Just to see what would happen, I tried adding a network range to the
"proxyarp" file:
10.0.229.224/27 tap0 grn0 no
in order to handle traffic to an entire subnet living behind a VPN-connected
host in a single configuration directive.
"shorewall check" didn't complain, but "shorewall restart" did:
Error: an inet prefix is expected rather than "10.0.229.224/27/32".
ERROR: Command "ip -4 route replace 10.0.229.224/27/32 dev tap0" Failed
Please understand, I didn't really expect this to work, I just wanted to see
what the result would be.
Clearly (and as I expected), the Shorewall code handling "proxyarp" entries is
currently designed to handle only single addresses. However, I would think
the change to accommodate network ranges shouldn't be too difficult --
possibly involving the code around lines 84 and 96 in the
setup_one_proxy_arp() function in Proxyarp.pm. Could such a change perhaps be
made in a future release? Or am I overlooking some reason why this simply
won't work or is a really, really bad idea?
Again, I'm running Shorewall 4.5.16.1 on an Ubuntu 13.10 system.
--
*Rich Wales*
[email protected]
------------------------------------------------------------------------------
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
