Re: [Shorewall-users] regression in 4.5

2013-04-09 Thread Farkas Levente
On 04/09/2013 12:50 AM, Tom Eastep wrote: > On 4/8/13 3:12 PM, "Farkas Levente" wrote: > >> On 04/08/2013 11:59 PM, Tom Eastep wrote: >>> On 4/8/13 11:56 AM, "Farkas Levente" wrote: >>> hi, in a master shorewall-lite setup before 4.5 it was possible to out such a line into params

Re: [Shorewall-users] regression in 4.5

2013-04-09 Thread Farkas Levente
On 04/09/2013 12:41 AM, Tom Eastep wrote: > On 4/8/13 3:11 PM, "Farkas Levente" wrote: > >> On 04/08/2013 11:56 PM, Tom Eastep wrote: >>> On 4/8/13 11:56 AM, "Farkas Levente" wrote: >>> hi, in a master shorewall-lite setup before 4.5 it was possible to out such a line into params

Re: [Shorewall-users] regression in 4.5

2013-04-09 Thread Tom Eastep
On 04/09/2013 06:03 AM, Farkas Levente wrote: > On 04/09/2013 12:50 AM, Tom Eastep wrote: >> On 4/8/13 3:12 PM, "Farkas Levente" wrote: >> >>> On 04/08/2013 11:59 PM, Tom Eastep wrote: On 4/8/13 11:56 AM, "Farkas Levente" wrote: > hi, > in a master shorewall-lite setup before 4.

[Shorewall-users] How to make internal NAT

2013-04-09 Thread Javier Martinez
Hi every one, i have installed Openvpn and shorewall, lastest versions, and all is working fine. It's gratefully to configure access with shorewall. I have a cuestion that i don`t know how to solve. I have a eth8 ( 192.168.3.77/24) in my fw linux box where i have installed Openvpn and Shorewall,

Re: [Shorewall-users] regression in 4.5

2013-04-09 Thread Tom Eastep
On 04/09/2013 06:08 AM, Farkas Levente wrote: > On 04/09/2013 12:41 AM, Tom Eastep wrote: >>> can happened. eg: tos file no longer working as in 4.4. >>> this was my previous tos file: >>> >>> all all tcp - ssh 16 >>> all all tc

Re: [Shorewall-users] regression in 4.5

2013-04-09 Thread Farkas Levente
On 04/09/2013 03:44 PM, Tom Eastep wrote: > On 04/09/2013 06:03 AM, Farkas Levente wrote: >> On 04/09/2013 12:50 AM, Tom Eastep wrote: >>> On 4/8/13 3:12 PM, "Farkas Levente" >>> wrote: >>> On 04/08/2013 11:59 PM, Tom Eastep wrote: > On 4/8/13 11:56 AM, "Farkas Levente" > wrote: >>>

[Shorewall-users] Multi ISP strange behaviour

2013-04-09 Thread Göran Höglund
Hi List, I get a funny problem when I use Multiple ISP setup from the shorewall documentation. I use it for failover between two different carriers. I use lsm as described and are using shorewall version 4.5.5.1 on a centos 6.4 box. My issue is routing, when lsm change to the backup my browsing

Re: [Shorewall-users] regression in 4.5

2013-04-09 Thread Tom Eastep
On 04/09/2013 07:56 AM, Farkas Levente wrote: > On 04/09/2013 03:44 PM, Tom Eastep wrote: >> On 04/09/2013 06:03 AM, Farkas Levente wrote: >>> On 04/09/2013 12:50 AM, Tom Eastep wrote: On 4/8/13 3:12 PM, "Farkas Levente" wrote: > On 04/08/2013 11:59 PM, Tom Eastep wrote: >>

Re: [Shorewall-users] How to make internal NAT

2013-04-09 Thread Roberto C . Sánchez
On Tue, Apr 09, 2013 at 03:46:29PM +0200, Javier Martinez wrote: >Hi every one, i have installed Openvpn�and�shorewall, lastest versions, >and all is working fine. It's gratefully to configure access with >shorewall.� >I have a cuestion that i don`t know how to solve. I have a eth8

[Shorewall-users] MultiISP

2013-04-09 Thread João Alberto Kuchnier
Hi folks! I used Shorewall Multi ISP manual (http://www.shorewall.net/MultiISP.html) to configure a dual link firewall in one of our clients. When the primary link fails, remote conections using the secondary remains working. However, from LAN, they can't access the Internet. It seems like sho

Re: [Shorewall-users] MultiISP

2013-04-09 Thread Tom Eastep
On 4/9/13 12:38 PM, "João Alberto Kuchnier" wrote: >Hi folks! > >I used Shorewall Multi ISP manual >(http://www.shorewall.net/MultiISP.html) to configure a dual link >firewall in one of our clients. When the primary link fails, remote >conections using the secondary remains working. However, from

Re: [Shorewall-users] Multi ISP strange behaviour

2013-04-09 Thread Tom Eastep
On 4/9/13 7:46 AM, "Göran Höglund" wrote: >Hi List, >I get a funny problem when I use Multiple ISP setup from the shorewall >documentation. > >I use it for failover between two different carriers. >I use lsm as described and are using shorewall version 4.5.5.1 on a >centos 6.4 box. > >My issue is

[Shorewall-users] Exporting current rules from Shorewall in dry-run style?

2013-04-09 Thread Ville Walveranta
Is there a way to export the current ruleset from Shorewall in a way that would produce output comparable to iptables-save, without making those rules effective? I know there is "shorewall compile", but the resulting script does not appear to be diff-able (at least in a meaningful way :) with the

Re: [Shorewall-users] regression in 4.5

2013-04-09 Thread Farkas Levente
On 04/09/2013 06:45 PM, Tom Eastep wrote: > On 04/09/2013 07:56 AM, Farkas Levente wrote: >> On 04/09/2013 03:44 PM, Tom Eastep wrote: >>> On 04/09/2013 06:03 AM, Farkas Levente wrote: On 04/09/2013 12:50 AM, Tom Eastep wrote: > On 4/8/13 3:12 PM, "Farkas Levente" > wrote: > >>>

Re: [Shorewall-users] regression in 4.5

2013-04-09 Thread Tom Eastep
On 04/09/2013 02:38 PM, Farkas Levente wrote: > On 04/09/2013 06:45 PM, Tom Eastep wrote: >> >> Do you have a 'cd' command in ../common/params ? > > no. there are only simple ip and hostname constants. > Okay -- please: 1) cd shorewall/host1.example.com 2) sh -x /sbin/shorewall compile -e . fi

Re: [Shorewall-users] Exporting current rules from Shorewall in dry-run style?

2013-04-09 Thread Tom Eastep
On 04/09/2013 02:20 PM, Ville Walveranta wrote: > Is there a way to export the current ruleset from Shorewall in a way > that would produce output comparable to iptables-save, without making > those rules effective? I know there is "shorewall compile", but the > resulting script does not appear to

Re: [Shorewall-users] regression in 4.5

2013-04-09 Thread Tom Eastep
On 4/9/13 3:28 PM, "Farkas Levente" wrote: >On 04/09/2013 11:52 PM, Tom Eastep wrote: >> On 04/09/2013 02:38 PM, Farkas Levente wrote: >>> On 04/09/2013 06:45 PM, Tom Eastep wrote: >> Do you have a 'cd' command in ../common/params ? >>> >>> no. there are only simple ip and hostname con