shorewall-announce — Shoreline Firewall announcements

[Shorewall-announce] Change of mailing list address

[Tom E. <te...@sh...>]

In preparation for splitting the list server off from my mail server, I 
have updated all of the mailing lists. The list addresses are:

Users: sho...@li...
Announce: sho...@li...
Devel: sho...@li...

The old addresses will continue to work for a while but I urge you to 
update your address book now as the old addresses will eventually be 
rejected.

If you are using the envelope sender to sort your incoming mail, you need 
to note that the sender is now:

<list-name>-bo...@li...
                    ------

Please update your filters accordingly.

-Tom
--
Tom Eastep   \ Shorewall - iptables made easy
Shoreline,    \ http://www.shorewall.net
Washington USA \ te...@sh...

[Shorewall-announce] Re: [Shorewall-users] Future of Shorewall (was Shorewall-1.3.13)

[Tom E. <te...@sh...>]

--On Wednesday, January 15, 2003 8:57 AM +0000 Julian Church 
<jc...@lj...> wrote:

> Tom
>
> There's no reason you should let a complete stranger question your better
> judgement, but weren't you supposed to be taking a break from all of this?
>

The problem I am having is "Now what do I do with myself in the early 
mornings and evenings?":

a) It's winter here so I can't work out in the yard (and I really don't 
enjoy that much anyway).
b) I don't care for television except for sports.
c) My parents and my wife's mother (where my wife is staying) live 4-5 
hours away (each way) so it's not as if I can run out and see them in the 
evenings.
d) Going for walks in the dark is ok but....
e) I read a couple of hours a day and that's enough.

It has given me a chance to ponder the future of Shorewall though and I've 
concluded that the Shorewall community has reached the size where I can't 
do all of the jobs by myself:

a) Designer/developer
b) Support/Free Networking Consultant
c) Documentation
d) Web site administration
e) Mail Server administration
f) Mailing List/Search engine administration (Including spam control)

Trying to do all of these jobs, handling my own full-time job, and caring 
for aging and ill parents is becoming too much. The result is that I have 
developed a very short fuse when it comes to questions on the user's list; 
I'm sure that all of you who subscribe have noticed. And a number of you 
have stepped forward to help with the support load for which I am extremely 
grateful.

With the kind help of Alex Martin, I'm getting out of the business of 
running a web site (although as of this moment, I'm still responsible for 
the content and I still have responsibility for running the mailing 
list/search engine web interfaces).

Recently, several of you have begun sending me patches for inclusion in 
Shorewall. I think that's great and I very much welcome your participation. 
Unfortunately, with everything else I have to do to run this project, 
evaluating patches is still pretty low on my priority list. Please be 
patient.

So I'm still looking for more volunteers.

a) Maintainer of the Samples -- There has been a lot of pleading about 
"Don't take away the comments in the config files!!!!". Most of you have to 
update the comments in one configuration and you probably don't install 
every release. Maintaining the samples requires updating the %$#@ comments 
in THREE configurations on EVERY release. The comments in the 
shorewall.conf file in the .lrp also have to be updated for each release 
since that file is different from the standard one.

b) Maintainer of the .lrp. -- We have maintainers for Debian and GenToo -- 
would be great if someone stepped forward to be the maintainer of the .lrp 
(preferably someone who runs Bering and can actually test the thing before 
it goes out the door).

c) Documentation -- There are a number of areas where the documentation 
still needs expansion. For example, we have several outstanding questions 
on the ML about multiple IPSEC tunnels and how to configure them. I know 
that there are people on this list that have experience in that area 
whereas I don't. Now I have a good idea about how to go about configuring 
such a setup but I don't have the time, energy or resources to actually do 
it.

We've also had the suggestion that a text version of the documentation 
would be good for installation on firewall boxes without X. Good idea but I 
didn't hear anyone volunteering to do it. So in a very real sense, this 
becomes another "Hey, Tom -- here's something else that YOU can do for US 
in your spare time".

A number of these things would probably be easier if the documentation was 
translated to SGML -- I've thought about it but it is not something that's 
ever popped to the top of my stack of things to do.

I also have a suspicion that someone who is competent in web site design 
(which certainly excludes me) could make the web site/documentation a lot 
easier to navigate.

d) Mailing List/Search engine administration -- I would love to get this 
off of my site. The two must go together because of the size of the archive 
that needs to be indexed daily. Right now, an MTA somewhere in Hitachi is 
bouncing list posts as Spam and I haven't had a chance to deal with it yet.

