Re: [Shorewall-users] shorewall-init missing critical file?

2012-02-29 Thread Tom Eastep
On 02/29/2012 01:14 AM, Roy A. Gilmore wrote: I am currently using Fedora 16 with the distribution provided shorewall-*-4.4.23.3-6.fc16 packages. shorewall-init seems to be missing a critical file. /lib/systemd/system/shorewall-init.service attempts to call /sbin/shorewall-init, but,

Re: [Shorewall-users] shorewall update and HIGH_ROUTE_MARKS

2012-02-29 Thread Tom Eastep
On 02/28/2012 10:15 PM, Brad Clarke wrote: I just upgraded to shorewall 4.5.0.1. It warned me about the deprecated HIGH_ROUTE_MARKS=Yes setting that I was using, so I used shorewall update to take care of it. Even though it added all of the new settings that were needed, I was left with

Re: [Shorewall-users] Continuous pings going through a full DROP policy

2012-02-29 Thread Tom Eastep
On 02/28/2012 07:42 PM, Tom Eastep wrote: On 2/28/12 5:23 PM, jonetsu wrote: Hmmm.. Not sure if the other one got to you, so here it is. Sorry for any duplicate. Here is the dump. It was done in the following way: - unit3: reboot w/o any iptable commands applied - start continuous pings from

Re: [Shorewall-users] Same Syntax Versions

2012-02-29 Thread Tom Eastep
On 02/29/2012 12:31 PM, I.S.C. William wrote: Currently I have version 3.4.8 shorewall working very well, my question is .. if I want my shorewall update to a newer version, will follow my rules funionando same?, I mean if the syntax as well as works already in that version, for example:

Re: [Shorewall-users] shorewall-init missing critical file?

2012-02-29 Thread Tom Eastep
On 02/29/2012 06:58 AM, Tom Eastep wrote: On 02/29/2012 01:14 AM, Roy A. Gilmore wrote: I am currently using Fedora 16 with the distribution provided shorewall-*-4.4.23.3-6.fc16 packages. shorewall-init seems to be missing a critical file. /lib/systemd/system/shorewall-init.service attempts to

Re: [Shorewall-users] Continuous pings going through a full DROP policy

2012-02-29 Thread jonetsu
On Wed, 29 Feb 2012 10:33:28 -0800, Tom Eastep teas...@shorewall.net wrote : So to stop an existing ping at with shorewall start/restart, you need to flush the conntrack table ('shorewall restart -p'). That requires that you install the conntrack utility program (usually, the package is

Re: [Shorewall-users] Continuous pings going through a full DROP policy

2012-02-29 Thread Tom Eastep
On 2/29/12 6:36 PM, jonetsu jone...@teksavvy.com wrote: A value of 1 as the ICMP timeout could perhaps have an effect on normal pings when the network is slow, do you think so ? It could cause timeouts. So you have to decide which is the lesser of the two evils. Thanks so much for your help.