Tom
When interface eth0 has option dhcp set, the following iptables rules are
generated by shorewall-shell (udp 67,68 are allowed on eth0_in & eth0_out):
-A eth0_fwd -m state --state INVALID,NEW -j dynamic
-A eth0_in -m state --state INVALID,NEW -j dynamic
-A eth0_in -p udp -m udp --dport 67:68 -j ACCEPT
-A eth0_in -j all2all
-A eth0_out -p udp -m udp --dport 67:68 -j ACCEPT
-A eth0_out -j all2all
however when compiled with shorewall-perl, the following iptables rules are
generated (upd 67,68 are allowed on eth0_fwd & eth0_in):
-A eth0_fwd -m state --state NEW,INVALID -j dynamic
-A eth0_fwd -p udp --dport 67:68 -j ACCEPT
-A eth0_in -m state --state NEW,INVALID -j dynamic
-A eth0_in -p udp --dport 67:68 -j ACCEPT
-A eth0_in -j all2all
-A eth0_out -j all2all
Note: the policy for all2all is DROP.
Steven.
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Shorewall-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-devel
