Hi,
I'm running Slackware 13.37 x86 using Shorewall 4.4.21 with OpenVPN and the
VPN options I'm using in Slackware 13.37 will not work in Shorewall, but in
Slackware 13.1 using the same Shorewall version and files, the 'interfaces',
'policy' and 'zone', are all I have configured, it was working and this also
works in Arch at present too, with the same Shorewall version and files. So
I suspect something to do with Slackware has changed since 13.1 causing this
issue because I tried this out with the default kernel that ships with
Slackware and it still would not work.
For *POLICY* line 1 & 2 if I use it the way you see it below this allows me
to have a connection over eth0 or wlan0. With it like this and I then
connect to OpenVPN, after I'm connected to the VPN, I then comment out line
2 and uncomment line 1, restart shorewall and now the connection stays
routed over the VPN and if the VPN is disconnected for any reason and I try
to get back online with 1 uncommented and 2 commented I can't and this is
the behaviour I'd like to keep.
I'm attaching a dump I did which is 'diff -u' with Arch online with the VPN
running with the policy line 1 uncommented and line 2 commented and working
and the same settings for the policy in Slackware but the VPN connection
won't go online.
Hopefully with the dump.txt someone can tell me why Slackware will not work
with the VPN in the policy line 1 uncommented and line 2 commented....
THANKS
Das
*INTERFACES*
###############################################################################
#ZONE INTERFACE BROADCAST OPTIONS
net eth0 detect dhcp,tcpflags,logmartians,nosmurfs
net wlan0 detect dhcp,tcpflags,logmartians,nosmurfs
# OpenVPN Interface
vpn tun0 detect
vpn tap0 detect
*
POLICY*
###############################################################################
#SOURCE DEST POLICY LOG LIMIT: CONNLIMIT:
# LEVEL BURST MASK
#
# Block this machine from accessing NET ZONE accept for exceptions in
/etc/shorewall/rules
*1. #$FW net DROP info*
# Allow NET Zone when not on VPN - (Allow all connection requests from the
firewall to the Internet)
*2. $FW net ACCEPT
*
# Allow this machine to access the VPN ZONE for everything
$FW vpn ACCEPT
# Block anything from the NET ZONE to all other zones - (Drop (ignore) all
connection requests from the Internet to your firewall)
net all DROP info
# Block from using another connection
net net NONE
#
# The FOLLOWING POLICY MUST BE LAST
#
# Block everything else - (Reject all other connection requests (Shorewall
requires this catchall policy)
all all REJECT info
*ZONE*
###############################################################################
#ZONE TYPE OPTIONS IN OUT
# OPTIONS OPTIONS
fw firewall
net ipv4
#vpn ipsec
vpn ipv4
--- dump_arch.txt 2011-07-20 18:49:40.930264318 -1000
+++ dump.txt 2011-07-20 18:45:03.000000000 -1000
@@ -1,17 +1,17 @@
-Shorewall 4.4.21.1 Dump at arch - Wed Jul 20 18:49:30 HST 2011
+Shorewall 4.4.21 Dump at slackware - Wed Jul 20 18:44:06 HST 2011
-Counters reset Wed Jul 20 18:49:23 HST 2011
+Counters reset Wed Jul 20 18:43:54 HST 2011
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
0 0 dynamic all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID,NEW
- 0 0 eth0_in all -- eth0 * 0.0.0.0/0 0.0.0.0/0
+ 1 97 eth0_in all -- eth0 * 0.0.0.0/0 0.0.0.0/0
0 0 wlan0_in all -- wlan0 * 0.0.0.0/0 0.0.0.0/0
0 0 vpn2fw all -- tun0 * 0.0.0.0/0 0.0.0.0/0
0 0 vpn2fw all -- tap0 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 Reject all -- * * 0.0.0.0/0 0.0.0.0/0
- 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix `Shorewall:INPUT:REJECT:'
+ 0 0 ULOG all -- * * 0.0.0.0/0 0.0.0.0/0
ULOG copy_range 0 nlgroup 1 prefix `Shorewall:INPUT:REJECT:'
queue_threshold 1
0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain FORWARD (policy DROP 0 packets, 0 bytes)
@@ -21,28 +21,28 @@
0 0 vpn_frwd all -- tun0 * 0.0.0.0/0 0.0.0.0/0
