Re: [Shorewall-users] stupid routing question

2013-10-11 Thread Tom Eastep
On 10/11/2013 9:59 AM, Tom Eastep wrote: > On 10/11/2013 4:52 AM, HL wrote: >> In Multi ISP env having a static route on the FW itself impies that the >> remote host is forced to communicate over the same path that the static >> route indicates ?? >> In other words, >> If ip route add 173.194.39

Re: [Shorewall-users] Remapping port below 1024 on the firewall (epilogue)

2013-10-11 Thread johnny bowen
I'm really glad you posted that epilog. I actually woke up this morning thinking about what you might find. Thanks. -- October Webinars: Code for Performance Free Intel webinars can help you accelerate application performa

Re: [Shorewall-users] stupid routing question

2013-10-11 Thread Tom Eastep
On 10/11/2013 4:52 AM, HL wrote: > In Multi ISP env having a static route on the FW itself impies that the > remote host is forced to communicate over the same path that the static > route indicates ?? > In other words, > If ip route add 173.194.39.212/32 via ISP1 is placed on the fw, > and

Re: [Shorewall-users] Remapping port below 1024 on the firewall (epilogue)

2013-10-11 Thread Brian Burch
On 10/10/13 16:19, Brian Burch wrote: > My situation is unconventional, but very similar to the general case. I > have a rogue web client (not sure if it is buggy software or malware) > that occasionally tries to connect to my firewall's snat external ip > address on port 80. The syn's are rejected

[Shorewall-users] stupid routing question

2013-10-11 Thread HL
In Multi ISP env having a static route on the FW itself impies that the remote host is forced to communicate over the same path that the static route indicates ?? In other words, If ip route add 173.194.39.212/32 via ISP1 is placed on the fw, and provided that there is static ip prefix vv.

Re: [Shorewall-users] Remapping port below 1024 on the firewall

2013-10-11 Thread johnny bowen
Glad we could help you. Thanks Dominic, I just had a big "duh" moment regarding original dest. On Oct 11, 2013 12:39 AM, "Brian Burch" wrote: > I'm in the UK and have been asleep, so I apologise if it seems I was > ignoring your suggestions. > > This post should bring everyone up to date, but i

Re: [Shorewall-users] Remapping port below 1024 on the firewall

2013-10-11 Thread Brian Burch
I'm in the UK and have been asleep, so I apologise if it seems I was ignoring your suggestions. This post should bring everyone up to date, but it means I will have to top-post so that my reply makes chronological sense. 1. I've been there before, but I reconfigured like this: REDIRECT