headers
Tom Eastep | 1 Jul 2004 01:21
Favicon

Shorewall 1.4.10g and 2.0.3b

This is a rollup of fixes to two problems introduced in 1.4.10f and 2.0.3a:

1) Shorewall startup failed under Slackware 9.1. According to John Hill, 
this problem can also be corrected by upgrading to mktemp 1.5.

2) Shorewall startup failed if mktemp was not installed.

If you are not experiencing either of these problems then there is no
need to upgrade.

The updates are currently available at:

	http://shorewall.net/pub/shorewall/shorewall-1.4.10g
	ftp://shorewall.net/pub/shorewall/shorewall-1.4.10g

	http://shorewall.net/pub/shorewall/shorewall-2.0.3b
	ftp://shorewall.net/pub/shorewall/shorewall-2.0.3b

-Tom
--

-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep <at> shorewall.net
Permalink | Reply | 0 comments |
headers
Rodolfo J. Paiz | 1 Jul 2004 16:47

Re: more than 3 interfaces

At 05:32 PM 6/29/2004, Tom Eastep wrote:
>Paul Gear wrote:
>>One reason might be that it's cheaper to buy an extra NIC than to buy
>>one NIC & one switch...
>
>In that case, I think I would bridge the NICs rather than make a 
>two-interface zone. In /etc/shorewall/interfaces, associate the zone with 
>the bridge device and specify 'routeback'.

Perhaps it's as simple as that she only has two systems in the DMZ, so as 
Paul suggested two $7 NIC's are cheaper than a $7 NIC and a $25 switch. 
Just a thought.

Cheers,

--

-- 
Rodolfo J. Paiz
rpaiz <at> simpaticus.com
http://www.simpaticus.com
Permalink | Reply | 4 comments |
headers
Tom Eastep | 1 Jul 2004 17:01
Favicon

Re: more than 3 interfaces

Rodolfo J. Paiz wrote:
> At 05:32 PM 6/29/2004, Tom Eastep wrote:
> 
>> Paul Gear wrote:
>>
>>> One reason might be that it's cheaper to buy an extra NIC than to buy
>>> one NIC & one switch...
>>
>>
>> In that case, I think I would bridge the NICs rather than make a 
>> two-interface zone. In /etc/shorewall/interfaces, associate the zone 
>> with the bridge device and specify 'routeback'.
> 
> 
> Perhaps it's as simple as that she only has two systems in the DMZ, so 
> as Paul suggested two $7 NIC's are cheaper than a $7 NIC and a $25 
> switch. Just a thought.
> 

I wasn't disagreeing with Paul's economics -- I simply said that if two 
NICs are used rather than a NIC and a Switch then I would bridge the two 
NICs and put the two DMZ systems in the same network rather than routing 
through the firewall between two different networks. The physical 
diagram is the same but I believe that my way results in a less 
complicated setup.

-Tom
--

-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
(Continue reading)

Permalink | Reply | 3 comments |
headers
Rodolfo J. Paiz | 1 Jul 2004 17:17

Re: more than 3 interfaces

At 09:01 AM 7/1/2004, Tom Eastep wrote:
>I wasn't disagreeing with Paul's economics -- I simply said that if two 
>NICs are used rather than a NIC and a Switch then I would bridge the two 
>NICs and put the two DMZ systems in the same network rather than routing 
>through the firewall between two different networks. The physical diagram 
>is the same but I believe that my way results in a less complicated setup.

I understand better now. My lack of understanding of bridging got in the 
way (since I still don't grok it, but at least can comprehend the idea).

--

-- 
Rodolfo J. Paiz
rpaiz <at> simpaticus.com
http://www.simpaticus.com
Permalink | Reply | 0 comments |
headers
Ian Forbes | 1 Jul 2004 20:24
Picon

Little Kernel 2.6 Ipsec + shorewall problem

Hi

I hope somebody can offer some advice. I have been trying to setup a 
VPN between two sites using IPSEC + shorewall.

Previously I have used 2.4 kernels with freeswan patches. These 
generate an "ipsec0" device. That link is using shorewall version 
1.2.

Now for the new link I am using a late 2.4 kernel from the Debian 
distribution which has native Linux ipsec code backport patches. 
Debian also has a patched version of Freeswan and together I have 
got the VPN setup and running. Shorewall version is 2..0.2f.

Now I want to protect it with shorewall. Both ends of the VPN 
connect to the internet via ADSL. (To complicate things, both ends 
have dynamic IP's. However I already have hacked work arounds for 
this  which I have running on my 'old' 2.4 kernel based VPN for 
some months.)

