[Shorewall-users] shorewall stop and routing

[s***@iotti.biz]

Hi all,

I use shorewall in a two node active/backup firewall cluster. I issue
shorewall stop on the inactive node to apply the rules described in
stoppedrules, just to protect the backup node itself. Unfortunately,
shorewall stop has the (for me) unwanted side effect of enabling routing,
i.e. put 1 in /proc/sys/net/ipv4/ip_forward. This produces some problems,
mainly with proxy arp.
I would like to ask if there is a builtin way to make shorewall disable
routing, only when invoked with stop (I am aware of the IP_FORWARDING
setting which however is not specific fo stop).

Just for completeness, my stoppedrules file lists only rules where $FW is
the source or the destination. So routing, in my case, should not be needed.
Maybe I'm using too much fantasy, but I think it would be even nicer if
routing would be automatically disabled in such a situation.

Thank you
Luigi


------------------------------------------------------------------------------

[Tom Eastep]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Post by s***@iotti.biz
Hi all,
I use shorewall in a two node active/backup firewall cluster. I
issue shorewall stop on the inactive node to apply the rules
described in stoppedrules, just to protect the backup node itself.
Unfortunately, shorewall stop has the (for me) unwanted side effect
of enabling routing, i.e. put 1 in /proc/sys/net/ipv4/ip_forward.
This produces some problems, mainly with proxy arp. I would like to
ask if there is a builtin way to make shorewall disable routing,
only when invoked with stop (I am aware of the IP_FORWARDING
setting which however is not specific fo stop).
Just for completeness, my stoppedrules file lists only rules where
$FW is the source or the destination. So routing, in my case,
should not be needed. Maybe I'm using too much fantasy, but I think
it would be even nicer if routing would be automatically disabled
in such a situation.

Why don't you simply place this in /etc/shorewall/stopped?

echo 0 > /proc/sys/net/ipv4/ip_forward

- -Tom
- --
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: GPGTools - http://gpgtools.org

iQIcBAEBCAAGBQJYPag1AAoJEJbms/JCOk0QS6IQAK16GYq1lZxNpfuIBtKjG08U
5Zqnf6diF8BbRAECXdXJHlq8cSNzMMyKGWjugddlJV70ub7xwYHLtfk0DEb8aBPm
5Ket3WA0FGDjWOi0W3cua11nMYctZUdoLOSdIX+ZOR+/QfPuM9y2WTlZxRp5BbzI
MlpxcdqdEydNepnTj9aNBpXMy/gSbXDavLWpcTh2kr381hvJ8UTE/pdQmOeZicEw
8AN8P7FwJ5FDi8o4zGAv9a5cmmZlNW5CKwvg+5jUlpmzevZYytxV9smkD7iB+k/K
7SCT7PW04DgDwG9/rBxraUhc1ncjRswdmoig7xAIs9CXZIn+eSYLyzlTJ9aPqfd9
yUl/JXPuGcdgHd3yV8yWFthuhdqOt7HyjDHth5Kfo+e61soHDjwqWgDf9CSmwPFV
cj1FeAxO3npFRyoe3Qsq0Zhfd/IcyUpjT6ajsI6PVZYhqXGhc93OPzhdICUrz3kG
wyQG2HUBlj1O3DW+ecf6Oio1YiVFFt+IW2dUFPyLFCEWjuqhfdqryq9JyKNKjtKe
M/hlGFl+i3xUTdRf9KGT99QzkvaEKKPilcppnL5/fu82+f/x/0KE1XY1oxJVj6HS
nKn1zBzZVQi8DV3qH2iYa0vhpClCzgd/gp6a1ByBChKIA4LgiU55Y8E8vbYSUgr8
gIH5PWWZ/dSWnyU5beVs
=buP8
-----END PGP SIGNATURE-----

------------------------------------------------------------------------------

[s***@iotti.biz]

---Messaggio originale-----
Inviato: martedì 29 novembre 2016 17:09
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Post by s***@iotti.biz
Hi all,
I use shorewall in a two node active/backup firewall cluster. I issue
shorewall stop on the inactive node to apply the rules described in
stoppedrules, just to protect the backup node itself.
Unfortunately, shorewall stop has the (for me) unwanted side effect of
enabling routing, i.e. put 1 in /proc/sys/net/ipv4/ip_forward.
This produces some problems, mainly with proxy arp. I would like to
ask if there is a builtin way to make shorewall disable routing, only
when invoked with stop (I am aware of the IP_FORWARDING setting which
however is not specific fo stop).
Just for completeness, my stoppedrules file lists only rules where $FW
is the source or the destination. So routing, in my case, should not
be needed. Maybe I'm using too much fantasy, but I think it would be
even nicer if routing would be automatically disabled in such a
situation.

Why don't you simply place this in /etc/shorewall/stopped?
echo 0 > /proc/sys/net/ipv4/ip_forward

Yes that's what I'm doing actually. I was only curious if there was some
setting built-in, mainly because it seems strange to me (but my point of
view can be particular) that when the firewall is being stopped, ip_forward
is actively set to 1.

Thank you, regards
Luigi


------------------------------------------------------------------------------