Unless other folks become involved in an active and ongoing way with this 
project, Shorewall can't continue to grow -- there are only so many hours 
in my day and no more.

-Tom
--
Tom Eastep   \ Shorewall - iptables made easy
AIM: teastep  \ http://shorewall.sf.net
ICQ: #60745924 \ te...@sh...

[Shorewall-announce] Shorewall-1.3.13

[Tom E. <te...@sh...>]

Just some stuff that was laying around in CVS:

1. Added 'DNAT-' target.

2. Print policies in 'check' command.

3. Added CLEAR_TC option.

4. Added SHARED_DIR option.

[teastep@wookie Shorewall]$ cat releasenotes.txt
This is a minor release of Shorewall that has a couple of new features.

New features include:

1) A new 'DNAT-' action has been added for entries in the
   /etc/shorewall/rules file. DNAT- is intended for advanced users who
   wish to minimize the number of rules that connection requests must
   traverse.

   A Shorewall DNAT rule actually generates two iptables rules: a
   header rewriting rule in the 'nat' table and an ACCEPT rule in the
   'filter' table. A DNAT- rule only generates the first of these
   rules. This is handy when you have several DNAT rules that would
   generate the same ACCEPT rule.

   Here are three rules from my previous rules file:

        DNAT   net  dmz:206.124.146.177 tcp smtp - 206.124.146.178
        DNAT   net  dmz:206.124.146.177 tcp smtp - 206.124.146.179
        ACCEPT net  dmz:206.124.146.177 tcp www,smtp,ftp,...

   These three rules ended up generating _three_ copies of

         ACCEPT net  dmz:206.124.146.177 tcp smtp

   By writing the rules this way, I end up with only one copy of the
   ACCEPT rule.

        DNAT-  net  dmz:206.124.146.177 tcp smtp -  206.124.146.178
        DNAT-  net  dmz:206.124.146.177 tcp smtp -  206.124.146.179
        ACCEPT net  dmz:206.124.146.177 tcp www,smtp,ftp,...

2) The 'shorewall check' command now prints out the applicable policy
   between each pair of zones.

3. A new CLEAR_TC option has been added to shorewall.conf. If this
   option is set to 'No' then Shorewall won't clear the current
   traffic control rules during [re]start. This setting is intended
   for use by people that prefer to configure traffic shaping when
   the network interfaces come up rather than when the firewall
   is started. If that is what you want to do, set TC_ENABLED=Yes and
   CLEAR_TC=No and do not supply an /etc/shorewall/tcstart file. That
   way, your traffic shaping rules can still use the 'fwmark'
   classifier based on packet marking defined in /etc/shorewall/tcrules.

4. A new SHARED_DIR variable has been added that allows distribution
   packagers to easily move the shared directory (default
   /usr/lib/shorewall). Users should never have a need to change the
   value of this shorewall.conf setting.

-Tom
--
Tom Eastep   \ Shorewall - iptables made easy
Shoreline,    \ http://shorewall.sf.net
Washington USA \ te...@sh...

[Shorewall-announce] Re: Shorewall in print

[Tom E. <te...@sh...>]

--On Tuesday, January 14, 2003 10:20:00 AM -0700 Gar Nelson 
<Gar...@no...> wrote:

> Shorewall is briefly mentioned, and a web link listed, in the "Increase
> Bandwidth with Wireless Devices" article, SysAdmin Magazine, Feb 2003,
> page 20.

Thanks, Gar!

-Tom
--
Tom Eastep   \ Shorewall - iptables made easy
Shoreline,    \ http://shorewall.sf.net
Washington USA \ te...@sh...

[Shorewall-announce] Shorewall site search is now available again

[Tom E. <te...@sh...>]

I have been separating the content of my site into mailing list and other 
content with an eye toward moving the main site to another system. In that 
process, I managed to break the search function.

I believe that I have everything put back together now -- please let me 
know if you find any problems.

Again, I apologize for the inconvenience.

-Tom
--
Tom Eastep   \ Shorewall - iptables made easy
Shoreline,    \ http://shorewall.sf.net
Washington USA \ te...@sh...

