On Wed, 2007-08-22 at 17:47 +0100, Andrew Suffield wrote: > On Wed, Aug 22, 2007 at 07:52:21AM -0700, Tom Eastep wrote: > > On Wed, 2007-08-22 at 16:44 +0200, Frank Wittig wrote: > > > Unless your ppp0-Device has more than one IP, why not simply configure > > > shorewall in a way the resulting rules are independent from your dynamic > > > external IP? > > > > Mess-mate wants to be able to access his web server (in a DMZ) using > > it's (dynamic) DNS name as described in Shorewall FAQ 2b. > > This seems like a problem that would benefit from using an ipset, > controlled by the dhcp client (or whatever provides the dynamic > address). It is not immediately obvious to me how to arrange that, > though.
Currently, Shorewall doesn't correctly handle an ipset as the ORIGINAL DEST: /etc/shorewall/rules: DNAT net dmz:192.168.1.5 tcp 80 - +setname The generated rules (both compilers generate similar rules): -A net_dnat -p 6 --dport 80 -m set --set setname dst -j DNAT --to-destination 192.168.1.5 -A net2dmz -p 6 --dport 80 -d 192.168.1.5 -m conntrack --ctorigdst +setname -j ACCEPT The second rule is bogus. -Tom -- Tom Eastep \ Nothing is foolproof to a sufficiently talented fool Shoreline, \ http://shorewall.net Washington USA \ [EMAIL PROTECTED] PGP Public Key \ https://lists.shorewall.net/teastep.pgp.key
signature.asc
Description: This is a digitally signed message part
------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
