[Shorewall-users] Shorewall 5.0.12 Beta 1

[Tom Eastep]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Shorewall 5.0.12 Beta 1 is now available for testing.

Problems Corrected:

1) Minor cleanup, mostly commentary, in the Rules.pm module.

New Features:

1) You may now place comma-separated zone lists in the SOURCE and DEST
columns in /etc/shorewall[6]/policy.

Example:

#SOURCE DEST POLICY ...
loc,dmz net REJECT

That line is equivalent to:

#SOURCE DEST POLICY ...
loc net REJECT
loc dmz REJECT

If the same zone appears in both columns, the default ACCEPT
intrazone policy is not overridden unless the list is followed
immediately by '+'.

Example:

#SOURCE DEST POLICY ...
dmz,loc loc,dmz+ REJECT

That line is equivalent to:

#SOURCE DEST POLICY ...
dmz loc REJECT
dmz dmz REJECT
loc loc REJECT
loc dmz REJECT

Without the plus sine, it would be equivalent to

#SOURCE DEST POLICY ...
dmz loc REJECT
loc dmz REJECT

Thank you for testing,

- -Tom
- --
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: GPGTools - http://gpgtools.org

iQIcBAEBCAAGBQJX12l2AAoJEJbms/JCOk0Q280QAJqK03l2xqssTbHW3vyvcQkD
/ytOO1FIKx7CVflQsuXXGI+xxnnd/wod0UUNw3KTAr7uysRRZnJvhwn0y8BNKI90
JxSR7tPRNFibkBItFawXDO9/RVp5pKBsmroMhaW4+Nh8usD/PREC/M8ikuoRzXHX
LKa84An/O3upoliIeLo/krX+leKM67k3OrLHs0emiqIWqzhjLwi+PUndK2h0Z5WM
mOjncL4Q1DZV9DmfLXzh0juRT3SsywNOThUa83sGWZGRDBR0AuQlkk3gp+7J3Iwn
zmSpCaRjJU5l1sifEgYMczV5Siz4JO9sUKgCFV6C5Dn+XpG1ncrfTcxui8MTrMrR
h6gVyIf0vNJx+g2ERyEceKMbQpDRuKwPWUKrAUNeg4iyKENgTGbLeEdh1s3mc8VX
dH3pSRjDrf4BlUdBnHm9c1sVxI4Czo7c3+fltQIWl15nglfJJ5wSOy2+a6GaIw32
eV9picfMaIQ86vTmKgaPGRqvYpBIAXZUcA9opu4XePTobl9RYSpGjj07BS+0TlO9
LJVVfLy3tTygHPS82o0Zj9+KhxBrg5wXFzDzICY0Whm+X2iriQF0FOwc+oTDe2Zh
vAVaFsoa4vSjpWqsYaswati8phb67i1/ppQRJgTjM+zvWHyTxg5yxbgtCXCCfBPG
2NQZyT8c/pc5joX09K/i
=zUvs
-----END PGP SIGNATURE-----

------------------------------------------------------------------------------

[Hristo Benev]

Just to report...