[Shorewall-announce] MRTG drop/reject hits 1.3

[SHOREWALL T. <sho...@ti...>]

mrtg-drop-hits v1.3

Thanx a lot to Steve Cowles for his help and improvements

CHANGELOG:

1.3    - 2003-01-10
  - fix:=20size of counter=5Ffile equals zero
  - Bering/ash compatibiliy added by Steve Cowles
  - INSTALL.snmp added by Steve Cowles
  - small cleanup in INSTALL

ftp://slovakia.shorewall.net/mirror/shorewall/mrtg/
http://slovakia.shorewall.net/pub/shorewall/mrtg/
rsync://slovakia.shorewall.net/shorewall/mrtg/

example: http://slovakia.shorewall.net/pub/shorewall/mrtg/example/

Juraj

[Shorewall-announce] Mailing List Archive Search

[Tom E. <te...@sh...>]

The archive search is broken currently -- I believe that I have found the 
problem and am running the indexing process right now. It should be 
available within a couple of hours.

Sorry for the inconvenience.

-Tom
--
Tom Eastep    \ Shorewall - iptables made easy
Shoreline,     \ http://shorewall.sf.net
Washington USA  \ te...@sh...

[Shorewall-announce] new debian release for shorewall-1.3.12

[Lorenzo M. <lor...@po...>]

Hello,
I build a new debian release 1.3.12stable-3 to fix some bugs.

ChangeLog
---------

1.3.12stable-3

* /var/state/ does no longer exist. The SUBSYSLOCK variable of
  shorewall.conf is set to /var/lib/shorewall/state according to FSH
  (closes: #174776).
* /usr/lib/shorewall contained only architecture independent files, those
  files are moved to /usr/share/shorewall according to FSH (closes: #173266)

1.3.12stable-2

* included in shorewall-doc some configuration examples (closes: #175411)

-- lorenzo

Re: [Shorewall-announce] MRTG drop/reject hits

[Jacky H. <ck...@sc...>]

Dear,

   This is a great tool!! Thanks Juraj.
   And thanks Tom as well.. Take a nice break!


Jacky

SHOREWALL TimeLord wrote:

>I have created shell script for MRTG statistics of droped/rejected packets:
>
>ftp://slovakia.shorewall.net/mirror/shorewall/mrtg/
>http://slovakia.shorewall.net/pub/shorewall/mrtg/
>rsync://slovakia.shorewall.net/shorewall/mrtg/
>
>example: http://slovakia.shorewall.net/pub/shorewall/mrtg/example/
>
>It is not based on /var/log/messages (syslog), but iptables counter.
>A lot of packets are droped/rejected silently and that's why statistics from
>syslog is not real.
>
>Version for general MRTG statistics of any packets (droped/rejected/accepted)
>comming soon (I hope :o) )
>
>Juraj
>
>
>_______________________________________________
>Shorewall-announce mailing list
>Sho...@sh...
>http://www.shorewall.net/mailman/listinfo/shorewall-announce
>
>  
>

Re: [Shorewall-announce] MRTG drop/reject hits

[Jacky H. <ck...@sc...>]

SHOREWALL TimeLord wrote:

>I have created shell script for MRTG statistics of droped/rejected packets:
>
>ftp://slovakia.shorewall.net/mirror/shorewall/mrtg/
>http://slovakia.shorewall.net/pub/shorewall/mrtg/
>rsync://slovakia.shorewall.net/shorewall/mrtg/
>
>example: http://slovakia.shorewall.net/pub/shorewall/mrtg/example/
>
>It is not based on /var/log/messages (syslog), but iptables counter.
>A lot of packets are droped/rejected silently and that's why statistics from
>syslog is not real.
>
>Version for general MRTG statistics of any packets (droped/rejected/accepted)
>comming soon (I hope :o) )
>
>Juraj
>
>
>_______________________________________________
>Shorewall-announce mailing list
>Sho...@sh...
>http://www.shorewall.net/mailman/listinfo/shorewall-announce
>
>  
>

[Shorewall-announce] Thank You

[Tom E. <te...@sh...>]

My thanks go to each of you who have taken a moment to wish me well.

-Tom

[Shorewall-announce] MRTG drop/reject hits

[SHOREWALL T. <sho...@ti...>]

I have created shell script for MRTG statistics of droped/rejected packets:

ftp://slovakia.shorewall.net/mirror/shorewall/mrtg/
http://slovakia.shorewall.net/pub/shorewall/mrtg/
rsync://slovakia.shorewall.net/shorewall/mrtg/

example: http://slovakia.shorewall.net/pub/shorewall/mrtg/example/

It is not based on /var/log/messages (syslog), but iptables counter.
A lot of=20packets are droped/rejected silently and that's why statistics=
 from
syslog is not real.

