similar to: Still struggling with performance issues

I''m re-reading the section on dns names in the shorewall docs: "I personally recommend strongly against using DNS names in Shorewall configuration files. If you use DNS names and you are called out of bed at 2:00AM because Shorewall won''t start as a result of DNS problems then don''t say that you were not forewarned." Having been stung by this a few times

I *think* we are finally making some progress in tracking our elusive performance problems. After employing a second 10Mb link from our ISP, along with another firewall box and proxy, we were able to determine the problem *is* our firewall. We don''t know exactly why yet, but our sporadic slow web access seems to have gone away since swapping a new firewall in this morning. The

I'm building 3.0.14a on Mandrake 10.2, trying to use the same config as my other servers (3.0.11), but ACLs are not working. In checking the outout of smbd -b, I see this line is missing: System Headers: HAVE_SYS_ACL_H .... But I am specifying ./configure --with-acl-support ... Adding an acl using 'setfacl -m 'NTDOMAIN+NTUSER' file does successfully add an ACL for the NT

We have encountered a number of problems with our firewall recently, and the past 24 hours have left me quite concerned. Here is what we are seeing: 1. Original firewall, a PentiumPro/200 with 96Mb RAM, serving approx 500 client PCs for a 10Mb internet connection. Running Mandrake 9.2, we began seeing severe swapping a few weeks, with kernel mem usage exceeding 200Mb. Given an ip_conntrack

In the panic of replacing our firewall(s) earlier in the week, we ended up moving our original shorewall 1.4 config onto a machine with 2.0.10 already installed, overwriting all the 2.0.10 config files. Most things seem to work fine, except for our masq entries. I''ve examined the default 2.0.10 files compared with our 1.4 files, and can''t spot the problem. What am I missing?

I have just completed the installation of a new firewall running Shorewall 1.4 on Mandrake 9.2 for our campus network. It appears to be running fairly well so far, but is generating significantly more log entries than our previous linux 2.0.x firewall... Our previous firewall enjoyed more than 6 years of 24/7 operation with no downtime before we finally decided it needed more horsepower, and

Sorry for the frantic nature of this message, but we need to allow pings on our firewall so our ISP can test things. I''ve done this, and it still doesn''t work: (I am now at v.2.0.10) rules: AllowPing net fw AllowPing sls fw show indicates some matches, so where are they? Chain AllowPing (4 references) pkts bytes target prot opt in out source

I'm sure there is a simple solution to this one... how do I make the printers share go away? I have no printers, and no [printers] section. I tried adding one, and making it browseable=no, but it still appears. This is on v 3.0.11 and 3.0.14a -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Shawn Wright, I.T. Manager Shawnigan Lake School http://www.sls.bc.ca swright@sls.bc.ca

A problem has arisen with the way samba handles file creation dates compared to NT/win2k, which prevents xcopy /d from working correctly. On NT/Win2k, files copied from another NT machine using xcopy end up with the modified dates equal to the original modified date of the file, and the created and accessed dates become the date of the xcopy operation. On Samba, files copied from an NT

I have just upgraded two of our samba boxes to 2.2.8 and ended up with partially broken winbind after the upgrade. The machines are slightly different, and so are the symptoms, so here goes: System 1: Was at 2.2.3 compiled from source Feb4/02, using options: "./configure --with-winbind --with-acl-support --with-quotas". Running on RedHat 7.2, installed from SGI's XFS installer

We are seeing the following in our logs: Nov 25 16:21:41 fw kernel: martian source 139.142.66.253 from 10.0.0.199, on dev eth0 Nov 25 16:21:41 fw kernel: ll header: 00:a0:c9:60:0e:b2:00:02:7e:21:0e:dc:08:00 00:a0:c9:60:0e:b2 is the mac of our firewall interface on IP 139.142.66.253. 00:02:7e:21:0e:dc is the mac of our Cisco router on IP 10.0.0.1 10.0.0.199 is a Cisco switch - we have about

Ok, I''ve flogged this issue probably longer than some of you can stand by now. (remember, I''m the nut trying to use a PPro200 to support ~500 users on a 10Mb internet link :o) To appease those who think I''m nuts, I am ordering a new firewall shortly to allow for future growth. (probably a Dell PE750 with P4/2.8 and dual GE nics.) However, since I have yet to prove

>From: "Shawn Wright" <swright@sls.bc.ca> >Subject: [Shorewall-users] Finally making some progress >I *think* we are finally making some progress in tracking our elusive >performance problems. After employing a second 10Mb link from our ISP, >along with another firewall box and proxy, we were able to determine the >problem *is* our firewall. We don''t

On 11 Aug 2005 at 14:40, samba@lists.samba.org wrote: > Way back on Mar 10 2004, I wrote this: > > ========== > Perhaps this is a known problem, and if so, hopefully it is fixed > in 3.x: > > Win2K SP4 clients, Samba 2.2.8a servers on Linux using ACL > support with > XFS filesystem (Redhat SGI-XFS build, and Mandrake 9.2). > > Adding/editing an ACL for

I just recompiled a plain vanilla 2.4.28 kernel, and used the Shorewall.net kernel config as a guideline. For some reason, I get this: Nov 30 12:05:34 fw shorewall: Shorewall has detected the following iptables/netfilter capabilities: Nov 30 12:05:34 fw shorewall: NAT: Available Nov 30 12:05:34 fw shorewall: Packet Mangling: Available Nov 30 12:05:34 fw shorewall: Multi-port Match:

In the process of migrating file storage from NT to Samba servers, I am running into the following problem. I need a way to allow members of the group specified by file perms to change permissions on the file or dir. Here is the scenario: dir & files are owned by user (id 10634 in this case) group ownership is the nt group "domain admins" (id 10000) drwxrwx--- 4 10634

Has anyone encountered a situation where packets dropped by the newnotsyn chain can result in sporadic browsing problems, slowness, and even timeouts? I noticed that of the 3300 hits for newnotsyn in our current log (6 hours worth), over 2700 of them were to/from our proxy servers. And browsing through them, most *appear* to be otherwise valid packets from remote web servers that would have

Hi to all. I would to ask if there''s way in shorewall that I can be able to check my bandwidth, if im really getting what I paid for. Second, Is there a fast and effective way to implement traffic shaping with shorewall. Many thanks Jan --------------------------------- Yahoo! Messenger - Communicate instantly..."Ping" your friends today! Download Messenger Now

Perhaps this is a known problem, and if so, hopefully it is fixed in 3.x: Win2K SP4 clients, Samba 2.2.8a servers on Linux using ACL support with XFS filesystem (Redhat SGI-XFS build, and Mandrake 9.2). Adding/editing an ACL for an NT domain group to a folder on samba, and attempting to apply permissions to all subdirs and files only goes one level deep when using the win2k standard gui tool.

We've encountered the following problem on our Redhat 7.2/XFS box running samba 2.2.3 with winbind and acl support. This week, some local accounts were created on the samba box for the installation of djb's dnscache. In addition, some NT domain accounts were also created on the NT4 PDC. The samba box is configured to use the NT4 domain for authentication; none of the local accounts