Also, is this supposed to work in shorewall6?
/usr/local/src/shorewall-nft# PYTHONPATH=src python3 -m shorewall_nft
check /etc/shorewall6
ERROR: /etc/shorewall6/rtrules:20: invalid rtrules interface name
'[2607'
Offending line:
#SOURCE DEST PROVIDER PRIORITY#
Anything sourcing from the teksavvy-supplied /64 internal address spaces
goes out via teksavvy
# Preferably, this should only be return traffic.
[2607:f2c0:f00e:b700::/64] [2607:f2c0:f00e:b700::/64] main
900
[2607:f2c0:f00e:b700::/64] - teksavvy 901
# Anything sourcing from the rogers-supplied /64 internal address spaces
goes out via rogers
[2607:fea8:be20:7fc::/64] [2607:fea8:be20:7fc::/64] main 900
[2607:fea8:be20:7fc::/64] - rogers 901
(This is because I have multi-ISP and otherwise, traffic on one internal
/64 goes out via the wrong external interface
On 2026-07-22 6:49 p.m., Winston Sorfleet wrote:
Doing a
|PYTHONPATH=src python3 -m shorewall_nft check /etc/shorewall
shorewall-nft: warning: interfaces:12: interface option 'rpfilter' is
accepted but not yet enforced; anti-spoofing is NOT applied to this
interface. shorewall-nft: warning: interfaces:15: interface option
'rpfilter' is accepted but not yet enforced; anti-spoofing is NOT
applied to this interface. shorewall-nft: warning: interfaces:16:
interface option 'rpfilter' is accepted but not yet enforced;
anti-spoofing is NOT applied to this interface. ERROR:
/etc/shorewall/rules:17: unknown zone all Suggests that it does not
recognize the old shorewall macro "all"? |
On 2026-07-22 2:51 a.m., Dave Kempe wrote:
The process below will take care of that for you - they conflict, so
it will uninstall the shorewall package and leave the config intact
for you.
The two packages can't be installed at once - they both provide the
'shorewall' binary (script)
Dave
On Wed, 22 Jul 2026 at 15:45, Witold Tosta <[email protected]>
wrote:
Hi Dave,
Do I need to uninstall the old shorewall and shorewall6 packages
first, leaving only the directories with the configuration files?
Can the old shorewall packages be installed? I'm using Debian Trixie.
Best regards,
Witold Tosta
wt., 21 lip 2026, 08:45 użytkownik Dave Kempe
<[email protected]> napisał:
Hey everyone,
As a way to get started quickly, I have added shorewall-nft
to the Sol1 packages repo.
You can set it up here: https://packages.sol1.net/
and then simply:
apt install shorewall-nft
shorewall check
shorewall migrate
And you are done.
If encounter any problems with check or migrate, you can back
out and go back to shorewall, (apt install shorewall etc)
Note that shorewall-nft conflicts with shorewall and will
uninstall it, with the migrate command actually flushing
iptables rules.
I haven't got any packages repo for rpm based distros, as we
are debian/ubuntu from way back, but I'm sure a quick rpm
command will work the same sorta way.
Dave
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
