similar to: Defining "trusted" hosts/nets on a single interface system

My home lan is 192.168.174.240/29 so that I have 192.168.174.240 as net, 192.168.174.247 as broadcast and space for 6 hosts (have 2 PC and one router). Now I would like to edit the rfc1918 file in order to exclude this range from the list. What is the way to compute the most compact notation to say that only 192.168.0.0-192.168.174.239 and 192.168.174.248-192.168.255.255 are to be discarded

I have defined a Home zone and placed it before the Net zone. Defined a host 192.168.174.242 as a trusted host. Now if I ping from 242 to my fw it works just fine (also tweaked the norfc1918 file). Thing I do not understand is why if I try pinging or FTPing from FW to 242 I hit the all2all reject rule ! I tried reading the rules and from the INPUT chain I see a eth0_in chain which in turn

Believe me: Read the FAQ Checked over and over This might be toooooo stupid to be documented. Please bear with me. Any help ? Situation: single card standalone "firewall" (used like a "personal firewall"). Have sshd running on the FW. Want the sshd daemon to be accessible only from 2 LANs: 1) My other home LAN machine 2) IBM intranet machines (9.0.0.0) Whatever I have

Sorry if this is a stupid question but I tried reading, studying and finding solution but am not making it alone :) On my home lan I have a Linux (Debian sid) box (192.168.174.244) running 3.0.10 samba and cups 1.1.23. My objective is to print from this box to the other home PC which is running XP (192.168.174.242) and sharing an Epson R200 printer. Follows the troubleshooting I could do

Shorewall 1.4.6 is now available. Thanks to Francesca Smith, the 1.4.6 Sample configurations are also available. The release is currently available at: http://shorewall.net/pub/shorewall ftp://shorewall.net/pub/shorewall It will be available at the other mirrors shortly. This is a minor release of Shorewall. Problems Corrected: 1) A problem seen on RH7.3 systems where Shorewall encountered

I am running SELinux in Permissive mode. GNOME and KDE are installed. Following the upgrade from CentOS 5.2 to 5.3 (32 bit) I am getting SELinux messages. Possibly of interest to someone here or upstream? (Since I'm using Permissive mode, this is not a problem for me). If these are known issues, please disregard. Messages follow: (1) SELinux is preventing nm-system-setti (system_dbusd_t)

http://bugzilla.netfilter.org/show_bug.cgi?id=742 Summary: ip6tables "-m iprange" ipv6 range detection Product: netfilter/iptables Version: linux-2.6.x Platform: x86_64 OS/Version: SuSE Linux Status: NEW Severity: critical Priority: P5 Component: ip6_tables (kernel) AssignedTo:

http://bugzilla.netfilter.org/show_bug.cgi?id=639 Summary: iptables iprange Product: iptables Version: unspecified Platform: All OS/Version: All Status: NEW Severity: blocker Priority: P1 Component: iptables AssignedTo: netfilter-buglog at lists.netfilter.org ReportedBy: paulo.santos at

http://bugzilla.netfilter.org/show_bug.cgi?id=711 Summary: iptables -m iprange causes unknown error Product: netfilter/iptables Version: linux-2.6.x Platform: All OS/Version: All Status: NEW Severity: normal Priority: P5 Component: ip_tables (kernel) AssignedTo: netfilter-buglog at

I often find myself doing, whois some.damned.ip.address and then copying and pasting the address range for the miscreant in question, and doing, shorewall iprange x.x.x.x-y.y.y.y with the aim to drop the entire range. My one minor complaint is that I often have to edit out the spaces between the hyphen when copying and pasting the address range returned by whois. I tweaked the shorewall

Changes since Beta 1: Problems Corrected: 1. Corrected a problem in Beta 1 where DNS names containing a "-" were mis-handled when they appeared in the DEST column of a rule. New Features: 1. The limit of 256 addresses for an address range has been removed. Shorewall now decomposes the range into an optimal set of network/host addresses (see also the

Hi all, I was trying to test ROUTE specific code with a multi-isp serviced box. There is a bug somewhere, but I''m not able to understand what the real problem is: when I issue a "shorewall show capabilities" I get: Loading /usr/share/shorewall/functions... Processing /etc/shorewall/params ... Processing /etc/shorewall/shorewall.conf... Loading Modules... Shorewall has

Hello Tom. Sorry, don't answer on my previouse letter, i forget to set subject. I fix this in current. And now about my question. I ask you before about method of stopping RFC1918 traffic on external interface and you advised me follow rule: REJECT! all net:$RFC1918_NETS Can i replace this rule by 'norfc1918' option in 'interfaces' file for this interface?

Perhaps someone can help me understand why this is happening. I''m trying to write a script using ''shorewall iprange'' to parse some ip ranges into subnets so that i can place them into the blocklist. I keep getting an error when i run the script though. Here is the script: #!/bin/csh foreach i (`cat ipranges`) shorewall iprange $i >>

Hello , The folllowing is the error problem: Validating interfaces file... ERROR: The ''norfc1918'' option may not be specified on an interface with an RFC 1918 address. Interface:eth2 The shorewall interface file: net eth2 detect tcpflags,routefilter,norfc1918,nosmurfs,logmartians P.S. I tried to remove norfc1918 from interface

i have no idea how to definie for a parallel zone the host file if the second zone (net) should be the composition of the first zone (dmz). i tried all the following combinations in the interface and host files: interface: - eth0 - (variante 1) - eth0 192.168.0.255,255,255,255,255 (variante 2) - eth0 192.168.0.255,!192.168.0.255 (variante 3)

Hi I know I still need to learn a lot about firewalls so if I''ve missed some doc I should have read don''t hesitate to point it out to me. I have set up shorewall on my desktop and my laptop and everything appears to be working fine but now I''d like to allow certain services (like shh, rsync, unison, http) between these two PC''s. My LAN looks like this:

Hello list!: Well, I was able to install xen 2.0.7 using a 2.4.30 kernel in a domU. The domU have installed gcc3.4 .. after yum -y install compat-gcc* and put CC=gcc33 in all make commands and other changes as here: http://lists.xensource.com/archives/html/xen-users/2005-08/msg00258.html I''m trying to use the iprange match, but every time when I want apply a rule I receives:

https://bugzilla.netfilter.org/show_bug.cgi?id=922 Summary: iprange: --ports is not suppported Product: nftables Version: unspecified Platform: x86_64 OS/Version: Debian GNU/Linux Status: NEW Severity: normal Priority: P5 Component: nft AssignedTo: pablo at netfilter.org ReportedBy: anarey

Hi There, Due to shortage computer, I need to install Apache to my Shorewall box (192.168.1.1) But the real web server is on another box (192.168.1.2) I tried to put rule: DNAT net loc:192.168.168.1 tcp 80 But everytime www connection coming in, it will hit my shorewall Any solution? Cheer Access Yahoo!7 Mail on your mobile. Anytime. Anywhere. Show me how: