On Wed, 22 Aug 2007 08:24:49 am Tom Eastep wrote: > In helping a user on IRC today, I was dismayed to find that a bug that > was supposedly fixed in Shorewall 3.4.4 was not fixed. Furthermore, I > found that the bug is present as far back as 3.2.6 (I didn't look back > further since 3.2.6 was the release where the user (re-) discovered the > bug. > > If HIGH_ROUTE_MARKS=No, then PREROUTING and OUTPUT marking rules are > behaving as if TC_EXPERT=Yes was specified in shorewall.conf. In other > words, these rules are being applied even if the connection has been > marked as being associated with a particular ISP.
Thanks for the patches Tom. Are you releasing a new 3.4? Just curious as it would make my version-management easier than rolling my own (patched) RPM. Furthermore, the behaviour described seems to reflect the battles I've had over the last few days with my multi-ISP setup with HIGH_ROUTE_MARKS=No. Problem disappeared when I started using high route marks in PREROUTING. Cheers, James -- Anyone stupid enough to be caught by the police is probably guilty.
smime.p7s
Description: S/MIME cryptographic signature
------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
