Re: [Shorewall-users] How could I open Port 1701 for VPN l2tp/ipsec

2012-12-31 Thread tony . blue . mailinglist
Am 01.01.2013 03:18, schrieb tony.blue.mailingl...@gmx.de: > Am 31.12.2012 20:39, schrieb Tom Eastep: > With the above Konfigruation I can reach everything in the local network (for example, pick up mail, surf the DMZ) but I can not surf the Internet. The requests are sent, in the syslog is also

Re: [Shorewall-users] How could I open Port 1701 for VPN l2tp/ipsec

2012-12-31 Thread tony . blue . mailinglist
Am 31.12.2012 20:39, schrieb Tom Eastep: > > /etc/shorewall/hosts > #ZONE HOSTS OPTIONS > vpn1 eth0:0.0.0.0/0 > That can't be right -- don't you want ppp0:0.0.0.0/0? > Thank you for this great tip. Now l2tp/ipec gets a connect. >> > /etc/shorewal

Re: [Shorewall-users] How could I open Port 1701 for VPN l2tp/ipsec

2012-12-31 Thread Tom Eastep
On 12/31/12 10:37 AM, tony.blue.mailingl...@gmx.de wrote: > I configured shorewall like the instructiones in > http://www.shorewall.net/IPSEC-2.6.html but it does not run. > > I allways get in /var/log/syslog: > ... > Dec 31 19:08:31 router kernel: [81080.616087] > Shorewall:INPUT:REJECT:IN=ppp

Re: [Shorewall-users] How could I open Port 1701 for VPN l2tp/ipsec

2012-12-31 Thread tony . blue . mailinglist
Hello Mailinglist, I'm stumped. For three days I tried unsuccessfully to get started with L2TP/IPSEC with shorewall. I configured shorewall like the instructiones in http://www.shorewall.net/IPSEC-2.6.html but it does not run. I allways get in /var/log/syslog: ... Dec 31 19:08:31 router kernel

Re: [Shorewall-users] Protecting hosts from each other

2012-12-31 Thread Tom Eastep
On 12/31/2012 09:17 AM, Simon Hobson wrote: > Tom Eastep wrote: > >> In this setup, I would simply set the 'proxyarp' option on all >> interfaces and not worry about entries in /etc/shorewall/proxyarp. > > I have one question here. I use routing entries to direct traffic for > specific IP addres

Re: [Shorewall-users] Protecting hosts from each other

2012-12-31 Thread Simon Hobson
Tom Eastep wrote: >In this setup, I would simply set the 'proxyarp' option on all >interfaces and not worry about entries in /etc/shorewall/proxyarp. I have one question here. I use routing entries to direct traffic for specific IP addresses to the right VLAN, and proxy-arp takes care of the res

Re: [Shorewall-users] Typos in 4.5.11.1?

2012-12-31 Thread Tom Eastep
On 12/31/2012 04:10 AM, Simon Matter wrote: > Hi Tom and all, > > I've just updated a box to 4.5.11.1 and it won't start with > Loading Modules... >ERROR: Invalid modules file entry /usr/share/shorewall/modules.xtables > (line 45) > from /usr/share/shorewall/modules (line 23) > > Looks

Re: [Shorewall-users] Protecting hosts from each other

2012-12-31 Thread Tom Eastep
On 12/31/2012 05:44 AM, Simon Hobson wrote: > "Simon Matter" wrote: > >> I'm not sure I understood exactly but is it so that you'll have one VLAN >> interface per client on the box? If so then I think ISC DHCP will work as >> long as you make it listening on all those interfaces. It will complain

Re: [Shorewall-users] Protecting hosts from each other

2012-12-31 Thread Simon Hobson
"Simon Matter" wrote: >I'm not sure I understood exactly but is it so that you'll have one VLAN >interface per client on the box? If so then I think ISC DHCP will work as >long as you make it listening on all those interfaces. It will complain >about it with "Multiple interfaces match the same bla

[Shorewall-users] Typos in 4.5.11.1?

2012-12-31 Thread Simon Matter
Hi Tom and all, I've just updated a box to 4.5.11.1 and it won't start with Loading Modules... ERROR: Invalid modules file entry /usr/share/shorewall/modules.xtables (line 45) from /usr/share/shorewall/modules (line 23) Looks like this patch is wrong --- shorewall-4.5.11/modules.xtables

Re: [Shorewall-users] Protecting hosts from each other

2012-12-31 Thread Simon Matter
> I've got a project coming up that requires me to protect hosts from each > other within a network. Specifically, we've a class C subnet, and some > addresses are assigned to customers (only a handful) we resell bandwidth > to. At present they are just plugged into our frontend network - not as >