headers
Galia Lisovskaya | 1 Nov 2008 13:48
Picon

test

test

--

-- 
Best regards,
Galia Lisovskaya.

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
Permalink | Reply | 1 comment |
headers
Galia Lisovskaya | 1 Nov 2008 14:01
Picon

OpenVZ & shorewall. Did'nt work acl based on ip range.

Hello all,

It's my first letter on this list, and, my English is not very well.
Please take me indulgence
for grammar/syntax and over erorrs :))

I have trouble for acl's of ip range. But, acl for one host (with ip
adress) work fine.
Please help me for make work acl/find erorr in acl.

Becouse I'm new shorewall user, I maked test configuration on Virtual
Mashine (VirtualBOX) with bridge network.

Prodaction OVZ server work with iptables, and I'm afraid destroy work
configuration.
Work, but not fine. I want simple create new subnetworks, DMZ and overs.

===========Scheme======================

Host system (simple desktop of Fedora 8 with network bridge and
VirtualBOX) ---> Guest System with openvz kernel ---> some Virtual
Private Servers.

I think, you may forgot about VirtualBOX, but, you need remember about
OpenVZ. Hardware hosts in LAN see virtual OpenVZ? becouse, it use
bridge
with host system, and, VPS servers see also. All work, if whorewall
with virtual OpenVZ disabled.

-------------------Host-system:--------------------------
(Continue reading)

Permalink | Reply | 4 comments |
headers
Erwin Geuens | 1 Nov 2008 14:18
Picon

Re: test

test received :-)

Galia Lisovskaya wrote:
> test
>
>   

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
Permalink | Reply | 0 comments |
headers
Tom Eastep | 1 Nov 2008 15:11
Favicon

Re: OpenVZ & shorewall. Did'nt work acl based on ip range.

Galia Lisovskaya wrote:

> ============Configuration files====================
> 
> root <at> localhost two_work_config_]# cat zones
> ########################zones#######################################################
> #ZONE   TYPE            OPTIONS         IN                      OUT
> #                                       OPTIONS                 OPTIONS
> fw      firewall
> 
> ############ Hardware Local Network ##############
> #local Network interface
> loci     ipv4
> #local network
> loc:loci
> 
> desk1:loc
> ################################################
> 
> ############# Venet Local Network ##############
> #Virtual Interface
> venet      ipv4
> 
> #Virtual network (see hosts file)
> ven1:venet
> 
> #VPS servers
> web1:ven1
> serv2:ven1
> dmz:ven1
(Continue reading)

Permalink | Reply | 3 comments |
headers
Galia Lisovskaya | 1 Nov 2008 17:42
Picon

Re: OpenVZ & shorewall. Did'nt work acl based on ip range.

2008/11/1 Tom Eastep <teastep <at> shorewall.net>:

> The reason that it doesn't work is that 10.0.2.2 is in the serv2 zone.
> And serv2 is a sub-zone of ven1. The policy for desk->serv2 is REJECT.
>
> To make these zone definitions work the way you want them to, you need
> to set IMPLICIT_CONTINUE=Yes in shorewall.conf. That way, if a
> connection doesn't match for one zone that a host is in, it will be
> compared against the rules/policies of the next zone that the host is in.
>
> -Tom

Thanks.
I seted IMPLICIT_CONTINUE=Yes and get, i think. bug of OVZ-kernel:

[root <at> localhost shorewall]# shorewall debug start
Compiling...
Compiling /etc/shorewall/zones...
Compiling /etc/shorewall/interfaces...
Compiling /etc/shorewall/hosts...
Determining Hosts in Zones...
Preprocessing Action Files...
   Pre-processing /usr/share/shorewall/action.Drop...
   Pre-processing /usr/share/shorewall/action.Reject...
Compiling /etc/shorewall/policy...
Compiling Kernel Route Filtering...
Compiling Martian Logging...
Compiling MAC Filtration -- Phase 1...
Generating Transitive Closure of Used-action List...
Processing /usr/share/shorewall/action.Reject for chain Reject...
(Continue reading)

Permalink | Reply | 2 comments |
headers
Tom Eastep | 1 Nov 2008 18:08
Favicon

Re: OpenVZ & shorewall. Did'nt work acl based on ip range.

Galia Lisovskaya wrote:

> Running debug_restore_input...
> iptables v1.3.5: Unknown arg `--src-range'
> Try `iptables -h' or 'iptables --help' for more information.
>    ERROR: Command "/sbin/iptables -A venet0_fwd --src-range
> 10.0.2.1-10.0.2.255 -j ven1_frwd" Failed
> IP Forwarding Enabled

Hmmm -- I see from the dump you sent to support <at> shorewall.net that

	Repeat match: Not available

That is causing Shorewall to generate an invalid rule.