in ftp folder "beta" is missing in folder name
it is
shorewall-5.0.12-
instead

Hristo

-------- Оригинално писмо --------
Относно: [Shorewall-users] Shorewall 5.0.12 Beta 1
Изпратено на: 13.09.2016 05:50
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Shorewall 5.0.12 Beta 1 is now available for testing.
1) Minor cleanup, mostly commentary, in the Rules.pm module.
1) You may now place comma-separated zone lists in the SOURCE and DEST
columns in /etc/shorewall[6]/policy.
#SOURCE DEST POLICY ...
loc,dmz net REJECT
#SOURCE DEST POLICY ...
loc net REJECT
loc dmz REJECT
If the same zone appears in both columns, the default ACCEPT
intrazone policy is not overridden unless the list is followed
immediately by '+'.
#SOURCE DEST POLICY ...
dmz,loc loc,dmz+ REJECT
#SOURCE DEST POLICY ...
dmz loc REJECT
dmz dmz REJECT
loc loc REJECT
loc dmz REJECT
Without the plus sine, it would be equivalent to
#SOURCE DEST POLICY ...
dmz loc REJECT
loc dmz REJECT
Thank you for testing,
- -Tom
- --
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: GPGTools - http://gpgtools.org
iQIcBAEBCAAGBQJX12l2AAoJEJbms/JCOk0Q280QAJqK03l2xqssTbHW3vyvcQkD
/ytOO1FIKx7CVflQsuXXGI+xxnnd/wod0UUNw3KTAr7uysRRZnJvhwn0y8BNKI90
JxSR7tPRNFibkBItFawXDO9/RVp5pKBsmroMhaW4+Nh8usD/PREC/M8ikuoRzXHX
LKa84An/O3upoliIeLo/krX+leKM67k3OrLHs0emiqIWqzhjLwi+PUndK2h0Z5WM
mOjncL4Q1DZV9DmfLXzh0juRT3SsywNOThUa83sGWZGRDBR0AuQlkk3gp+7J3Iwn
zmSpCaRjJU5l1sifEgYMczV5Siz4JO9sUKgCFV6C5Dn+XpG1ncrfTcxui8MTrMrR
h6gVyIf0vNJx+g2ERyEceKMbQpDRuKwPWUKrAUNeg4iyKENgTGbLeEdh1s3mc8VX
dH3pSRjDrf4BlUdBnHm9c1sVxI4Czo7c3+fltQIWl15nglfJJ5wSOy2+a6GaIw32
eV9picfMaIQ86vTmKgaPGRqvYpBIAXZUcA9opu4XePTobl9RYSpGjj07BS+0TlO9
LJVVfLy3tTygHPS82o0Zj9+KhxBrg5wXFzDzICY0Whm+X2iriQF0FOwc+oTDe2Zh
vAVaFsoa4vSjpWqsYaswati8phb67i1/ppQRJgTjM+zvWHyTxg5yxbgtCXCCfBPG
2NQZyT8c/pc5joX09K/i
=zUvs
-----END PGP SIGNATURE-----
------------------------------------------------------------------------------
_______________________________________________
Shorewall-users mailing list
https://lists.sourceforge.net/lists/listinfo/shorewall-users

------------------------------------------------------------------------------

[Tom Eastep]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Post by Hristo Benev
Just to report...
in ftp folder "beta" is missing in folder name it is
shorewall-5.0.12- instead

I'm not seeing that:

***@sff:~/shorewall/release$ ftp ftp.shorewall.org
Connected to server.shorewall.net.
220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
220-You are user number 2 of 50 allowed.
220-Local time is now 08:39. Server port: 21.
220 You will be disconnected after 15 minutes of inactivity.
Name (ftp.shorewall.org:teastep): ftp
230-Welcome to ftp.shorewall.net
230 Anonymous user logged in
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> passive
Passive mode on.
ftp> ls
229 Extended Passive mode OK (|||61707|)
150 Accepted data connection
drwxrwxr-x 16 1006 33 4096 Aug 19 2014 archives
drwxrwxr-x 2 1006 33 4096 Dec 18 2005 etc
drwxrwxr-x 7 1006 33 4096 Oct 22 2014 pub
drwxr-xr-x 2 0 0 4096 Oct 9 2015 temp
226-Options: -l
226 4 matches total
ftp> cd pub/shorewall/development/5.0
250 OK. Current directory is /pub/shorewall/development/5.0
ftp> ls
229 Extended Passive mode OK (|||61042|)
150 Accepted data connection
drwxr-sr-x 2 1001 33 4096 Jun 14 14:29
shorewall-5.0.10-Beta1
drwxr-sr-x 2 1001 33 4096 Jun 19 07:51
shorewall-5.0.10-Beta2
drwxr-sr-x 2 1001 33 4096 Jun 25 07:27
shorewall-5.0.10-RC1
drwxr-sr-x 2 1001 33 4096 Jul 25 07:36
shorewall-5.0.11-Beta1
drwxr-sr-x 2 1001 33 4096 Jul 30 13:14
shorewall-5.0.11-Beta2
drwxr-sr-x 2 1001 33 4096 Aug 5 08:05
shorewall-5.0.11-RC1
drwxr-sr-x 2 1001 33 4096 Sep 12 18:28
shorewall-5.0.12-Beta1 <===============
drwxr-sr-x 3 1001 33 4096 Apr 1 12:32
shorewall-5.0.8-Beta2
...
226-Options: -l
226 15 matches total
ftp>

