On Thu, 7 Jul 2011, Dominic Benson wrote:

> Date: Thu, 7 Jul 2011 00:58:44
> From: Dominic Benson <[email protected]>
> To: Shorewall Users <[email protected]>
> 
> On 7 Jul 2011, at 01:22, Tom Eastep wrote:
>
>> On Jul 6, 2011, at 5:17 PM, J. Randall Owens wrote:
>>>
>>> I don't know about TPROXY in particular, but in most places in shorewall6,
>>> you can enclose the IPv6 addresses (including prefix length) in angle
>>> brackets, like so (all mine are in hosts so far, so these are with
>>> interfaces):
>>> eth0:<2001:470:1::/64,fe80::/10>
>>>
>>> Note that multiple entries are enclosed in one set of brackets, rather
>>> than one pair of brackets per address range.
>>
>> Please also note that <...> is deprecated in favor of the more standard 
>> [...].
>>
>
> Hi Tom,
>
> It's on this page:
> http://docs.huihoo.com/shorewall/4.4/manpages6/shorewall6-tcrules.html
>
> I'm almost sure I originally saw it on shorewall.net, but I certainly don't 
> now. Or even in the shorewall-tcrules page - in fact neither of them seem 
> (currently) to make any mention of TPROXY, although
> http://www.shorewall.net/Shorewall_Squid_Usage.html#TPROXY
> does.
>
> I tried the suggestions about encapsulating the address in square or angle 
> brackets, but I still get the error; I've included it below to be sure we're 
> on the same page.
>
> It certainly *seems* to be working; the local squid is only listening on 
> [::1]:3128 and 127.0.0.1:3128, and if I understand correctly the default 
> would be to use the original source interface. Also, if I remove the 
> interface option it stops working.
>
> Dominic
>
> Jul  7  8:35:59 Compiling /etc/shorewall6/tcrules...
> Jul  7 08:35:59    ERROR: Invalid MARK (TPROXY(10,3128,[::1])) : 
> /etc/shorewall6/tcrules (line 4)
>   ERROR: Invalid MARK (TPROXY(10,3128,[::1])) : /etc/shorewall6/tcrules (line 
> 4)
>
>
> Jul  7  8:37:14 Compiling /etc/shorewall6/tcrules...
> Jul  7 08:37:14    ERROR: Invalid MARK (TPROXY(10,3128,<::1>)) : 
> /etc/shorewall6/tcrules (line 4)
>   ERROR: Invalid MARK (TPROXY(10,3128,<::1>)) : /etc/shorewall6/tcrules (line 
> 4)
>
>
> Jul  7  8:37:40 Compiling /etc/shorewall6/tcrules...
> Jul  7 08:37:40    ERROR: Invalid MARK (TPROXY(10,3128,::1)) : 
> /etc/shorewall6/tcrules (line 4)
>   ERROR: Invalid MARK (TPROXY(10,3128,::1)) : /etc/shorewall6/tcrules (line 4)
>

I don't think you've shown us the actual tcrules line 4, have you?  Does 
it start with "TPROXY(10,3128,::1)" (give or take some brackets) shown in 
the error message?  I don't see anything on the Shorewall Squid page about 
putting an address in the parentheses; it looks like address(es) belong in 
the third and optionally second columns.

If that is where you have the [::1], then we'd need to figure out why it's 
getting lumped in there when it's sent to process_tc_rule or wherever.

-- 
J. Randall Owens | http://www.ghiapet.net/
ProofReading Markup Language | http://prml.sourceforge.net/



------------------------------------------------------------------------------
All of the data generated in your IT infrastructure is seriously valuable.
Why? It contains a definitive record of application performance, security 
threats, fraudulent activity, and more. Splunk takes this data and makes 
sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-d2d-c2
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Reply via email to