Version for general MRTG statistics=20of any packets (droped/rejected/accep=
ted)
comming soon (I hope :o) )

Juraj

[Shorewall-announce] Mailing Lists

[Tom E. <te...@sh...>]

I don't intend to shut down my server during my "down time" so the existing 
mailing lists can continue in my absence.

-Tom
--
Tom Eastep    \ Shorewall - iptables made easy
Shoreline,     \ http://shorewall.sf.net
Washington USA  \ te...@sh...

[Shorewall-announce] Some time off

[Tom E. <te...@sh...>]

Until further notice, I will not be involved in Shorewall development or 
support.

-Tom
--
Tom Eastep   \ Shorewall - iptables made easy
Shoreline,    \ http://shorewall.sf.net
Washington USA \ te...@sh...

[Shorewall-announce] Re: [Shorewall-users] PDF - Shorewall 1.3.12

[Tom E. <te...@sh...>]

--On Monday, December 30, 2002 12:07:00 PM +0100 SHOREWALL TimeLord 
<sho...@ti...> wrote:

>
> PDF Documentation for Shorewall 1.3.12:
>
> ftp://slovakia.shorewall.net/mirror/shorewall/pdf/
> http://slovakia.shorewall.net/pub/shorewall/pdf/
> rsync://slovakia.shorewall.net/shorewall/pdf/
>
> Sorry for delay .. you know .. Christmas, party, wine .. etc ;o)
>

Thanks, Juraj!

Happy New Year,
-Tom
--
Tom Eastep   \ Shorewall - iptables made easy
Shoreline,    \ http://shorewall.sf.net
Washington USA \ te...@sh...

[Shorewall-announce] HTML Posts -- Take 2

[Tom E. <te...@sh...>]

I had expected to be out of town this weekend so when I plans suddenly 
changed, I responded to a nudge from a list member and investigated means 
for stripping html from list posts. It turns out that MailMan 2.1 has this 
capability and since I run MailMan for my list server, that seemed like a 
good fit.

After a couple false starts trying to upgrade, I think that I have it 
running.

One thing to note. Mailman 2.0 used "<list-name>-a...@sh..." as 
the envelope sender; Mailman 2.1 uses "<list-name>-bo...@sh...". 
Update your mail sorting filters accordingly.

I currently have shorewall-users configured to drop text/html and allow all 
other mime types.

The shorewall-announce and shorewall-devel lists will only accept:

	multipart/mixed
	multipart/alternative
	text/plain

-Tom
--
Tom Eastep   \ Shorewall - iptables made easy
Shoreline,    \ http://shorewall.sf.net
Washington USA \ te...@sh...

[Shorewall-announce] Mailing List Web Site Problems Corrected

[Tom E. <te...@sh...>]

During today's power outage, the /var partition on my server did not escape 
undamaged. I think that I have corrected the problems and that the mailing 
list subscription URLs are operational again.

-Tom
--
Tom Eastep    \ Shorewall - iptables made easy
Shoreline,     \ http://shorewall.sf.net
Washington USA  \ te...@sh...

[Shorewall-announce] Shorewall 1.3.12 Released

[Tom E. <te...@sh...>]

New features include:

1) "shorewall refresh" now reloads the traffic shaping rules (tcrules
   and tcstart).

2) "shorewall debug [re]start" now turns off debugging after an error
   occurs. This places the point of the failure near the end of the
   trace rather than up in the middle of it.

3) "shorewall [re]start" has been speeded up by more than 40% with
   my configuration. Your milage may vary.

4) A "shorewall show classifiers" command has been added which shows
   the current packet classification filters. The output from this
   command is also added as a separate page in "shorewall monitor"

5) ULOG (must be all caps) is now accepted as a valid syslog level and
   causes the subject packets to be logged using the ULOG target rather
   than the LOG target. This allows you to run ulogd (available from
   www.gnumonks.org/projects/ulogd) and log all Shorewall messages to
   a separate log file.

6) If you are running a kernel that has a FORWARD chain in the mangle
   table ("shorewall show mangle" will show you the chains in the
   mangle table), you can set MARK_IN_FORWARD=Yes in
   shorewall.conf. This allows for marking inbound packets based on
   their destination even when you are using Masquerading or SNAT.