Similar results at ftp.shorewall.net. Which mirror are you using?

- -Tom

- --
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: GPGTools - http://gpgtools.org

iQIcBAEBCAAGBQJX2B6NAAoJEJbms/JCOk0QhlAP/0zYqwJ0fjWIa03T7ovjb/RM
SMdBUuJBsbjYdxL0N3GMxhguaPQ2Qww1jLxV/s8eNRzKxP0NMF5Kqo5RjLGB79Bw
bFlCaNJ3mhh3H64WCBzMQNULFrTUhX36DS0uzyIDxhNBTrNQblcFxJRbq9kkH6Y7
v79ipC/OCcYViInVzqIIsA+zuB+0JNaAToMd51ZEyBw0Sz626ExWIMC/fzuXiIHz
bz69a4M+RzGb1vVauD6+s8pxB2t6vVxBqE6x77e6sYwO9Qad9M/8XVf/VS95GBE5
Pi1wOpM48gWprz5OXzcJT9m0EXYG63Tiow6VWvn3mrCLRZi0K9cGY98x2SPFy2qD
4LzVvX7bzeEwG9o2iaOpjsaZ1KApYwYEZXdaB7+zkxOLlPOPDunvk9AmWE+IFiNE
S5WAXIs5e9+yKUZLglijYdcDdseUJsDOMLodRwPsoJjIexEQ4H2DqnnOqXpQArkh
CNmakTtfZIpu8p2JjB7nKXrvPugskJj4R2C5vGY1LXM7vTUnDAtYv49GUg60R06l
yvPJI14ZdD4HTLOcHIkrE9TLpsMbKnGBHVXJdk0Vk/Ak7YwS1R0jVn5tJ3aAqgsl
L997WGyF1/+O/IDODCT5hAw8Q3bN5Lf+FO+OFbgw20/hqx0bf19ACDE0neZTNXjh
mlfKcfeCl4orfEauLR5z
=cJ3R
-----END PGP SIGNATURE-----

------------------------------------------------------------------------------

[Hristo Benev]

Here is it...

ftp://ftp.shorewall.net/pub/shorewall/5.0/shorewall-5.0.12-/

-------- Оригинално писмо --------
Относно: Re: [Shorewall-users] Shorewall 5.0.12 Beta 1
Изпратено на: 13.09.2016 18:43
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Post by Hristo Benev
Just to report...
in ftp folder "beta" is missing in folder name it is
shorewall-5.0.12- instead

