On 9/3/12 3:20 PM, Mr Dash Four wrote:
>> 1) This release attempts to alleviate the confustion that results
>> from different usage of the VARDIR name.
> Whenever ${VARLIB} is referenced, there appears to be an extra slash coming
> from somewhere, i.e. /var/lib//firewall (see below for details).
>
>> 2) A new 'stoppedrules' file has been added and the 'routestopped file
>> is now deprecated. See stoppedrules(5) for details.
>
> 1. Stock-supplied "stoppedrules" should be changed:
> Compiling /etc/shorewall/stoppedrules...
> ERROR: Invalid TARGET (FORMAT) /etc/shorewall/stoppedrules (line 12)
>
> This was executed as soon as shorewall was installed.
Remove the FORMAT line.
>
> 2. Either man page not appropriate or the stock-supplied stoppedrules format
> is wrong (I am assuming the man page is correct, so sticking to this format).
> Despite that:
>
> ###############################################################################
> #TARGET SOURCE DEST
> PROTO DEST SOURCE
> #
> PORT(S) PORT(S)
> ACCEPT $FW:+mickey-mouse-port[dst] +mickey-mouse-net tcp
>
> Produces nothing! Also, ipsets - is it supported (I am assuming that it is)?
> So:
>
> [root@test1 shorewall]# shorewall compile
> Compiling...
> Processing /etc/shorewall/params ...
> Processing /etc/shorewall/shorewall.conf...
> Loading Modules...
> Compiling /etc/shorewall/zones...
> Compiling /etc/shorewall/interfaces...
> Determining Hosts in Zones...
> Locating Action Files...
> Compiling /usr/share/shorewall/action.Drop for chain Drop...
> Compiling /usr/share/shorewall/action.Reject for chain Reject...
> Compiling /etc/shorewall/policy...
> Running /etc/shorewall/initdone...
> Adding Anti-smurf Rules
> Compiling TCP Flags filtering...
> Compiling ARP Filtering...
> Compiling Kernel Route Filtering...
> Compiling Martian Logging...
> Compiling /etc/shorewall/tcdevices...
> Compiling /etc/shorewall/tcclasses...
> Compiling /etc/shorewall/tcfilters...
> Compiling /etc/shorewall/tcrules...
> Compiling /etc/shorewall/secmarks...
> Compiling MAC Filtration -- Phase 1...
> Compiling /etc/shorewall/blrules...
> Compiling /etc/shorewall/rules...
> Compiling /etc/shorewall/conntrack...
> Compiling MAC Filtration -- Phase 2...
> Applying Policies...
> Generating Rule Matrix...
> Optimizing Ruleset...
> Creating iptables-restore input...
> Compiling /etc/shorewall/stoppedrules...
> Shorewall configuration compiled to /var/lib//firewall
>
> But, in the produced "/var/lib//firewall" (shouldn't that be
> /var/lib/shorewall/firewall?) there aren't any references to the above rule!
> Indeed when I execute shorewall stop, and then iptables -L -vn, nothing is
> there!
>
>> 3) When the -e option is specified, the current working directory is
>> now included in the CONFIG_PATH.
> [me@test1 dmz]$ shorewall compile -T -p -e
> Compiling...
> Processing /home/me/shorewall/dmz/params ...
> Processing /home/me/shorewall/dmz/shorewall.conf...
> WARNING: Your capabilities file is out of date -- it does not contain all
> of the capabilities defined by Shorewall version 4.5.8-Beta1 at
> /usr/share/perl5/Shorewall/Config.pm line 4015
> Shorewall::Config::read_capabilities() called at
> /usr/share/perl5/Shorewall/Config.pm line 4079
> Shorewall::Config::get_capabilities(1) called at
> /usr/share/perl5/Shorewall/Config.pm line 4319
> Shorewall::Config::get_configuration(1, 0, 0) called at
> /usr/share/perl5/Shorewall/Compiler.pm line 624
> Shorewall::Compiler::compiler('script', '/var/lib//firewall',
> 'directory', ., 'verbosity', 1, 'timestamp', 0, 'debug', ...) called at
> /usr/libexec/shorewall/compiler.pl line 134
> ERROR: Directory /var/lib// is not writable at
> /usr/share/perl5/Shorewall/Config.pm line 1133
> Shorewall::Config::fatal_error('Directory /var/lib// is not writable')
> called at /usr/share/perl5/Shorewall/Config.pm line 1517
> Shorewall::Config::create_temp_script('/var/lib//firewall', 1) called
> at /usr/share/perl5/Shorewall/Compiler.pm line 630
> Shorewall::Compiler::compiler('script', '/var/lib//firewall',
> 'directory', ., 'verbosity', 1, 'timestamp', 0, 'debug', ...) called at
> /usr/libexec/shorewall/compiler.pl line 134
>
I'm not seeing this issue. How did you install? Can I see the
shorewallrc file you used to install?
Thanks,
-Tom
--
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________ Shorewall-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-devel
