On 08/14/2017 06:15 AM, Matt Darfeuille wrote: > On 8/8/2017 11:25 PM, Tom Eastep wrote: >> On 08/08/2017 11:06 AM, Matt Darfeuille wrote: >>> On 8/8/2017 1:34 AM, Tom Eastep wrote: >>>> It >>>> On 08/07/2017 03:35 PM, Matt Darfeuille wrote: >>>>> >>>>> >>>>> On 8/7/2017 10:51 PM, Tom Eastep wrote: >>>>>> On 08/07/2017 01:45 PM, Matt Darfeuille wrote: >>>>>>> Hi, >>>>>>> >>>>>>> My net interface gets it's ip address dinamically asigned by a dhcp >>>>>>> server. >>>>>>> Sometime I need that address for SNAT, DNAT rules and so on... >>>>>>> I use a variable throughout Shorewall that is defined in the params >>>>>>> file. >>>>>>> Everytime that this ip change, I need to change it manually. >>>>>>> >>>>>>> I'm currently testing the following to let Shorewall know about that >>>>>>> new ip: >>>>>>> >>>>>>> I have a script in /etc/dhcp/dhclient-exit-hooks that do: >>>>>>> >>>>>>> case $reason in >>>>>>> bound) >>>>>>> echo $new_ip_address > /etc/shorewall/current_net_ip >>>>>>> shorewall reload >>>>>>> ;; >>>>>>> esac >>>>>>> >>>>>>> then in /etc/shorewall/params: >>>>>>> >>>>>>> CURRENT_NET_IP=$(cat /etc/shorewall/current_net_ip) >>>>>>> >>>>>>> then I can use 'CURRENT_NET_Ip' throughout Shorewall. >>>>>>> >>>>>>> I could clearly asign a fix address but for the sake of understanding... >>>>>>> Is there a better way to let shorewall know when my net interface gets a >>>>>>> new ip or fix address is the way to go? >>>>>> >>>>>> The best way is to use an address variable >>>>>> (http://www.shorewall.org/configuration_file_basics.htm#AddressVariables). >>>>>> You still need to use an exit-hook script though. >>>>>> >>>>> >>>>> Can I use address variable in the DEST column of the rules file? >>>>> >>>>> /etc/shorewall/init: >>>>> >>>>> NEW_IP_ADDRESS=<IP-ADDRESS> >>>>> >>>>> /etc/shorewall/rules.d/DNAT.rules: >>>>> >>>>> DNAT net:$REMOTE_MANAGEMENT_IP $FW:&{NEW_IP_ADDRESS} tcp 22 >>>>> >>>>> $ shorewall check >>>>> >>>>> ERROR: Unknown Host (&{NEW_IP_ADDRESS}) >>>>> /etc/shorewall/rules.d/DNAT.rules (line 14) >>>>> from /etc/shorewall/rules (line 25) >>>>> in >>>>> I'm tired so I could be rong! >>>> >>>> Address variables currently cannot be used in the DEST column of a DNAT >>>> rule. But to do what you want in that case, just use a REDIRECT rule. >>>> > > Thanks Tom for implementing that in 5.1.6-RC1! > > If I have the following in the rules file: > > DNAT net:$REMOTE_MANAGEMENT_IP $FW:&enp1s0 tcp 22 > > I get the following: > > Aug 14 14:43:47 ERROR: Can't determine the IP address of enp1s0 > > What do you recommend?: > > - Keeping what I'm currently doing (echo the ip to a file then cat that > file). > - Delay the start of shorewall. > - An other approach. >
You could specify the 'wait' option on enp1s0 in shorewall-interfaces(). That way, the generated script will wait for a while to allow the interface to be assigned an address. -Tom -- Tom Eastep \ Q: What do you get when you cross a mobster with Shoreline, \ an international standard? Washington, USA \ A: Someone who makes you an offer you can't http://shorewall.org \ understand \_______________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________ Shorewall-users mailing list Shorewall-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/shorewall-users