Connected to server.shorewall.net.
220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
220-You are user number 2 of 50 allowed.
220-Local time is now 08:39. Server port: 21.
220 You will be disconnected after 15 minutes of inactivity.
Name (ftp.shorewall.org:teastep): ftp
230-Welcome to ftp.shorewall.net
230 Anonymous user logged in
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> passive
Passive mode on.
ftp> ls
229 Extended Passive mode OK (|||61707|)
150 Accepted data connection
drwxrwxr-x 16 1006 33 4096 Aug 19 2014 archives
drwxrwxr-x 2 1006 33 4096 Dec 18 2005 etc
drwxrwxr-x 7 1006 33 4096 Oct 22 2014 pub
drwxr-xr-x 2 0 0 4096 Oct 9 2015 temp
226-Options: -l
226 4 matches total
ftp> cd pub/shorewall/development/5.0
250 OK. Current directory is /pub/shorewall/development/5.0
ftp> ls
229 Extended Passive mode OK (|||61042|)
150 Accepted data connection
drwxr-sr-x 2 1001 33 4096 Jun 14 14:29
shorewall-5.0.10-Beta1
drwxr-sr-x 2 1001 33 4096 Jun 19 07:51
shorewall-5.0.10-Beta2
drwxr-sr-x 2 1001 33 4096 Jun 25 07:27
shorewall-5.0.10-RC1
drwxr-sr-x 2 1001 33 4096 Jul 25 07:36
shorewall-5.0.11-Beta1
drwxr-sr-x 2 1001 33 4096 Jul 30 13:14
shorewall-5.0.11-Beta2
drwxr-sr-x 2 1001 33 4096 Aug 5 08:05
shorewall-5.0.11-RC1
drwxr-sr-x 2 1001 33 4096 Sep 12 18:28
shorewall-5.0.12-Beta1 <===============
drwxr-sr-x 3 1001 33 4096 Apr 1 12:32
shorewall-5.0.8-Beta2
...
226-Options: -l
226 15 matches total
ftp>
Similar results at ftp.shorewall.net. Which mirror are you using?
- -Tom
- --
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: GPGTools - http://gpgtools.org
iQIcBAEBCAAGBQJX2B6NAAoJEJbms/JCOk0QhlAP/0zYqwJ0fjWIa03T7ovjb/RM
SMdBUuJBsbjYdxL0N3GMxhguaPQ2Qww1jLxV/s8eNRzKxP0NMF5Kqo5RjLGB79Bw
bFlCaNJ3mhh3H64WCBzMQNULFrTUhX36DS0uzyIDxhNBTrNQblcFxJRbq9kkH6Y7
v79ipC/OCcYViInVzqIIsA+zuB+0JNaAToMd51ZEyBw0Sz626ExWIMC/fzuXiIHz
bz69a4M+RzGb1vVauD6+s8pxB2t6vVxBqE6x77e6sYwO9Qad9M/8XVf/VS95GBE5
Pi1wOpM48gWprz5OXzcJT9m0EXYG63Tiow6VWvn3mrCLRZi0K9cGY98x2SPFy2qD
4LzVvX7bzeEwG9o2iaOpjsaZ1KApYwYEZXdaB7+zkxOLlPOPDunvk9AmWE+IFiNE
S5WAXIs5e9+yKUZLglijYdcDdseUJsDOMLodRwPsoJjIexEQ4H2DqnnOqXpQArkh
CNmakTtfZIpu8p2JjB7nKXrvPugskJj4R2C5vGY1LXM7vTUnDAtYv49GUg60R06l
yvPJI14ZdD4HTLOcHIkrE9TLpsMbKnGBHVXJdk0Vk/Ak7YwS1R0jVn5tJ3aAqgsl
L997WGyF1/+O/IDODCT5hAw8Q3bN5Lf+FO+OFbgw20/hqx0bf19ACDE0neZTNXjh
mlfKcfeCl4orfEauLR5z
=cJ3R
-----END PGP SIGNATURE-----
------------------------------------------------------------------------------
_______________________________________________
Shorewall-users mailing list
https://lists.sourceforge.net/lists/listinfo/shorewall-users

------------------------------------------------------------------------------

[Philip Le Riche]

We'd been running Shorewall successfully since a couple of years ago on
the then current version of Linux Mint. I recently rebuilt the firewall
on slightly less ancient hardware and with the latest Linux Mint and
Shorewall, and now it doesn't start automatically.

After a bit of googling I set startup=1 in /etc/default/shorewall and on
the next reboot following logon the desktop crashed before displaying
anything, dropping me into fallback mode. Now shorewall again doesn't
start on boot.

I think I got the same desktop crash when I first set
STARTUP_ENABLED=Yes in shorewall.conf. The ruleset is unchanged from the
previous build. Do you now need an ACCEPT $FW $FW rule to allow the
desktop to talk to its graphics server? And how do I now get shorewall
to start on boot?