0 0 vpn_frwd all -- tap0 * 0.0.0.0/0 0.0.0.0/0
0 0 Reject all -- * * 0.0.0.0/0 0.0.0.0/0
- 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix `Shorewall:FORWARD:REJECT:'
+ 0 0 ULOG all -- * * 0.0.0.0/0 0.0.0.0/0
ULOG copy_range 0 nlgroup 1 prefix `Shorewall:FORWARD:REJECT:'
queue_threshold 1
0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
- 0 0 fw2net all -- * eth0 0.0.0.0/0 0.0.0.0/0
+ 5 333 fw2net all -- * eth0 0.0.0.0/0 0.0.0.0/0
0 0 fw2net all -- * wlan0 0.0.0.0/0 0.0.0.0/0
0 0 fw2vpn all -- * tun0 0.0.0.0/0 0.0.0.0/0
0 0 fw2vpn all -- * tap0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
0 0 Reject all -- * * 0.0.0.0/0 0.0.0.0/0
- 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix `Shorewall:OUTPUT:REJECT:'
+ 0 0 ULOG all -- * * 0.0.0.0/0 0.0.0.0/0
ULOG copy_range 0 nlgroup 1 prefix `Shorewall:OUTPUT:REJECT:'
queue_threshold 1
0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
-Chain Drop (2 references)
+Chain Drop (3 references)
pkts bytes target prot opt in out source
destination
- 0 0 all -- * * 0.0.0.0/0 0.0.0.0/0
+ 4 236 all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 reject tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:113 /* Auth */
- 0 0 dropBcast all -- * * 0.0.0.0/0 0.0.0.0/0
+ 4 236 dropBcast all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
icmp type 3 code 4 /* Needed ICMP types */
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
icmp type 11 /* Needed ICMP types */
- 0 0 dropInvalid all -- * * 0.0.0.0/0
0.0.0.0/0
+ 4 236 dropInvalid all -- * * 0.0.0.0/0
0.0.0.0/0
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
multiport dports 135,445 /* SMB */
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpts:137:139 /* SMB */
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
udp spt:137 dpts:1024:65535 /* SMB */
@@ -97,13 +97,15 @@
0 0 smurfs all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID,NEW
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpts:67:68
0 0 tcpflags tcp -- * * 0.0.0.0/0 0.0.0.0/0
- 0 0 net2fw all -- * * 0.0.0.0/0 0.0.0.0/0
+ 1 97 net2fw all -- * * 0.0.0.0/0 0.0.0.0/0
Chain fw2net (2 references)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp dpts:67:68
- 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
- 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
+ 1 97 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
+ 4 236 Drop all -- * * 0.0.0.0/0 0.0.0.0/0
+ 4 236 ULOG all -- * * 0.0.0.0/0 0.0.0.0/0
ULOG copy_range 0 nlgroup 1 prefix `Shorewall:fw2net:DROP:'
queue_threshold 1
+ 4 236 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain fw2vpn (2 references)
pkts bytes target prot opt in out source
destination
@@ -116,7 +118,7 @@
Chain logflags (5 references)
pkts bytes target prot opt in out source
destination
- 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 4 level 6 prefix `Shorewall:logflags:DROP:'
+ 0 0 ULOG all -- * * 0.0.0.0/0 0.0.0.0/0
ULOG copy_range 0 nlgroup 1 prefix `Shorewall:logflags:DROP:'
queue_threshold 1
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain logreject (0 references)
@@ -125,17 +127,17 @@
Chain net2fw (2 references)
pkts bytes target prot opt in out source
destination
- 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
+ 1 97 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0
tcp dpt:113
0 0 Drop all -- * * 0.0.0.0/0 0.0.0.0/0
- 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix `Shorewall:net2fw:DROP:'
+ 0 0 ULOG all -- * * 0.0.0.0/0 0.0.0.0/0
ULOG copy_range 0 nlgroup 1 prefix `Shorewall:net2fw:DROP:'
queue_threshold 1
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain net2vpn (2 references)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
0 0 Drop all -- * * 0.0.0.0/0 0.0.0.0/0
- 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix `Shorewall:net2vpn:DROP:'
+ 0 0 ULOG all -- * * 0.0.0.0/0 0.0.0.0/0
