Hi everybody,
I have 2 linux servers with 2 installed shorewall.
One shorewall is 4.6.4.3 version (Jessie Debian) and the other installation
is in 5.2.3.4 version (Ubuntu 20.04 LTS).
Shorewall is ok and running on each server :)
I enabled 'BLACKLIST' feature in "blrules" file with an IPSET containing
subnets that I want to blacklist...I exactly have the exactly same
configuration in "blrules" file on each shorewall installation.
BLACKLIST net:+ MYIPSET1 all
BLACKLIST net:+ MYIPSET2 all
BLACKLIST net:+ MYIPSET3 all
BLACKLIST net:+ MYIPSET4 all
=> On 4.6.4.3, when I enter "shorewall show bl" I got an answer with many
lines :
shorewall show bl
Shorewall 4.6.4.3 blacklist chains at zeus.sonixtra.net - jeudi 29 avril
2021, 10:42:07 (UTC+0200)
Chain dynamic (1 references)
pkts bytes target prot opt in out source
destination
Chain net-fw~ (1 references)
pkts bytes target prot opt in out source
destination
620 32800 blacklog all -- * * 0.0.0.0/0
0.0.0.0/0 match-set MYIPSET1 src /* BLACKLIST */
155 7526 blacklog all -- * * 0.0.0.0/0
0.0.0.0/0 match-set MYIPSET2 src /* BLACKLIST */
0 0 blacklog all -- * * 0.0.0.0/0
0.0.0.0/0 match-set MYIPSET3 src /* BLACKLIST */
0 0 blacklog all -- * * 0.0.0.0/0
0.0.0.0/0 match-set MYIPSET4 src /* BLACKLIST */
=> On 5.2.3.4, when I enter "shorewall show bl" I got an empty answer :
shorewall show bl
Shorewall 5.2.3.4 blacklist chains at Stamina-Filer - jeu. 29 avril 2021
11:03:36 CEST
Chain dynamic (4 references)
pkts bytes target prot opt in out source
destination
=> So, if I check in IPTABLES, I got these lines for 4.6.4.3 version :
iptables -L -v | grep blacklog
Chain blacklog (4 references)
892 47437 blacklog all -- any any anywhere
anywhere match-set MYIPSET1 src /* BLACKLIST */
207 10010 blacklog all -- any any anywhere
anywhere match-set MYIPSET2 src /* BLACKLIST */
0 0 blacklog all -- any any anywhere
anywhere match-set MYIPSET3 src /* BLACKLIST */
0 0 blacklog all -- any any anywhere
anywhere match-set MYIPSET4 src /* BLACKLIST */
=> And for 5.2.3.4 version :
iptables -L -v | grep blacklog
Chain blacklog (4 references)
0 0 blacklog all -- any any anywhere
anywhere [goto] match-set MYIPSET1 src
0 0 blacklog all -- any any anywhere
anywhere [goto] match-set MYIPSET2 src
0 0 blacklog all -- any any anywhere
anywhere [goto] match-set MYIPSET3 src
0 0 blacklog all -- any any anywhere
anywhere [goto] match-set MYIPSET4 src
===> So, everything is not as really empty as shown in "shorewall show bl"
...
So, My question is : Why "Shorewall show bl" doesn't give the same result
depends of shorewall version ?
Thanks for your help
Regards :)
Oliver
_______________________________________________
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users
