-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
On 11/29/2016 01:42 AM, [email protected] wrote:
> Hi all,
>
> I use shorewall in a two node active/backup firewall cluster. I
> issue shorewall stop on the inactive node to apply the rules
> described in stoppedrules, just to protect the backup node itself.
> Unfortunately, shorewall stop has the (for me) unwanted side effect
> of enabling routing, i.e. put 1 in /proc/sys/net/ipv4/ip_forward.
> This produces some problems, mainly with proxy arp. I would like to
> ask if there is a builtin way to make shorewall disable routing,
> only when invoked with stop (I am aware of the IP_FORWARDING
> setting which however is not specific fo stop).
>
> Just for completeness, my stoppedrules file lists only rules where
> $FW is the source or the destination. So routing, in my case,
> should not be needed. Maybe I'm using too much fantasy, but I think
> it would be even nicer if routing would be automatically disabled
> in such a situation.
>
Why don't you simply place this in /etc/shorewall/stopped?
echo 0 > /proc/sys/net/ipv4/ip_forward
- -Tom
- --
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: GPGTools - http://gpgtools.org
iQIcBAEBCAAGBQJYPag1AAoJEJbms/JCOk0QS6IQAK16GYq1lZxNpfuIBtKjG08U
5Zqnf6diF8BbRAECXdXJHlq8cSNzMMyKGWjugddlJV70ub7xwYHLtfk0DEb8aBPm
5Ket3WA0FGDjWOi0W3cua11nMYctZUdoLOSdIX+ZOR+/QfPuM9y2WTlZxRp5BbzI
MlpxcdqdEydNepnTj9aNBpXMy/gSbXDavLWpcTh2kr381hvJ8UTE/pdQmOeZicEw
8AN8P7FwJ5FDi8o4zGAv9a5cmmZlNW5CKwvg+5jUlpmzevZYytxV9smkD7iB+k/K
7SCT7PW04DgDwG9/rBxraUhc1ncjRswdmoig7xAIs9CXZIn+eSYLyzlTJ9aPqfd9
yUl/JXPuGcdgHd3yV8yWFthuhdqOt7HyjDHth5Kfo+e61soHDjwqWgDf9CSmwPFV
cj1FeAxO3npFRyoe3Qsq0Zhfd/IcyUpjT6ajsI6PVZYhqXGhc93OPzhdICUrz3kG
wyQG2HUBlj1O3DW+ecf6Oio1YiVFFt+IW2dUFPyLFCEWjuqhfdqryq9JyKNKjtKe
M/hlGFl+i3xUTdRf9KGT99QzkvaEKKPilcppnL5/fu82+f/x/0KE1XY1oxJVj6HS
nKn1zBzZVQi8DV3qH2iYa0vhpClCzgd/gp6a1ByBChKIA4LgiU55Y8E8vbYSUgr8
gIH5PWWZ/dSWnyU5beVs
=buP8
-----END PGP SIGNATURE-----
------------------------------------------------------------------------------
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
