Package: ferm Version: 1.3.1-1 Severity: important Hi
Following line:
proto tcp saddr $DAK dport smtp DNAT to-destination $GOLIATH2;
The important definition is
@def $GOLIATH2 = (213.146.108.162 192.168.10.2);
Old version generates (line-break from me):
iptables -t nat -A PREROUTING -s 213.146.108.164 -p tcp -m tcp --dport smtp \
-j DNAT --to-destination 213.146.108.162 --to-destination 192.168.10.2
new version generates:
iptables -t nat -A PREROUTING -s 213.146.108.164 -p tcp -m tcp --dport smtp \
-j DNAT --to-destination ARRAY(0x90ea00)
Guess what iptables likes more? :)
And the former is actually allowed, see iptables -h:
DNAT v1.3.6 options:
--to-destination <ipaddr>[-<ipaddr>][:port-port]
Address to map destination to.
(You can use this more than once)
--
bye Joerg
Yeah, patching debian/rules sounds like changing shoes while running the
100 meters track.
-- Michael Koch
pgpv5yXJPzHgu.pgp
Description: PGP signature