ULOG copy_range 0 nlgroup 1 prefix `Shorewall:net2vpn:DROP:'
queue_threshold 1
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain net_frwd (2 references)
@@ -155,7 +157,7 @@
Chain sfilter (4 references)
pkts bytes target prot opt in out source
destination
- 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix `Shorewall:sfilter:DROP:'
+ 0 0 ULOG all -- * * 0.0.0.0/0 0.0.0.0/0
ULOG copy_range 0 nlgroup 1 prefix `Shorewall:sfilter:DROP:'
queue_threshold 1
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain shorewall (0 references)
@@ -163,7 +165,7 @@
Chain smurflog (2 references)
pkts bytes target prot opt in out source
destination
- 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix `Shorewall:smurfs:DROP:'
+ 0 0 ULOG all -- * * 0.0.0.0/0 0.0.0.0/0
ULOG copy_range 0 nlgroup 1 prefix `Shorewall:smurfs:DROP:'
queue_threshold 1
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain smurfs (4 references)
@@ -185,14 +187,14 @@
0 0 dynamic all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate INVALID,NEW
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
0 0 Reject all -- * * 0.0.0.0/0 0.0.0.0/0
- 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix `Shorewall:vpn2fw:REJECT:'
+ 0 0 ULOG all -- * * 0.0.0.0/0 0.0.0.0/0
ULOG copy_range 0 nlgroup 1 prefix `Shorewall:vpn2fw:REJECT:'
queue_threshold 1
0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain vpn2net (2 references)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
ctstate RELATED,ESTABLISHED
0 0 Reject all -- * * 0.0.0.0/0 0.0.0.0/0
- 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 6 prefix `Shorewall:vpn2net:REJECT:'
+ 0 0 ULOG all -- * * 0.0.0.0/0 0.0.0.0/0
ULOG copy_range 0 nlgroup 1 prefix `Shorewall:vpn2net:REJECT:'
queue_threshold 1
0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0
[goto]
Chain vpn_frwd (2 references)
@@ -221,7 +223,7 @@
0 0 tcpflags tcp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 net2fw all -- * * 0.0.0.0/0 0.0.0.0/0
-Log (/var/log/shorewall)
+Log (/var/log/shorewall-init.log)
NAT Table
@@ -232,7 +234,7 @@
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
-Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
+Chain OUTPUT (policy ACCEPT 4 packets, 236 bytes)
pkts bytes target prot opt in out source
destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
@@ -240,26 +242,26 @@
Mangle Table
-Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
+Chain PREROUTING (policy ACCEPT 1 packets, 97 bytes)
pkts bytes target prot opt in out source
destination
- 0 0 tcpre all -- * * 0.0.0.0/0 0.0.0.0/0
+ 1 97 tcpre all -- * * 0.0.0.0/0 0.0.0.0/0
-Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
+Chain INPUT (policy ACCEPT 1 packets, 97 bytes)
pkts bytes target prot opt in out source
destination
- 0 0 tcin all -- * * 0.0.0.0/0 0.0.0.0/0
+ 1 97 tcin all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
0 0 MARK all -- * * 0.0.0.0/0 0.0.0.0/0
MARK and 0xffffff00
0 0 tcfor all -- * * 0.0.0.0/0 0.0.0.0/0
-Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
+Chain OUTPUT (policy ACCEPT 5 packets, 333 bytes)
pkts bytes target prot opt in out source
destination
- 0 0 tcout all -- * * 0.0.0.0/0 0.0.0.0/0
+ 5 333 tcout all -- * * 0.0.0.0/0 0.0.0.0/0
-Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
+Chain POSTROUTING (policy ACCEPT 1 packets, 97 bytes)
pkts bytes target prot opt in out source
destination
- 0 0 tcpost all -- * * 0.0.0.0/0 0.0.0.0/0
+ 1 97 tcpost all -- * * 0.0.0.0/0 0.0.0.0/0
Chain tcfor (1 references)
pkts bytes target prot opt in out source
destination
@@ -278,21 +280,24 @@
Raw Table
-Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
+Chain PREROUTING (policy ACCEPT 1 packets, 97 bytes)
pkts bytes target prot opt in out source
destination
-Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
+Chain OUTPUT (policy ACCEPT 5 packets, 333 bytes)
