On Sun, 12 Mar 2017 21:16:20 -0400 Scott Beane <[email protected]> wrote:
> Shorewall version = shorewall-5.1.2.1-1.el7.noarch > uname = 3.10.0-514.10.2.el7.x86_64 > > Tied 2 of 3 interfaces together using "Channel Bonding" described at > https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/4/html/Reference_Guide/s2-modules-bonding.html > [not to be confused with Bridging] Shorewall blocks everything on the > bonded interfaces. Can't even get a ping through with Ping(ACCEPT) > all all. > > Interfaces: > mails enp5s0 > logmartians=1,arp_filter,arp_ignore=2,nosmurfs,tcpflags,blacklist > loc bond0,enp4s0f+ nosmurfs,tcpflags Bonding is very similar to bridging in one thing. When you do bonding you can't use interfaces which are part of bond0 interface at all any more. Another problem with your configuration is you are using rhel4 documentation for rhel7. You should read rhel7 documentation which suggests using more modern team driver instead of bonding. When you start to use bonding it's default mode is round-robin - that will not work with your switch if it hasn't been configured for it, most switches can't be configured for round-robin at all. You left out all important data from this report, that is bonding configuration and ip addr list output of your interfaces, together with output of cat /proc/net/bonding/bond0. > Appears that shorewall is not playing nice with the bonding > configuration hardwired > into /etc/sysconfig/network-scripts/ifcfg-bond0 and the two > interfaces. Technically, the interfaces are each a "slave" of the > master "bond0" with the slaves loosing their IP Address to the bond0 > and only one address is assigned. I am guessing that shorewall is > reading the ifcfg-enp4s0f* files directly rather that after the bond > is set up??? Shorewall only knows of what you have configured, shorewall doesn't read ifcfg files. If you configure bonding, leave slave interfaces out from shorewall configuration, they are not used any more. -- Tuomo Soini <[email protected]> Foobar Linux services +358 40 5240030 Foobar Oy <http://foobar.fi/> ------------------------------------------------------------------------------ Announcing the Oxford Dictionaries API! The API offers world-renowned dictionary content that is easy and intuitive to access. Sign up for an account today to start using our lexical data to power your apps and projects. Get started today and enter our developer competition. http://sdm.link/oxford _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