Regards - Philip

------------------------------------------------------------------------------

[Roberto C. Sánchez]

Post by Philip Le Riche
After a bit of googling I set startup=1 in /etc/default/shorewall and on
the next reboot following logon the desktop crashed before displaying
anything, dropping me into fallback mode. Now shorewall again doesn't
start on boot.

What version of Shorewall and what installation source (upstream
installer or distro packages)?

Regards,

-Roberto

[Philip Le Riche]

I don't have immediate access to the system and can't easily get precise
subversion numbers but it's running a freshly installed Linux Mint 18
and Shorewall 5 as offered by the standard repository just a few weeks
ago. I'm also running Apache2, Samba, isc-dhcp-server and
openssh-server. I could be wrong, but to me this has the feel of
something to do with the way shorewall and Mint 18 interact rather than
something specific to a subversion.

Regards - Philip

Post by Roberto C. Sánchez

Post by Philip Le Riche
After a bit of googling I set startup=1 in /etc/default/shorewall and on
the next reboot following logon the desktop crashed before displaying
anything, dropping me into fallback mode. Now shorewall again doesn't
start on boot.

What version of Shorewall and what installation source (upstream
installer or distro packages)?
Regards,
-Roberto
------------------------------------------------------------------------------
_______________________________________________
Shorewall-users mailing list
https://lists.sourceforge.net/lists/listinfo/shorewall-users

[Roberto C. Sánchez]

Post by Philip Le Riche
I don't have immediate access to the system and can't easily get precise
subversion numbers  but it's running a freshly installed Linux Mint 18 and
Shorewall 5 as offered by the standard repository just a few weeks ago.
I'm also running Apache2, Samba, isc-dhcp-server and openssh-server. I
could be wrong, but to me this has the feel of something to do with the
way shorewall and Mint 18 interact rather than something specific to a
subversion.

I am not a Linux Mint user, so I looked on the Mint package listing page
for the current release and Shorewall is not listed as a package in the
distribution. Just tell us the Shorewall package version (output of
`apt-cache policy shorewall`) so that we can help diagnose the problem.

Also, since you indicated originally that your problem has to do with
Shorewall not starting at boot, what init system are you using?

Regards,

-Roberto

[Philip Le Riche]

Ah, come to think of it I've got another Linux Mint system down here in
a corner which I set up as far as I can tell identically but it doesn't
have Shorewall configured or started as I don't have the requisite NICs
and only have one network.

It reports:
Philip-Desktop ~ # apt-cache policy shorewall
shorewall:
Installed: 5.0.4-1
Candidate: 5.0.4-1
Version table:
*** 5.0.4-1 500
500 http://archive.ubuntu.com/ubuntu xenial/universe amd64 Packages
500 http://archive.ubuntu.com/ubuntu xenial/universe i386 Packages
100 /var/lib/dpkg/status

I'm having difficulty working out what init system it uses and the
release notes don't seem to say. (I was brought up on SystemV inittab -
I've got the white hair - I just need the walking frame.) Running ps
reports process 1 as /sbin/init splash. There's no /etc/inittab but
/etc/init is a directory containing loads of .conf files including
several upstart-*.conf, smbd.conf and ssh.conf but no shorewall.conf,
possibly because I haven't started it.

Regards - Philip

Post by Roberto C. Sánchez

Post by Philip Le Riche
I don't have immediate access to the system and can't easily get precise
subversion numbers but it's running a freshly installed Linux Mint 18 and
Shorewall 5 as offered by the standard repository just a few weeks ago.
I'm also running Apache2, Samba, isc-dhcp-server and openssh-server. I
could be wrong, but to me this has the feel of something to do with the
way shorewall and Mint 18 interact rather than something specific to a
subversion.

