On 22/08/2011 04:00, Tom Eastep wrote:
> It appears that your /etc/shorewall/masq file isn't doing what is
> proscribed at http://www.shorewall.net/MultiISP.html#id36153819. So I
> suspect that packets with the source IP of eth0 are leaving ppp1 and are
> not being replied to.
Hi, thanks for the answer. I have changed masq to show 0.0.0.0/0
instead of using br0 and this appears to do what I expect for the
limited testing I have given so far.
> Furthermore, the Shorewall rules compiler is issuing a warning on both
> entries in /etc/shorewall/masq which you are obviously ignoring. Maybe
> you should have done something about them.
Curiously, I only see one error, I presume this is because of
"idiotcounter++" in the code that supresses display of the second?
Note, thank you for highlighting the problems with using an interface
here. I just wanted to highlight that I didn't think I was being a
total clutz though - I did check the code previously and it appeared
that the warning appears every time you use this form, so I had wrongly
presumed it was an information message. I do see now in the man page for
"masq" that this is deprecated, and with some thought I can see how it
wouldn't match my "locally generated" packets either.
Perhaps the lines around 4462 in Shorewall/Chains.pm (sorry, probably
going to wrap..):
if ( $table eq 'nat' ) {
warning_message qq(Using an interface as the masq SOURCE
requires the interface to be up and configured when $Product
starts/restarts) unless $idiotcount++;
} else {
warning_message qq(Using an interface as the SOURCE in a
T: rule requires the interface to be up and configured when $Product
starts/restarts) unless $idiotcount1+
}
...could include a "Deprecation" note? I can supply a patch if you
like, but probably it's faster for you to adjust directly (and to your
liking) than to apply my patch?
Many thanks for putting me straight here - I have noticed a couple of
quirks - will send a separate email
Thanks
Ed W
------------------------------------------------------------------------------
uberSVN's rich system and user administration capabilities and model
configuration take the hassle out of deploying and managing Subversion and
the tools developers use with it. Learn more about uberSVN and get a free
download at: http://p.sf.net/sfu/wandisco-dev2dev
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
