> 1) This release attempts to alleviate the confustion that results
> from different usage of the VARDIR name.
Whenever ${VARLIB} is referenced, there appears to be an extra slash coming
from somewhere, i.e. /var/lib//firewall (see below for details).
> 2) A new 'stoppedrules' file has been added and the 'routestopped file
> is now deprecated. See stoppedrules(5) for details.
1. Stock-supplied "stoppedrules" should be changed:
Compiling /etc/shorewall/stoppedrules...
ERROR: Invalid TARGET (FORMAT) /etc/shorewall/stoppedrules (line 12)
This was executed as soon as shorewall was installed.
2. Either man page not appropriate or the stock-supplied stoppedrules format is
wrong (I am assuming the man page is correct, so sticking to this format).
Despite that:
###############################################################################
#TARGET SOURCE DEST PROTO
DEST SOURCE
#
PORT(S) PORT(S)
ACCEPT $FW:+mickey-mouse-port[dst] +mickey-mouse-net tcp
Produces nothing! Also, ipsets - is it supported (I am assuming that it is)? So:
[root@test1 shorewall]# shorewall compile
Compiling...
Processing /etc/shorewall/params ...
Processing /etc/shorewall/shorewall.conf...
Loading Modules...
Compiling /etc/shorewall/zones...
Compiling /etc/shorewall/interfaces...
Determining Hosts in Zones...
Locating Action Files...
Compiling /usr/share/shorewall/action.Drop for chain Drop...
Compiling /usr/share/shorewall/action.Reject for chain Reject...
Compiling /etc/shorewall/policy...
Running /etc/shorewall/initdone...
Adding Anti-smurf Rules
Compiling TCP Flags filtering...
Compiling ARP Filtering...
Compiling Kernel Route Filtering...
Compiling Martian Logging...
Compiling /etc/shorewall/tcdevices...
Compiling /etc/shorewall/tcclasses...
Compiling /etc/shorewall/tcfilters...
Compiling /etc/shorewall/tcrules...
Compiling /etc/shorewall/secmarks...
Compiling MAC Filtration -- Phase 1...
Compiling /etc/shorewall/blrules...
Compiling /etc/shorewall/rules...
Compiling /etc/shorewall/conntrack...
Compiling MAC Filtration -- Phase 2...
Applying Policies...
Generating Rule Matrix...
Optimizing Ruleset...
Creating iptables-restore input...
Compiling /etc/shorewall/stoppedrules...
Shorewall configuration compiled to /var/lib//firewall
But, in the produced "/var/lib//firewall" (shouldn't that be
/var/lib/shorewall/firewall?) there aren't any references to the above rule!
Indeed when I execute shorewall stop, and then iptables -L -vn, nothing is
there!
> 3) When the -e option is specified, the current working directory is
> now included in the CONFIG_PATH.
[me@test1 dmz]$ shorewall compile -T -p -e
Compiling...
Processing /home/me/shorewall/dmz/params ...
Processing /home/me/shorewall/dmz/shorewall.conf...
WARNING: Your capabilities file is out of date -- it does not contain all of
the capabilities defined by Shorewall version 4.5.8-Beta1 at
/usr/share/perl5/Shorewall/Config.pm line 4015
Shorewall::Config::read_capabilities() called at
/usr/share/perl5/Shorewall/Config.pm line 4079
Shorewall::Config::get_capabilities(1) called at
/usr/share/perl5/Shorewall/Config.pm line 4319
Shorewall::Config::get_configuration(1, 0, 0) called at
/usr/share/perl5/Shorewall/Compiler.pm line 624
Shorewall::Compiler::compiler('script', '/var/lib//firewall',
'directory', ., 'verbosity', 1, 'timestamp', 0, 'debug', ...) called at
/usr/libexec/shorewall/compiler.pl line 134
ERROR: Directory /var/lib// is not writable at
/usr/share/perl5/Shorewall/Config.pm line 1133
Shorewall::Config::fatal_error('Directory /var/lib// is not writable')
called at /usr/share/perl5/Shorewall/Config.pm line 1517
Shorewall::Config::create_temp_script('/var/lib//firewall', 1) called
at /usr/share/perl5/Shorewall/Compiler.pm line 630
Shorewall::Compiler::compiler('script', '/var/lib//firewall',
'directory', ., 'verbosity', 1, 'timestamp', 0, 'debug', ...) called at
/usr/libexec/shorewall/compiler.pl line 134
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Shorewall-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-devel
