On 12/17/2013 9:56 AM, [email protected] wrote: > I've installed > > shorewall version > 4.5.21.4 > > Reading up
>
> I configure one IPSET-containing blrule,
>
> cat blrules
> #ACTION SOURCE DEST
> DROP +TEST_IPSET all
You must use correct syntax. If you are only blacklisting hosts in the
net zone, then the rule would be:
#ACTION SOURCE DEST
DROP net:+TEST_IPSET all
>
> The IPSET is a run-time defined IPSET. I.e., it exists, pre-defined on
> the remote, not locally on the admin
>
> @ remote
> ipset -L | grep -i TEST_IPSET
> Name: TEST_IPSET
>
> @ local admin
> ipset -L | grep -i TEST_IPSET
>
>
> When I try to compile it for remote installation
>
> shorewall load test.gateway.int
> Compiling...
> Compiling /home/jenl/shorewall/blrules...
> ERROR: Unknown source zone (+TEST_IPSET)
> /home/jenl/shorewall/blrules (line 2)
>
> How do I get this to compile correctly to be 'run-time' aware, without
> having to create each remote's IPSETs locally on the admin instance?
>
> Is there a toggle/flag that can identify an IPSET as compile-time
> (locally defined) vs run-time (defined at remote)?
No.
-Tom
--
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Rapidly troubleshoot problems before they affect your business. Most IT organizations don't have a clear picture of how application performance affects their revenue. With AppDynamics, you get 100% visibility into your Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro! http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
