I've installed
shorewall version
4.5.21.4
Reading up
@ http://www.shorewall.net/upgrade_issues.htm#idp3157976
"
...
Versions >= 4.5.0
...
The BLACKLIST section of the rules file has been
eliminated. If you have entries in that file section,
you must move them to the blrules file."
...
"
@ http://shorewall.net/blacklisting_support.htm#idp2730648
"
...
Rule-based Blacklisting
Beginning with Shorewall 4.4.25, the preferred method of
blacklisting and whitelisting is to use the blrules file
(shorewall-blrules (5)). There you have access to the
DROP, ACCEPT, REJECT and WHITELIST actions, standard and
custom macros as well as standard and custom actions.
See shorewall-rules (5) for details.
...
"
@ http://shorewall.net/manpages/shorewall-rules.html
"
...
SOURCE -
{zone|zone-list[+]|{all|any}[+][-]}[:interface][:{address-or-range[,address-or-range]...[exclusion]|exclusion|+ipset|^countrycode-list}
...
If your kernel and iptables have ipset match support
then you may give the name of an ipset prefaced by "+".
...
"
I configure one IPSET-containing blrule,
cat blrules
#ACTION SOURCE DEST
DROP +TEST_IPSET all
The IPSET is a run-time defined IPSET. I.e., it exists, pre-defined on
the remote, not locally on the admin
@ remote
ipset -L | grep -i TEST_IPSET
Name: TEST_IPSET
@ local admin
ipset -L | grep -i TEST_IPSET
When I try to compile it for remote installation
shorewall load test.gateway.int
Compiling...
Processing /home/jenl/shorewall/params ...
Processing /home/jenl/shorewall/shorewall.conf...
Shorewall has detected the following capabilities:
...
Compiling /home/jenl/shorewall/zones...
Compiling /home/jenl/shorewall/interfaces...
Interface "net eth0
dhcp,tcpflags,logmartians,nosmurfs" Validated
Determining Hosts in Zones...
fw (firewall)
net (ipv4)
eth0:0.0.0.0/0
Locating Action Files...
Compiling /home/jenl/shorewall/policy...
Policy for net to fw is DROP using chain net2all
Policy for fw to net is REJECT using chain all2all
Policy for net to fw is REJECT using chain all2all
Running /home/jenl/shorewall/initdone...
Adding Anti-smurf Rules
Adding rules for DHCP
Compiling TCP Flags filtering...
Compiling Kernel Route Filtering...
Compiling Martian Logging...
Compiling MAC Filtration -- Phase 1...
Compiling /home/jenl/shorewall/blrules...
ERROR: Unknown source zone (+TEST_IPSET)
/home/jenl/shorewall/blrules (line 2)
How do I get this to compile correctly to be 'run-time' aware, without
having to create each remote's IPSETs locally on the admin instance?
Is there a toggle/flag that can identify an IPSET as compile-time
(locally defined) vs run-time (defined at remote)?
------------------------------------------------------------------------------
Rapidly troubleshoot problems before they affect your business. Most IT
organizations don't have a clear picture of how application performance
affects their revenue. With AppDynamics, you get 100% visibility into your
Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro!
http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
