-VPN with something like OpenVPN? If so,
what are the high levels steps that would need to be completed?
Aaron
2004 Dec 08
9
Kernel/iptables question
As suggested here:
http://lists.shorewall.net/pipermail/shorewall-users/2004-October/015097.html
I''ve run:
adam@shrike:~$ /sbin/iptables -m policy --help
iptables v1.2.11
Usage: iptables -[AD] chain rule-specification [options]
iptables -[RI] chain rulenum rule-specification [options]
iptables -D chain rulenum [options]
--snip--
And:
adam@shrike:~$ sudo
2008 May 29
1
shorewall & ipsec rules with "FORWARD:DROP" packets
I have been working really hard configuring and researching very
extensively, trying to figure why we are getting
"Shorewall:FORWARD:DROP" packets. IPSEC works just fine without the
iptable rules created by our shorewall configs but when starting
shorewall and creating the iptables I noticed the packets are dropped.
I know it is a config situation but I am totally racking my brain as
2005 Jun 29
5
Dual-ISP Masq
I know this is a FAQ and that it''s been discussed much before, I''m just
looking for a few key things.
I need to setup our gateway so that traffic FROM a range of IPs is sent
out, masqueraded, via a new cable connection.
I''m running 2.6.9.
Am I going to require any of the CONNMARK patches or other patches from
http://www.ssi.bg/~ja/#routes? I''m really not sure
2004 Oct 31
9
Maquerading through IPSECed wireless dropping packets selectively?
Hello,
I''m stuck IPSECing my wireless network at home and would appreciate any
comments. I appologize in advance if I''m wasting your time with trivia -
I''m not a professional and staring at the problem for days from various
angles hasn''t done me any good ...
My home server/firewall (morannon) is hooked up through an USB to
ethernet adapter (eth1) to my DSL
2005 Feb 05
13
Problem while trying to set up an ipsec vpn
Hi,
I''m asking my question here, because I could not find any answer to my
problem, but I''m affraid shorewall is not the one to blame.
First of all I''m using shorewall version 2.0.15 on two linux box.
I set up an ipsec tunnel beetween those 2 boxes to be ables to connect
2 not routable subnetworks.
Here is my network topology:
10.66.17.0/24 - 10.66.17.1 = eth0
2007 May 25
49
Problem with ssh limit and scp stalling
Hi,
I have a very simple server setup, using shorewall as my firewall. I
have a line like this at the top of my rules file to allow ssh
connections, but limited to 3 connection per minute with a burst rate
of 3:
SSH/ACCEPT net $FW - - -
- 3/min:3 -
Now when I have that in place, and from a remote machine run scp
server:/some/file ., I find
2004 Sep 01
11
IPSEC VPN clients on local network
I have problems connecting IPSEC VPN clients on the masqueraded network
to outside VPN servers.
It looks like this:
ipsec-user
| 192.168.1.10 (DHCP assigned)
|
| 192.168.1.1
fw-1 (shorewall, Linux 2.6)
| 20.20.20.20
(internet)
| 30.30.30.30
fw-2 (IPSEC VPN endpoint)
| 192.168.100.1
|
| 192.168.100.2
server
ipsec-user (a road warrior) is supposed to create an IPSEC tunnel to his
home
2004 Sep 22
3
2.6 kernel ipsec and shorewall
I set up an ipsec/racoon vpn tunnel test environment. The gateway machines
are 192.168.0.30 and 192.168.0.31 on the external adaptor and 10.0.1.1 and
10.0.2.1 internally. The test workstations are 10.0.1.10 and 10.0.2.10.
The tunnel seems to be working as in 10.0.1.10 can talk to 10.0.2.10 an vice
versa and they can both use the net via NAT, however 192.168.0.30 and
192.168.0.31 cannot directly
2007 Aug 24
13
Shorewall 3.4.x - Error when (re) starting - segmentation fault
Shorewall 3.4.6 running on SuSE Linux 10.2
Compiling Rule Activation...
Shorewall configuration compiled to /var/lib/shorewall/.restart
Processing /etc/shorewall/params ...
Restarting Shorewall....
/sbin/shorewall: line 665: 6782 Segmentation fault
$SHOREWALL_SHELL ${VARDIR}/.restart $debugging restart
got this with V3.4.4, updated to 3.4.6 this morning, but that didn''t help.
2007 Jan 05
18
GRE over IPSec VPN
Hey guys I''ve been beating my head on this for a few hours. Maybe it is
just a stupid configuration error you can point me at. First here is a
small diagram of what I am trying to configure:
http://6bit.com/img/netdiag.png Currently I only have Shorewall running on
the host on the right of the diagram until I can get this working then I''ll
add it to the other host as well.
2004 Oct 20
11
Shorewall, Freeswan and SuSE 9.1
I have been using shorewall and freeswan successfully for 3 or more
years now. But they have all been using the Linux 2.4 kernel. My current
configuration is (as the title suggests) using SuSE 9.1 which has a
2.6.5 kernel and freeswan 2.0.4 built-in.
After much reading and a lot of trial and error, I did get this
combination to work with Shorewall 2.0.9. It is happily talking to an
older Mandrake
2008 Jul 07
5
IPSEC tunnel up, but no traffic coming through
Hi all,
I finally got my IPSec tunnel from my Fedora firewall system (running
Shorewall 4.0.6) to a remote Draytek Router up-and-running, but I''m having
difficulties directing traffic through the tunnel. From the output of
"racoon -F -f racoon.conf" and the connection status page of the Draytek I
can tell the tunnel is UP, but ping and traceroute requests to several hosts
2004 Oct 06
7
Re: IPsec problems with tunneled networks
class wrote on 06/10/2004 11:18:48:
> Hello, I have the following situation:
>
> 192.168.176.0/24 ------ A ========== B ------ 192.168.177.0/24
> 192.168.176.2 pop3 ipsec
> racoon
>
>
> policy: (Machine A and B)
> -------
> loc vpn ACCEPT
> vpn loc ACCEPT
> all