Jerry Vonau wrote:
Ok, is been more that a couple of days. ;-) With 4.2, is the reason behind the shorewall test layout, using main 999, is for backwards compatibility?
Yes.
Getting the "squid in loc" to work with "loose" took a bit of effort but that works now. Give me a bit, I'll have some config info that worked for me if you want.
Please -- I haven't tested that configuration.
One a side note: Running /sbin/iptables-restore... iptables-restore v1.4.1.1: host/network `!' not found Error occurred at line: 134 Try `iptables-restore -h' or 'iptables-restore --help' for more information.ERROR: iptables-restore Failed. Input is in /var/lib/shorewall/.iptables-restore-inputLine 134: -A loc2fw -p 6 --dport 8080 -m conntrack --ctorigdst ! 10.3.0.10 -j ACCEPT editing out this line in rules allows a start: REDIRECT loc 8080 tcp 80 - !10.3.0.10 Did I miss something along the journey?
Looks like iptables-restore 1.4.1.1 is broken. That syntax is correct:
/usr/sbin/iptables -m conntrack -h
...
conntrack match v1.4.0 options:
[!] --ctstate [INVALID|ESTABLISHED|NEW|RELATED|UNTRACKED|SNAT|DNAT][,...]
State(s) to match
[!] --ctproto proto Protocol to match; by number or name, eg. `tcp'
--ctorigsrc [!] address[/mask]
Original source specification
--ctorigdst [!] address[/mask] <=====================================
Original destination specification
--ctreplsrc [!] address[/mask]
Reply source specification
--ctrepldst [!] address[/mask]
Reply destination specification
[!] --ctstatus [NONE|EXPECTED|SEEN_REPLY|ASSURED|CONFIRMED][,...]
Status(es) to match
[!] --ctexpire time[:time] Match remaining lifetime in seconds against
value or range of values (inclusive)
and
ursa:~ # iptables -t nat -N foo
ursa:~ # iptables -t nat -A foo -m conntrack --ctorigdst ! 10.1.1.1 -j ACCEPT
ursa:~ # iptables -V
iptables v1.4.0
ursa:~ #
What happens when you try that on your 1.4.1.1?
-Tom
--
Tom Eastep \ Nothing is foolproof to a sufficiently talented fool
Shoreline, \ http://shorewall.net
Washington USA \ [EMAIL PROTECTED]
PGP Public Key \ https://lists.shorewall.net/teastep.pgp.key
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------- Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW! Studies have shown that voting for your favorite open source project, along with a healthy diet, reduces your potential for chronic lameness and boredom. Vote Now at http://www.sourceforge.net/community/cca08
_______________________________________________ Shorewall-users mailing list Shorewall-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/shorewall-users
