On 03/05/2012 12:36 PM, Ed W wrote: > Hi > >>> Right now I have the following (shall I build a minimal failing case and >>> email the config?) >> Be sure to send a capabilities file as well. > > Near as I can tell, a very minimal rule and masq is triggering this. I > do have an unusual interfaces file though? > > > Minimal config here: > http://www.mailasail.com/w/uploads/Support/shorewall.broken.tar.gz >
a) I took the above configuration and added the attached capabilities
file which I think matches your system.
b) I set CONFIG_PATH="/usr/share/shorewall" so as not to include
anything from /etc/shorewall/
c) I added this single entry to the params file:
LOC_IF=br0
The compiled firewall script contains this ruleset for stopping the
firewall:
#
# Generated by Shorewall 4.5.0.1 - Mon Mar 5 13:03:19 2012
#
*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i br0 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -i br0 -o br0 -j ACCEPT
COMMIT
So I am clearly not able to reproduce the problem with the information
provided.
-Tom
--
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
# # Shorewall 4.5.0.1 detected the following iptables/netfilter capabilities - Mon Mar 5 12:50:21 PST 2012 # NAT_ENABLED=Yes MANGLE_ENABLED=Yes MULTIPORT=Yes XMULTIPORT=Yes CONNTRACK_MATCH=Yes NEW_CONNTRACK_MATCH=Yes OLD_CONNTRACK_MATCH= USEPKTTYPE=Yes POLICY_MATCH=Yes PHYSDEV_MATCH=Yes PHYSDEV_BRIDGE=Yes LENGTH_MATCH=Yes IPRANGE_MATCH=Yes RECENT_MATCH=Yes OWNER_MATCH=Yes IPSET_MATCH=Yes OLD_IPSET_MATCH= CONNMARK=Yes XCONNMARK=Yes CONNMARK_MATCH=Yes XCONNMARK_MATCH=Yes RAW_TABLE=Yes RAWPOST_TABLE= IPP2P_MATCH=Yes OLD_IPP2P_MATCH= CLASSIFY_TARGET=Yes ENHANCED_REJECT=Yes KLUDGEFREE=Yes MARK=Yes XMARK=Yes EXMARK=Yes MANGLE_FORWARD=Yes COMMENTS=Yes ADDRTYPE=Yes TCPMSS_MATCH=Yes HASHLIMIT_MATCH=Yes OLD_HL_MATCH= NFQUEUE_TARGET=Yes REALM_MATCH=Yes HELPER_MATCH=Yes CONNLIMIT_MATCH=Yes TIME_MATCH=Yes GOTO_TARGET=Yes LOGMARK_TARGET=Yes IPMARK_TARGET=Yes LOG_TARGET=Yes ULOG_TARGET= NFLOG_TARGET=Yes PERSISTENT_SNAT=Yes TPROXY_TARGET=Yes FLOW_FILTER=Yes FWMARK_RT_MASK=Yes MARK_ANYWHERE=Yes HEADER_MATCH= ACCOUNT_TARGET=Yes AUDIT_TARGET=Yes IPSET_V5= CONDITION_MATCH= IPTABLES_S=Yes BASIC_FILTER=Yes CT_TARGET=Yes STATISTIC_MATCH=Yes IMQ_TARGET= CAPVERSION=40501 KERNELVERSION=30000
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Try before you buy = See our experts in action! The most comprehensive online learning library for Microsoft developers is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3, Metro Style Apps, more. Free future releases when you subscribe now! http://p.sf.net/sfu/learndevnow-dev2
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