Please do the following:

	shorewall show -f capabilities > /etc/shorewall/caps
	tar -zcf shorewall.tgz /etc/shorewall
	Send shorewall.tgz to support <at> shorewall.net

Thanks,
-Tom
--

-- 
Tom Eastep        \ The ultimate result of shielding men from the
Shoreline,         \ effects of folly is to fill the world with fools.
Washington, USA     \                                 -Herbert Spencer
http://shorewall.net \________________________________________________
(Continue reading)

Permalink | Reply | 1 comment |
headers
Hellmut Tümmler | 1 Nov 2008 19:51
Picon
Favicon

Shorewall bridge setup

Hello everybody,

I need to bridge two different LANs with OpenVPN. According to all I read, both LAN segments need to share the
same subnet. All documentation refers to examples within a /24 network.
As of now my own LAN is 10.10.1.0/24, the opposite side is 10.10.10.0/24.
To prevent the confusion that is preprogrammed by changing all IP numbers in one LAN, would it make sense to
change the netmask on all clients and both gateways' bridges to /16 ? This would put both segmants into the
same subnet, right?
This may be an immense waste of number space, but I doubt that I will run into IP number scarcity in this
private setup :),
Any drawbacks in using such a huge netmask, maybe I miss something obvious here?

Thanks in advance,
Hellmut

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
Permalink | Reply | 1 comment |
headers
Tom Eastep | 1 Nov 2008 21:29
Favicon

Re: OpenVZ & shorewall. Did'nt work acl based on ip range.

Tom Eastep wrote:
> Galia Lisovskaya wrote:
> 
>> Running debug_restore_input...
>> iptables v1.3.5: Unknown arg `--src-range'
>> Try `iptables -h' or 'iptables --help' for more information.
>>    ERROR: Command "/sbin/iptables -A venet0_fwd --src-range
>> 10.0.2.1-10.0.2.255 -j ven1_frwd" Failed
>> IP Forwarding Enabled
> 
> Hmmm -- I see from the dump you sent to support <at> shorewall.net that
> 
> 	Repeat match: Not available
> 
> That is causing Shorewall to generate an invalid rule.
> 
> Please do the following:
> 
> 	shorewall show -f capabilities > /etc/shorewall/caps
> 	tar -zcf shorewall.tgz /etc/shorewall
> 	Send shorewall.tgz to support <at> shorewall.net
> 

Attached is a patch to /usr/share/shorewall-perl/Shorewall/Rules.pm that
should correct the problem.

-Tom
--

-- 
Tom Eastep        \ The ultimate result of shielding men from the
Shoreline,         \ effects of folly is to fill the world with fools.
(Continue reading)

Permalink | Reply | 0 comments |
headers
Tom Eastep | 1 Nov 2008 23:49
Favicon

Re: Shorewall bridge setup

Hellmut Tümmler wrote:

> I need to bridge two different LANs with OpenVPN. According
> to all I read, both LAN segments need to share the same subnet.
> All documentation refers to examples within a /24 network.

> As of now my own LAN is 10.10.1.0/24, the opposite side is 10.10.10.0/24.
> To prevent the confusion that is preprogrammed by changing all IP numbers
> in one LAN, would it make sense to change the netmask on all clients
> and both gateways' bridges to /16 ? This would put both segmants into the
> same subnet, right?

Yes -- but so would /20.

teastep <at> ursa:~/Support/Galia/shorewall$ shorewall ipcalc 10.0.0.0/20
   CIDR=10.0.0.0/20
   NETMASK=255.255.240.0
   NETWORK=10.0.0.0
   BROADCAST=10.0.15.255
teastep <at> ursa:~/Support/Galia/shorewall$

But what applications are you running that require the two LANs to be in
the same broadcast domain? That's the only reason that you would want to
use a bridged configuration rather than a routed one.

-Tom

PS -- is there any way to configure your mailer to fold long lines at
some nice length (74-80)? Each paragraph in your mail is one long line
which makes quoting very inconvenience.
(Continue reading)

Permalink | Reply | 0 comments |
headers
Galia Lisovskaya | 2 Nov 2008 13:49
Picon

Re: OpenVZ & shorewall. Did'nt work acl based on ip range.

Thank you very much, all work!
Is it bug, or else?

I have work configuration with some subnetworks and DMZ,
but, I want make trafic-shaping for some VPS servers and serivices in
VPS servers.

It's new line in Perl compilator did'nt  may intercept for make trafic shaping?

If it's bug, this new line will be include in future release?

And, I want write how-to about OpenVZ and shorewall.
I want know details of  public how-to in wiki openvz.org and wiki shorewall...
In shorewall wiki is documentation on some lagugeges.
I may write how-to on two languge, didn't that?

And, if i remeber true, Tom want edit English version for correct
English syntax and grammar...
Is it true?

2008/11/1 Tom Eastep <teastep <at> shorewall.net>:
> Tom Eastep wrote:

> Attached is a patch to /usr/share/shorewall-perl/Shorewall/Rules.pm that
> should correct the problem.

--
Best regards,
Galia Lisovskaya.
e-mail: inbox <at> shaggy-cat.ru
(Continue reading)

Permalink | Reply | 8 comments |

Gmane