pkts bytes target prot opt in out source
destination
-Conntrack Table (0 out of 65536)
+Conntrack Table (1 out of 65536)
+udp 17 176 src=192.168.1.8 dst=94.231.84.82 sport=54172 dport=1194
src=94.231.84.82 dst=192.168.1.8 sport=1194 dport=54172 [ASSURED] mark=0 use=2
IP Configuration
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
inet 127.0.0.1/8 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP
qlen 1000
- inet 192.168.1.3/24 brd 192.168.1.255 scope global eth0
+ inet 192.168.1.8/24 brd 192.168.1.255 scope global eth0
+4: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast
state UNKNOWN qlen 100
+ inet 10.235.0.151/16 brd 10.235.255.255 scope global tun0
IP Stats
@@ -303,11 +308,23 @@
TX: bytes packets errors dropped carrier collsns
0 0 0 0 0 0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP
qlen 1000
- link/ether 00:17:31:cd:68:16 brd ff:ff:ff:ff:ff:ff
+ link/ether 00:07:03:1b:d2:1d brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
- 2724035 7424 0 1138 0 0
+ 308062 537 0 0 0 0
TX: bytes packets errors dropped carrier collsns
- 889521 5009 0 0 0 0
+ 80106 538 0 0 1 0
+3: wlan0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN
qlen 1000
+ link/ether 0c:60:76:51:82:c2 brd ff:ff:ff:ff:ff:ff
+ RX: bytes packets errors dropped overrun mcast
+ 0 0 0 0 0 0
+ TX: bytes packets errors dropped carrier collsns
+ 0 0 0 0 0 0
+4: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast
state UNKNOWN qlen 100
+ link/none
+ RX: bytes packets errors dropped overrun mcast
+ 247290 253 0 0 0 0
+ TX: bytes packets errors dropped carrier collsns
+ 30450 273 0 0 0 0
Per-IP Counters
@@ -315,7 +332,7 @@
/proc
- /proc/version = Linux version 2.6.39-ARCH (thomas@evey) (gcc version 4.6.1
(GCC) ) #1 SMP PREEMPT Sat Jul 9 15:31:04 CEST 2011
+ /proc/version = Linux version 2.6.36.4 (root@slackware) (gcc version 4.5.2
(GCC) ) #7 PREEMPT Wed Jul 20 17:51:07 HST 2011
/proc/sys/net/ipv4/ip_forward = 1
/proc/sys/net/ipv4/icmp_echo_ignore_all = 0
/proc/sys/net/ipv4/conf/all/proxy_arp = 0
@@ -338,31 +355,26 @@
/proc/sys/net/ipv4/conf/lo/arp_ignore = 0
/proc/sys/net/ipv4/conf/lo/rp_filter = 0
/proc/sys/net/ipv4/conf/lo/log_martians = 1
-
-Routing Rules
-
-0: from all lookup local
-32766: from all lookup main
-32767: from all lookup default
-
-Table default:
-
-
-Table local:
-
-broadcast 127.0.0.0 dev lo proto kernel scope link src 127.0.0.1
-local 127.0.0.0/8 dev lo proto kernel scope host src 127.0.0.1
-local 127.0.0.1 dev lo proto kernel scope host src 127.0.0.1
-broadcast 127.255.255.255 dev lo proto kernel scope link src 127.0.0.1
-broadcast 192.168.1.0 dev eth0 proto kernel scope link src 192.168.1.3
-local 192.168.1.3 dev eth0 proto kernel scope host src 192.168.1.3
-broadcast 192.168.1.255 dev eth0 proto kernel scope link src 192.168.1.3
-
-Table main:
-
+ /proc/sys/net/ipv4/conf/tun0/proxy_arp = 0
+ /proc/sys/net/ipv4/conf/tun0/arp_filter = 0
+ /proc/sys/net/ipv4/conf/tun0/arp_ignore = 0
+ /proc/sys/net/ipv4/conf/tun0/rp_filter = 0
+ /proc/sys/net/ipv4/conf/tun0/log_martians = 1
+ /proc/sys/net/ipv4/conf/wlan0/proxy_arp = 0
+ /proc/sys/net/ipv4/conf/wlan0/arp_filter = 0
+ /proc/sys/net/ipv4/conf/wlan0/arp_ignore = 0
+ /proc/sys/net/ipv4/conf/wlan0/rp_filter = 0
+ /proc/sys/net/ipv4/conf/wlan0/log_martians = 1
+
+Routing Table
+
+94.231.84.82 via 192.168.1.1 dev eth0
+192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.8 metric 202
+10.235.0.0/16 dev tun0 proto kernel scope link src 10.235.0.151
+127.0.0.0/8 dev lo scope link
+0.0.0.0/1 via 10.235.0.1 dev tun0
+128.0.0.0/1 via 10.235.0.1 dev tun0
default via 192.168.1.1 dev eth0 metric 202
-94.231.84.81 via 192.168.1.1 dev eth0
-192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.3 metric 202
ARP
@@ -370,23 +382,40 @@
Modules
-iptable_filter 1100 1
-iptable_mangle 1228 1
-iptable_nat 3364 0
-iptable_raw 1024 0
