On 12/4/2019 4:58 PM, Vieri Di Paola wrote: > On Wed, Dec 4, 2019 at 4:07 PM Matt Darfeuille <matd...@gmail.com> wrote: >> > >>> b) rsync -a root@$SW_TARGET_SYSTEM_1:/etc/shorewall/ >>> $SW_ADMINISTRATIVE_SYSTEM_TARGET_1_DIR/ >>> >> >> Basically, you need to copy the configuration files from the firewall >> systems to the administrative system. > > OK, I guess I can create a directory anywhere and to my liking, "as > long as I add it in CONFIG_PATH within shorewall.conf in that > directory". Is the second half of my sentence correct? >
Your assumption is correct, however, the following is enough: CONFIG_PATH="/usr/share/shorewall" > >>> 2) on shorewall-lite target system: >>> >>> a) install shorewall-lite (without uninstalling shorewall) >>> >> >> See (1). > > The guide suggests to uninstall shorewall right away. > Here, I'm trying to keep both systems up so I can quickly revert. > >From my point of view, you are out of luck here. >>> b) /usr/share/shorewall-lite/shorecap > /tmp/capabilities >>> rsync -a /tmp/capabilities >>> root@$SW_ADMINISTRATIVE_SYSTEM:$SW_ADMINISTRATIVE_SYSTEM_TARGET_1_DIR/ >>> rm /tmp/capabilities >>> >>> [QUESTION] Is the above destination path correct? >>> >> >> Use 'remote-getrc' to do that. > > Do you mean I should use remote-getcaps from the adminsitrative > system? Isn't remote-getrc for shorewallrc? > Yes my bad, all 'remote-*' commands are to be used on the administrative system exclusively. The command 'remote-getcaps' will capture the capabilities file while 'remote-getrc' will capture 'shorewallrc'. >> >>> d) rsync -a /usr/share/shorewall/shorewallrc >>> root@$SW_ADMINISTRATIVE_SYSTEM:$SW_ADMINISTRATIVE_SYSTEM_TARGET_1_DIR/ >>> [QUESTION] Is this step necessary if I want to compile the firewall >>> script for testing purposes? >>> >> >> This file is required for compilation only. > > So, if I need to compile then can I get it by running remote-getrc > from the administrative system? > Yes, you are correct. >>> 3) on shorewall administrative system: >>> >>> a) >>> cd $SW_ADMINISTRATIVE_SYSTEM_TARGET_1_DIR >>> shorewall -e $SW_ADMINISTRATIVE_SYSTEM_TARGET_1_DIR >>> /tmp/fw_$SW_TARGET_SYSTEM_1 >>> >> >> Shorewall-lite only requires 'firewall' and firewall.conf'. > > OK, but isn't my command generating the same script with a different name? > The following command as non-root user will generate the required files (try, try.conf) that are to be used on the firewall system. /sbin/shorewall compile -e try > As far as EXPORTPARAMS is concerned, I'll leave it undefined. > Can't comment on this. >>> ===== TEST ====== >>> >>> To test the new compiled firewall script: >>> >>> 1) on shorewall administrative system: >>> rsync -a /tmp/fw_$SW_TARGET_SYSTEM_1 root@$SW_TARGET_SYSTEM_1:/tmp/ >>> >> >> See (A) above. > > So I just need to copy over the firewall.conf file as well. > The 'firewall' ('try') and 'firewall.conf' ('try.conf') files are required. >>> PS: >>> 'shorewall remote-getcaps' is the same as using shorecap or as >>> 'shorewall-lite show -f capabilities'? >>> >> >> See (1) -- 'remote-getrc' and 'remote-getcaps' will pull the >> corresponding generated file to the administrative system. > > Yes, but (1) indicates that "unlike the shorecap program, the show > capabilities command shows the kernel's current capabilities; it does > not attempt to load additional kernel modules". That's why I was > asking if remote-getcaps is more like shorecap or more like "show > capabilities". > All 'remote-*' commands invoke 'shorecap'. -Matt -- Matt Darfeuille _______________________________________________ Shorewall-users mailing list Shorewall-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/shorewall-users