I am not a Linux Mint user, so I looked on the Mint package listing page
for the current release and Shorewall is not listed as a package in the
distribution. Just tell us the Shorewall package version (output of
`apt-cache policy shorewall`) so that we can help diagnose the problem.
Also, since you indicated originally that your problem has to do with
Shorewall not starting at boot, what init system are you using?
Regards,
-Roberto
------------------------------------------------------------------------------
_______________________________________________
Shorewall-users mailing list
https://lists.sourceforge.net/lists/listinfo/shorewall-users

[Roberto C. Sánchez]

Post by Philip Le Riche
Philip-Desktop ~ # apt-cache policy shorewall
  Installed: 5.0.4-1

That version of Shorewall had a packaging bug such that it wouldn't
start on boot on systems running systemd.

Post by Philip Le Riche
I'm having difficulty working out what init system it uses and the release
notes don't seem to say. (I was brought up on SystemV inittab - I've got
the white hair - I just need the walking frame.) Running ps reports
process 1 as /sbin/init splash. There's no /etc/inittab but /etc/init is a
directory containing loads of .conf files including several
upstart-*.conf, smbd.conf and ssh.conf but no shorewall.conf, possibly
because I haven't started it.

What is the output of `apt-cache policy systemd`? If it reports
something in the version field for "Installed", then look at the output
of `systemctl is-enabled shorewall`. If that spits out "disabled" then
you can turn it on with `systemctl enable shorewall` and it will start
on boot as you would expect.

Regards,

-Roberto

[Philip Le Riche]

OK, thanks, so on this near-clone system, systemd is installed and
systemctl shows shorewall as disabled. When next I can get to the live
system (probably next week) I'll repeat it there, and it sounds like it
should then start on boot.

But does that explain why the desktop crashed when I enabled
start-on-boot through shorewall.conf and /etc/defaults/shorewall? Does
the desktop need an ACCEPT $fw $fw rule to talk to its (local) display
server, or is the route from a zone to itself always implicitly allowed?

Regards - Philip

Post by Roberto C. Sánchez

Post by Philip Le Riche
Philip-Desktop ~ # apt-cache policy shorewall
Installed: 5.0.4-1

That version of Shorewall had a packaging bug such that it wouldn't
start on boot on systems running systemd.

Post by Philip Le Riche
I'm having difficulty working out what init system it uses and the release
notes don't seem to say. (I was brought up on SystemV inittab - I've got
the white hair - I just need the walking frame.) Running ps reports
process 1 as /sbin/init splash. There's no /etc/inittab but /etc/init is a
directory containing loads of .conf files including several
upstart-*.conf, smbd.conf and ssh.conf but no shorewall.conf, possibly
because I haven't started it.

What is the output of `apt-cache policy systemd`? If it reports
something in the version field for "Installed", then look at the output
of `systemctl is-enabled shorewall`. If that spits out "disabled" then
you can turn it on with `systemctl enable shorewall` and it will start
on boot as you would expect.
Regards,
-Roberto
------------------------------------------------------------------------------
_______________________________________________
Shorewall-users mailing list
https://lists.sourceforge.net/lists/listinfo/shorewall-users

[Roberto C. Sánchez]

Post by Philip Le Riche
OK, thanks, so on this near-clone system, systemd is installed and
systemctl shows  shorewall as disabled. When next I can get to the live
system (probably next week) I'll repeat it there, and it sounds like it
should then start on boot.

I hope that fixes the start-on-boot problem for you.

Post by Philip Le Riche
But does that explain why the desktop crashed when I enabled start-on-boot
through shorewall.conf and /etc/defaults/shorewall? Does the desktop need
an ACCEPT $fw $fw rule to talk to its (local) display server, or is the
route from a zone to itself always implicitly allowed?

I think that might be a different issue. Unless you have done something
peculiar with your configuration, $FW<->$FW connections should be
allowed by default.

To properly diagnose this, we will need the output of 'shorewall dump'
just after a boot/crash. It would be helpful if you could also include
other relevant logs (e.g., the Xorg.log).

Regards,

-Roberto

[Philip Le Riche]

I've just popped in to the school and the systemctl enable shorewall did
the trick.