-ip_tables 9186 4
iptable_nat,iptable_raw,iptable_mangle,iptable_filter
-ipt_LOG 6518 10
-ipt_REJECT 1997 4
-nf_conntrack 50208 4
iptable_nat,nf_nat,nf_conntrack_ipv4,xt_conntrack
-nf_conntrack_ipv4 9601 21 iptable_nat,nf_nat
-nf_defrag_ipv4 1023 1 nf_conntrack_ipv4
-nf_nat 12413 1 iptable_nat
-xt_addrtype 2393 3
-xt_comment 687 18
-xt_conntrack 2653 18
-xt_mark 897 1
-xt_multiport 1498 4
-xt_tcpudp 1883 20
+ip_tables 7946 4
iptable_nat,iptable_raw,iptable_mangle,iptable_filter
+ipt_LOG 3698 0
+ipt_REJECT 1570 4
+ipt_ULOG 3833 12
+ipt_addrtype 1401 3
+iptable_filter 1012 1
+iptable_mangle 1100 1
+iptable_nat 2928 0
+iptable_raw 924 0
+nf_conntrack 38356 19
iptable_nat,xt_conntrack,nf_nat_tftp,nf_nat_snmp_basic,nf_nat_pptp,nf_nat_irc,nf_nat_h323,nf_nat_ftp,nf_nat,nf_conntrack_ipv4,nf_conntrack_tftp,nf_conntrack_proto_sctp,nf_conntrack_pptp,nf_conntrack_proto_gre,nf_conntrack_netlink,nf_conntrack_netbios_ns,nf_conntrack_irc,nf_conntrack_h323,nf_conntrack_ftp
+nf_conntrack_ftp 4121 1 nf_nat_ftp
+nf_conntrack_h323 30773 1 nf_nat_h323
+nf_conntrack_ipv4 8182 21 iptable_nat,nf_nat
+nf_conntrack_irc 2403 1 nf_nat_irc
+nf_conntrack_netbios_ns 970 0
+nf_conntrack_netlink 10514 0
+nf_conntrack_pptp 3357 1 nf_nat_pptp
+nf_conntrack_proto_gre 2932 1 nf_conntrack_pptp
+nf_conntrack_proto_sctp 4885 0
+nf_conntrack_tftp 2369 1 nf_nat_tftp
+nf_defrag_ipv4 903 1 nf_conntrack_ipv4
+nf_nat 11396 7
iptable_nat,nf_nat_tftp,nf_nat_pptp,nf_nat_proto_gre,nf_nat_irc,nf_nat_h323,nf_nat_ftp
+nf_nat_ftp 1136 0
+nf_nat_h323 4346 0
+nf_nat_irc 958 0
+nf_nat_pptp 1699 0
+nf_nat_proto_gre 913 1 nf_nat_pptp
+nf_nat_snmp_basic 6363 0
+nf_nat_tftp 642 0
+xt_comment 615 18
+xt_conntrack 1953 18
+xt_mark 785 1
+xt_multiport 1264 4
+xt_tcpudp 1738 20
Shorewall has detected the following iptables/netfilter capabilities:
NAT: Available
@@ -397,8 +426,8 @@
Extended Connection Tracking Match Support: Available
Packet Type Match: Available
Policy Match: Available
- Physdev Match: Available
- Physdev-is-bridged Support: Available
+ Physdev Match: Not available
+ Physdev-is-bridged Support: Not available
Packet length Match: Available
IP range Match: Available
Recent Match: Available
@@ -441,12 +470,39 @@
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
PID/Program name
+tcp 0 0 0.0.0.0:6000 0.0.0.0:* LISTEN
1939/X
+tcp 0 0 :::6000 :::* LISTEN
1939/X
+udp 0 0 0.0.0.0:54172 0.0.0.0:*
2047/openvpn
Traffic Control
Device eth0:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1
1 1
- Sent 864793 bytes 5009 pkt (dropped 0, overlimits 0 requeues 0)
+ Sent 79364 bytes 538 pkt (dropped 0, overlimits 0 requeues 0)
+ backlog 0b 0p requeues 0
+
+
+Device wlan0:
+qdisc mq 0: root
+ Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
+ backlog 0b 0p requeues 0
+
+class mq :1 root
+ Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
+ backlog 0b 0p requeues 0
+class mq :2 root
+ Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
+ backlog 0b 0p requeues 0
+class mq :3 root
+ Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
+ backlog 0b 0p requeues 0
+class mq :4 root
+ Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
+ backlog 0b 0p requeues 0
+
+Device tun0:
+qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1
1 1
+ Sent 30450 bytes 273 pkt (dropped 0, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
@@ -455,3 +511,7 @@
Device eth0:
+Device wlan0:
+
+Device tun0:
+
------------------------------------------------------------------------------
5 Ways to Improve & Secure Unified Communications
Unified Communications promises greater efficiencies for business. UC can
improve internal communications as well as offer faster, more efficient ways
to interact with customers and streamline customer service. Learn more!
http://www.accelacomm.com/jaw/sfnl/114/51426253/
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
