We added our custom rules to the start script and it works very well.
Thanks for your support.
Davide
On Fri, Dec 13, 2013 at 5:38 PM, Tom Eastep <[email protected]> wrote:
> On 12/13/2013 7:53 AM, Davide Ferri wrote:
> > Hi all,
> > I'm tring to convert some manually written iptables rules into a
> > shorewall configuration but I'm facing some issue with mode statistic.
> > In our outgoing smtp we balance the source IP address of outgoing
> > connections originating from the firewall between 4 alias configured on
> > eth0 interface:
> >
> > eth0 inet addr:xxx.xxx.xxx.18 Bcast:xxx.xxx.xxx.255 Mask:255.255.255.0
> > eth0:1 inet addr:xxx.xxx.xxx.19 Bcast:xxx.xxx.xxx.255 Mask:255.255.255.0
> > eth0:2 inet addr:xxx.xxx.xxx.28 Bcast:xxx.xxx.xxx.255 Mask:255.255.255.0
> > eth0:3 inet addr:xxx.xxx.xxx.29 Bcast:xxx.xxx.xxx.255 Mask:255.255.255.0
> >
> > using iptables we just add the following rules:
> >
> > iptables -A POSTROUTING -m statistic --mode random --probability 0.25 -t
> > nat -o eth0 -p tcp --dport 25 -j SNAT --to xxx.xxx.xxx.19
> > iptables -A POSTROUTING -m statistic --mode random --probability 0.33 -t
> > nat -o eth0 -p tcp --dport 25 -j SNAT --to xxx.xxx.xxx.28
> > iptables -A POSTROUTING -m statistic --mode random --probability 0.5 -t
> > nat -o eth0 -p tcp --dport 25 -j SNAT --to xxx.xxx.xxx.29
> >
> > how can we achieve this with shorewall ?
>
> The only way to do it with current Shorewall versions is to insert those
> rules using your 'start' extension script.
>
> Beginning with Shorewall 4.6.0, you will be able to do something like
> the following in /etc/shorewall/masq:
>
> INLINE(eth0) - xxx.xxx.xxx.19 tcp 25 ; -m statistic --mode
> random
> --probablilty 0.25
> ...
>
> The attached patch can be applied to recent Shorewall 4.5 versions to
> allow you do do that now.
>
> patch /usr/share/shorewall/Shorewall/Nat.pm < INLINEMASQ.patch
>
> That command assumes that PERLLIB=/usr/share/shorewall/ in your
> shorewallrc file.
>
> -Tom
> --
> Tom Eastep \ When I die, I want to go like my Grandfather who
> Shoreline, \ died peacefully in his sleep. Not screaming like
> Washington, USA \ all of the passengers in his car
> http://shorewall.net \________________________________________________
>
>
> ------------------------------------------------------------------------------
> Rapidly troubleshoot problems before they affect your business. Most IT
> organizations don't have a clear picture of how application performance
> affects their revenue. With AppDynamics, you get 100% visibility into your
> Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics
> Pro!
> http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk
> _______________________________________________
> Shorewall-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/shorewall-users
>
>
------------------------------------------------------------------------------
Rapidly troubleshoot problems before they affect your business. Most IT
organizations don't have a clear picture of how application performance
affects their revenue. With AppDynamics, you get 100% visibility into your
Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro!
http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