Three or four reboots later I thought I'd seen the last of the desktop
crash, but then I was sorting out another problem - I have 16 DNAT rules
but had only added 8 extra IP addresses to the source NIC. After adding
the remaining 8 I rebooted and the desktop crashed. I was going to do a
shorewall dump as suggested but this crazy fallback desktop, would you
believe, doesn't provide a terminal! The usual ctl-alt-t didn't produce
one either. After rebooting it was fine and I'll probably never see it
again so it's not an issue for me. Probably I should have done a
shorewall reload before rebooting. If you can see theoretically why what
I did caused it to get into a strange state and can make it more robust,
then well and good.

I now just have one other unrelated problem and I'll start another
threadif I can't see how to fix it.

Thanks for your help and patience - regards - Philip

Post by Roberto C. Sánchez

Post by Philip Le Riche
OK, thanks, so on this near-clone system, systemd is installed and
systemctl shows shorewall as disabled. When next I can get to the live
system (probably next week) I'll repeat it there, and it sounds like it
should then start on boot.

I hope that fixes the start-on-boot problem for you.

Post by Philip Le Riche
But does that explain why the desktop crashed when I enabled start-on-boot
through shorewall.conf and /etc/defaults/shorewall? Does the desktop need
an ACCEPT $fw $fw rule to talk to its (local) display server, or is the
route from a zone to itself always implicitly allowed?

I think that might be a different issue. Unless you have done something
peculiar with your configuration, $FW<->$FW connections should be
allowed by default.
To properly diagnose this, we will need the output of 'shorewall dump'
just after a boot/crash. It would be helpful if you could also include
other relevant logs (e.g., the Xorg.log).
Regards,
-Roberto
------------------------------------------------------------------------------
_______________________________________________
Shorewall-users mailing list
https://lists.sourceforge.net/lists/listinfo/shorewall-users

[Philip Le Riche]

OK, this is getting too deep for me. On Linux Mint Cinnamon 18, I'm
running Shorewall and apache2 (and isc-dhcp-server, openssh-server and
samba). One of the interfaces apache is listening on has a number of
additional ip addresses matching DNAT rules. Apache fails to start on
boot because the attempt to listen on this interface (on the base IP
address) fails. It's not clear whether this is because shorewall is
still starting or because the basic networking is still messing about
adding IP addresses to the interface. Starting apache later by handworks
fine.

The whole init system on Mint 18 seems a mess. Shorewall is started by
systemd from /lib/systemd/shorewall.service, apache is started by SysV
init from /etc/init.d/apache2, whereas sshd and samba are started by
upstart from /etc/init/ssh.conf and /etc/init/samba.conf. I think in
fact systemd is masquerading as init - there's no inittab, but how
systemd and upstart dependencies are supposed to resolve is as yet a
mystery to me.

A long time ago (on Mint 17) I had a problem with sshd not starting
which was fixed by putting a sleep 5 in /etc/init/ssh.conf and this fix
also works on Mint18.

I could presumably put a sleep 5 in /etc/init.d/apache2 but the real
solution would be to sort out the dependencies. Any idea how to do that?

Regards - Philip

------------------------------------------------------------------------------

[Tom Eastep]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Post by Hristo Benev
Here is it...
ftp://ftp.shorewall.net/pub/shorewall/5.0/shorewall-5.0.12-/

For Betas, you should be looking in
ftp://ftp.shorewall.net/pub/shorewall/development/5.0/

- -Tom
- --
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: GPGTools - http://gpgtools.org

