Re: [Shorewall-users] SW private address access 'out' its external interface to a single device?

2015-05-26 Thread PGNd
Tom Simon you have an invalid IP configuration since the subnet between modem and firewall is the same as your internal network. Thus it's not possible to correctly route traffic to allow internal devices to access the modem. Thanks for pointing that out. A quick change/test to

[Shorewall-users] Adding routes on shorewall

2015-05-26 Thread João Kuchnier
Hi everyone! I need some help with a four interface shorewal. I have two ISPs (eth0 and eth1), a DMZ (eth2) and a local subnet (eth3). I configured the providers file with the two ISPs. Internet access is working fine. On eth3, I have two different subnets: 10.50.105.0/25 and 10.50.3.0/24. The

[Shorewall-users] Reverse Path filtering: iptables and kernel ?

2015-05-26 Thread jonetsu
Hello,   When specifying a rpfilter option for an interface, we can see after applying the firewall configuration that there is a rpfilter being added for that interface, as well as a rpfilter chain.  OTOH, no rp_filter option is set in /proc/sys/net/ipv4/conf/interface|all/rp_filter. What

Re: [Shorewall-users] init dependency ordering for system net stack, shorewall + openvpn?

2015-05-26 Thread Tom Eastep
On 5/26/2015 12:36 PM, PGNd wrote: Tom On Tue, May 26, 2015, at 12:15 PM, Tom Eastep wrote: Is the OpenVPN tunnel also a provider? yes, it is. Then I think that the most straight-forward thing to do is: a) Make the OpenVPN interface 'optional' with no 'wait=' specified in the interfaces

[Shorewall-users] SW private address access 'out' its external interface to a single device?

2015-05-26 Thread PGNd
I've setup a DHCP connected linux box. It runs Shorewall. [net] | EXT: DHCP Client Uverse/ATT modem (bridge mode) INT: DHCP Server WebServer @ http://192.168.1.254 | | EXT: DHCP Client - IP == 1.2.3.4 Linux

Re: [Shorewall-users] init dependency ordering for system net stack, shorewall + openvpn?

2015-05-26 Thread PGNd
On Tue, May 26, 2015, at 12:47 PM, Tom Eastep wrote: Then I think that the most straight-forward thing to do is: a) Make the OpenVPN interface 'optional' with no 'wait=' specified in the interfaces file. Done. b) Start OpenVPN after Shorewall-lite. Starting it with a script from within

Re: [Shorewall-users] init dependency ordering for system net stack, shorewall + openvpn?

2015-05-26 Thread Tom Eastep
On 5/25/2015 2:58 PM, PGNd wrote: I have OpenVPN Shorewall-lite installed on an Opensuse server, running its 'wicked' networking stack. It's an all systemd-controlled init environment. I'm interested in ordering the system network stack, openvpn and shorewall service starts correctly to

Re: [Shorewall-users] Reverse Path filtering: iptables and kernel ?

2015-05-26 Thread Tom Eastep
On 5/26/2015 7:53 AM, jonetsu wrote: Hello, When specifying a rpfilter option for an interface, we can see after applying the firewall configuration that there is a rpfilter being added for that interface, as well as a rpfilter chain. OTOH, no rp_filter option is set in

Re: [Shorewall-users] init dependency ordering for system net stack, shorewall + openvpn?

2015-05-26 Thread PGNd
Tom On Tue, May 26, 2015, at 12:15 PM, Tom Eastep wrote: Is the OpenVPN tunnel also a provider? yes, it is. -- ___ Shorewall-users mailing list

[Shorewall-users] SW's default findgw looks in wrong dhcp lease location on opensuse+wicked net stack

2015-05-26 Thread PGNd
I'm switching my current linux box from staticIP - dynamicIP via dhcp. On net start of my linux box, connecting via native wicked dhcp on Opensuse 13.2, wicked ifdown eth0 wicked ifup eth0 I have connectivity ip -4 addr show dev eth0 4: eth0:

Re: [Shorewall-users] init dependency ordering for system net stack, shorewall + openvpn?

2015-05-26 Thread Tom Eastep
On 5/26/2015 1:01 PM, PGNd wrote: On Tue, May 26, 2015, at 12:47 PM, Tom Eastep wrote: Then I think that the most straight-forward thing to do is: a) Make the OpenVPN interface 'optional' with no 'wait=' specified in the interfaces file. Done. b) Start OpenVPN after Shorewall-lite.

Re: [Shorewall-users] SW private address access 'out' its external interface to a single device?

2015-05-26 Thread Tom Eastep
On 5/26/2015 1:05 PM, PGNd wrote: I've setup a DHCP connected linux box. It runs Shorewall. [net] | EXT: DHCP Client Uverse/ATT modem (bridge mode) INT: DHCP Server WebServer @ http://192.168.1.254 | |

Re: [Shorewall-users] SW private address access 'out' its external interface to a single device?

2015-05-26 Thread Simon Hobson
PGNd d...@pgnd.us wrote: I've setup a DHCP connected linux box. It runs Shorewall. [net] | EXT: DHCP Client Uverse/ATT modem (bridge mode) INT: DHCP Server WebServer @ http://192.168.1.254 | | EXT: DHCP