My setup is based on the document 
http://www.shorewall.net/IPSEC.htm. To sumarise I have:

zones:
net     Net             Internet
loc     Local           Local networks
vpn     VPN             VPN

interfaces:
-       ppp0            "-"             tcpflags
(Continue reading)

Permalink | Reply | 8 comments |
headers
John S. Andersen | 1 Jul 2004 20:29
Picon

Re: more than 3 interfaces

On 1 Jul 2004 at 8:47, Rodolfo J. Paiz wrote:

> At 05:32 PM 6/29/2004, Tom Eastep wrote:
> >Paul Gear wrote:
> >>One reason might be that it's cheaper to buy an extra NIC than to
> >>buy one NIC & one switch...
> >
> >In that case, I think I would bridge the NICs rather than make a
> >two-interface zone. In /etc/shorewall/interfaces, associate the 
zone
> >with the bridge device and specify 'routeback'.
> 
> Perhaps it's as simple as that she only has two systems in the DMZ, 
so
> as Paul suggested two $7 NIC's are cheaper than a $7 NIC and a $25
> switch. Just a thought.
> 
> Cheers,

Not when you throw in two hours of tech time spent batting
this idea around, opening the box, adding a nic, reconfiguring
shorewall, and slapping forehead three months from now when
the third box arrives in the DMZ.  

It seems a penny wize and pound foolish implimentation
to me.  Most folks can scrounge an old 10meg hub.

Spend the $25.

--

--
(Continue reading)

Permalink | Reply | 0 comments |
headers
Jan Kohnert | 1 Jul 2004 20:38
Picon

Question concerning faq2

I have read the faq2 but still have problems:
I have created a dyndns account (jankoh.dyndns.org) and forward www requests 
from our local router to my computer. This works for external computers but 
not for internal (faq2).
I have setup the following rule:
ACCEPT	net	loc:192.168.0.254	tcp	www	-	all
as it is descibed on your website.
It works from outside and not from inside (as expected).
So I tried faq2 but it still does not work...
I want a rule like
ACCEPT	net	loc:192.168.0.254	tcp	www	-	all:192.168.0.1
where 192.168.0.1 is the internal device of our router as it is described in 
faq2 but this doesn't work.
And so I tried faq2b:
(multi for eth1 [loc] is specified anyway)
policy:
loc	loc	ACCEPT
masq:
eth1	192.168.0.0/24
but this one also does not work?!
Did I miss something??? (mostly!!! :-))
What do I have to write in the rules file for 2b (I have dynamic IP so I don't 
know my current IP (or I have to update it every 24h :( ).

Please help!

Thanks Jan

--

-- 
OpenPGP public key available:
(Continue reading)

Permalink | Reply | 9 comments |
headers
Tom Eastep | 1 Jul 2004 20:48
Favicon

Re: Little Kernel 2.6 Ipsec + shorewall problem

Ian Forbes wrote:

> My setup is based on the document 
> http://www.shorewall.net/IPSEC.htm. To sumarise I have:
> 
> zones:
> net     Net             Internet
> loc     Local           Local networks
> vpn     VPN             VPN
> 
> interfaces:
> -       ppp0            "-"             tcpflags
> loc     eth0            detect          dhcp
> 
> hosts:
> vpn             ppp0:192.168.39.0/24
> net             ppp0:0.0.0.0/0
> 
> tunnels:
> ipsec                   net     0.0.0.0/0       vpn
> 
> masq
> ppp0:!192.168.39.0/24   192.168.38.32/27
> 

Why didn't you follow the instructions in that document for configuring 
Shorewall on a 2.6 kernel?

-Tom
--

--
(Continue reading)

Permalink | Reply | 7 comments |
headers
Tom Eastep | 1 Jul 2004 20:52
Favicon

Re: Question concerning faq2

Jan Kohnert wrote:
> I have read the faq2 but still have problems:
> I have created a dyndns account (jankoh.dyndns.org) and forward www requests 
> from our local router to my computer. This works for external computers but 
> not for internal (faq2).
> I have setup the following rule:
> ACCEPT	net	loc:192.168.0.254	tcp	www	-	all

Are you running Shorewall 1.2? The above syntax hasn't been supported 
for a long time.

-Tom
--

-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep <at> shorewall.net
Permalink | Reply | 4 comments |
headers
John S. Andersen | 1 Jul 2004 20:53
Picon

Re: Question concerning faq2

Jan:

Did you miss the "routeback" bit in Faq2?

On 1 Jul 2004 at 20:38, Jan Kohnert wrote:

> I have read the faq2 but still have problems:
> I have created a dyndns account (jankoh.dyndns.org) and forward www
> requests from our local router to my computer. This works for 
external
> computers but not for internal (faq2). I have setup the following
> rule: ACCEPT	net	loc:192.168.0.254	tcp	www	-	all as it is descibed 
on
> your website. It works from outside and not from inside (as 
expected).
> So I tried faq2 but it still does not work... I want a rule like
> ACCEPT	net	loc:192.168.0.254	tcp	www	-	all:192.168.0.1 where
> 192.168.0.1 is the internal device of our router as it is described 
in
> faq2 but this doesn't work. And so I tried faq2b: (multi for eth1
> [loc] is specified anyway) policy: loc	loc	ACCEPT masq:
> eth1	192.168.0.0/24 but this one also does not work?! Did I miss
> something??? (mostly!!! :-)) What do I have to write in the rules 
file
> for 2b (I have dynamic IP so I don't know my current IP (or I have 
to
> update it every 24h :( ).
> 
> Please help!
>
(Continue reading)

Permalink | Reply | 3 comments |

Gmane