iQIcBAEBCAAGBQJX2c8+AAoJEJbms/JCOk0Q1BYP/RqpGp4mvp7QplICuAmn7X+m
TmSztCqUKpjtV3dCq/fxB8AtWxdQ244XzljYcp+UyzuGcv9/YqgOhdp8zKAYvJwY
wqrbej9ORSAeFEcAYBN/3ecibSotmmHncyAr3xtFpoyIJmjhSqiFiHNvSvyM0vDV
RDM2/9rqGxlvzsjtFbSfzxPbWuMBrvc+lsI8V7X2PQxqk8HmWovdohYyUEBKYDSr
imR2LRjUZp2938QIFNNJgP5p+4EGxa4LsiJedVWyGXy1UmO9N3CeE7KIv0NCj/WB
ciNRC7I7bLgGt+JYLpbqUryux80oCYItMKYfWFtCgrHGhP3uojXI+x9gHkdvIwxy
n9txzR6jaT0DLt+AYZG04RGh3d2CB4nMmJlej7RScmmKgPBHv9BfvRoK0YrVE7f5
odlaGNwpbZi3e5mT7R9OpU1tq/F144HN9RwJdFC4ASDxRJmFjQFGTamSIPVu1DC5
Pt6I8HpuKXc4SOXM26twChLKm/Qd9EttJEWy9HAPXkgdnNODSGlvGAzbCQWSiwmO
my4mWcjgAV2VsPyD0I6btVLA6qkP8lQUKe2bCtB6+g/GNMWP5qkxOqFUBE9TsbeH
+HkbekeFMhYWLhxKa04f8m16tEKRRRCL+mBx5fhR5ueVmhMMMWz9mKP/y3zhAvNN
oYHRXE5xTmfmKi1HN8dC
=ZMQ2
-----END PGP SIGNATURE-----

------------------------------------------------------------------------------

[Hristo Benev]

-------- Оригинално писмо --------
Относно: Re: [Shorewall-users] Shorewall 5.0.12 Beta 1
Изпратено на: 15.09.2016 01:29
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Post by Hristo Benev
Here is it...
ftp://ftp.shorewall.net/pub/shorewall/5.0/shorewall-5.0.12-/

For Betas, you should be looking in
ftp://ftp.shorewall.net/pub/shorewall/development/5.0/
- -Tom
- --
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: GPGTools - http://gpgtools.org
iQIcBAEBCAAGBQJX2c8+AAoJEJbms/JCOk0Q1BYP/RqpGp4mvp7QplICuAmn7X+m
TmSztCqUKpjtV3dCq/fxB8AtWxdQ244XzljYcp+UyzuGcv9/YqgOhdp8zKAYvJwY
wqrbej9ORSAeFEcAYBN/3ecibSotmmHncyAr3xtFpoyIJmjhSqiFiHNvSvyM0vDV
RDM2/9rqGxlvzsjtFbSfzxPbWuMBrvc+lsI8V7X2PQxqk8HmWovdohYyUEBKYDSr
imR2LRjUZp2938QIFNNJgP5p+4EGxa4LsiJedVWyGXy1UmO9N3CeE7KIv0NCj/WB
ciNRC7I7bLgGt+JYLpbqUryux80oCYItMKYfWFtCgrHGhP3uojXI+x9gHkdvIwxy
n9txzR6jaT0DLt+AYZG04RGh3d2CB4nMmJlej7RScmmKgPBHv9BfvRoK0YrVE7f5
odlaGNwpbZi3e5mT7R9OpU1tq/F144HN9RwJdFC4ASDxRJmFjQFGTamSIPVu1DC5
Pt6I8HpuKXc4SOXM26twChLKm/Qd9EttJEWy9HAPXkgdnNODSGlvGAzbCQWSiwmO
my4mWcjgAV2VsPyD0I6btVLA6qkP8lQUKe2bCtB6+g/GNMWP5qkxOqFUBE9TsbeH
+HkbekeFMhYWLhxKa04f8m16tEKRRRCL+mBx5fhR5ueVmhMMMWz9mKP/y3zhAvNN
oYHRXE5xTmfmKi1HN8dC
=ZMQ2
-----END PGP SIGNATURE-----
------------------------------------------------------------------------------
_______________________________________________
Shorewall-users mailing list
https://lists.sourceforge.net/lists/listinfo/shorewall-users

I know...

Just it looks like it is missing something and it break one of my scripts, but if it is intended no issue I have a workaround.

Thanks

Hristo

------------------------------------------------------------------------------