Klemens Rutz wrote: > Hi, > > playing around with the nosmurfs option I found out that the firewall script > contains > no rules to enter <interface>_fwd chains when generated shorewall-perl: > # grep eth0_fwd firewall > :eth0_fwd - [0:0] > -A eth0_fwd -m state --state NEW,INVALID -j smurfs > > As a result the nosmurf option does not affect forwarded packages. This is > also true for > other interface options like e.g. tcpflags, maclist, etc.
Please see if the attached hack to /usr/share/shorewall-perl/Shorewall/Chains.pm corrects this for you. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
Index: Shorewall/Chains.pm
===================================================================
--- Shorewall/Chains.pm (revision 9467)
+++ Shorewall/Chains.pm (working copy)
@@ -616,11 +616,8 @@
my $zone = $interfaceref->{zone};
return 1 unless $zone;
- #
- # Interface associated with a single zone -- Must use the interface chain if
- # the zone has multiple interfaces
- # and this chain has option rules
- $interfaceref->{options}{use_forward_chain} && keys %{ zone_interfaces( $zone ) } > 1;
+
+ $interfaceref->{options}{use_forward_chain};
}
#
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Open Source Business Conference (OSBC), March 24-25, 2009, San Francisco, CA -OSBC tackles the biggest issue in open source: Open Sourcing the Enterprise -Strategies to boost innovation and cut costs with open source participation -Receive a $600 discount off the registration fee with the source code: SFAD http://p.sf.net/sfu/XcvMzF8H
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
