Steven Jan Springl wrote: > Tom > > When interface eth0 has option dhcp set, the following iptables rules are > generated by shorewall-shell (udp 67,68 are allowed on eth0_in & eth0_out): > > -A eth0_fwd -m state --state INVALID,NEW -j dynamic > -A eth0_in -m state --state INVALID,NEW -j dynamic > -A eth0_in -p udp -m udp --dport 67:68 -j ACCEPT > -A eth0_in -j all2all > -A eth0_out -p udp -m udp --dport 67:68 -j ACCEPT > -A eth0_out -j all2all > > > however when compiled with shorewall-perl, the following iptables rules are > generated (upd 67,68 are allowed on eth0_fwd & eth0_in): > > -A eth0_fwd -m state --state NEW,INVALID -j dynamic > -A eth0_fwd -p udp --dport 67:68 -j ACCEPT > -A eth0_in -m state --state NEW,INVALID -j dynamic > -A eth0_in -p udp --dport 67:68 -j ACCEPT > -A eth0_in -j all2all > -A eth0_out -j all2all > > > Note: the policy for all2all is DROP.
Corrected in revision 6322. Thanks, Steven. -Tom -- Tom Eastep \ Nothing is foolproof to a sufficiently talented fool Shoreline, \ http://shorewall.net Washington USA \ [EMAIL PROTECTED] PGP Public Key \ https://lists.shorewall.net/teastep.pgp.key
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/
_______________________________________________ Shorewall-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-devel