7) I have cluttered up the /etc/shorewall directory with empty 'init',
   'start', 'stop' and 'stopped' files. If you already have a file with
   one of these names, don't worry -- the upgrade process won't
   overwrite your file.

8) I have added a new RFC1918_LOG_LEVEL variable to
   shorewall.conf. This variable specifies the syslog level at which
   packets are logged as a result of entries in the
   /etc/shorewall/rfc1918 file. Previously, these packets were always
   logged at the 'info' level.

Happy New Year!
-Tom
--
Tom Eastep   \ Shorewall - iptables made easy
Shoreline,    \ http://shorewall.sf.net
Washington USA \ te...@sh...

[Shorewall-announce] shorewall.net may be down for a while today

[Tom E. <te...@sh...>]

A violent wind storm is expected in western Washington state later today 
and such storms often produce power/communications outages. I'll do what I 
can to keep things running here.

-Tom
--
Tom Eastep   \ Shorewall - iptables made easy
Shoreline,    \ http://shorewall.sf.net
Washington USA \ te...@sh...

[Shorewall-announce] Happy Holidays

[Tom E. <te...@sh...>]

I will be taking a few days off to be with my family over Christmas. May 
peace and happiness be with you and your loved ones during this holiday 
season.

-Tom
--
Tom Eastep   \ Shorewall - iptables made easy
Shoreline,    \ http://shorewall.sf.net
Washington USA \ te...@sh...

[Shorewall-announce] Shorewall 1.3.12 Beta3

[Tom E. <te...@sh...>]

Due to the blacklisting bug found yesterday in Beta 2, I've released Beta 3.

You can download from:

	http://www.shorewall.net/pub/shorewall/Beta
	ftp://ftp.shorewall.net/pub/shorewall/Beta

Happy Holidays,
-Tom
--
Tom Eastep   \ Shorewall - iptables made easy
Shoreline,    \ http://shorewall.sf.net
Washington USA \ te...@sh...

[Shorewall-announce] Location of Beta

[Tom E. <te...@sh...>]

And the Beta may be downloaded from:

	http://www.shorewall.net/pub/shorewall/Beta
	ftp://ftp.shorewall.new/pub/shorewall/Beta

-Tom
--
Tom Eastep   \ Shorewall - iptables made easy
Shoreline,    \ http://shorewall.sf.net
Washington USA \ te...@sh...

[Shorewall-announce] Shorewall 1.3.12 Beta 2

[Tom E. <te...@sh...>]

The first public Beta of Shorewall 1.3.12 is now available:

New features include:

1) "shorewall refresh" now reloads the traffic shaping rules (tcrules
   and tcstart).

2) "shorewall debug [re]start" now turns off debugging after an error
   occurs. This places the point of the failure near the end of the
   trace rather than up in the middle of it.

3) "shorewall [re]start" has been speeded up by more than 40% with
   my configuration. Your milage may vary.

4) A "shorewall show classifiers" command has been added which shows
   the current packet classification filters. The output from this
   command is also added as a separate page in "shorewall monitor"

5) ULOG (must be all caps) is now accepted as a valid syslog level and
   causes the subject packets to be logged using the ULOG target rather
   than the LOG target. This allows you to run ulogd (available from
   http://www.gnumonks.org/projects/ulogd) and log all Shorewall
   messages to a separate log file.

6) If you are running a kernel that has a FORWARD chain in the mangle
   table ("shorewall show mangle" will show you the chains in the
   mangle table), you can set MARK_IN_FORWARD=Yes in
   shorewall.conf. This allows for marking input packets based on their
   destination even when you are using Masquerading or SNAT.

7) I have cluttered up the /etc/shorewall directory with empty 'init',
   'start', 'stop' and 'stopped' files. If you already have a file with
   one of these names, don't worry -- the upgrade process won't overwrite 
your
   file.

-Tom
--
Tom Eastep   \ Shorewall - iptables made easy
Shoreline,    \ http://shorewall.sf.net
Washington USA \ te...@sh...

[Shorewall-announce] Shorewall on Steroids

[Tom E. <te...@sh...>]

Today, the Mandrake Store here in the US have made available for sale their 
"Multi Network Firewall" (MNF). MNF is built around Shorewall and has a lot 
of nice features including a cool GUI. MNF has been under development for 
almost a year and is Mandrake's next-generation firewall product.

For those of you who are using Shorewall in a commercial environment and 
who are looking for a complete vendor-supported firewalling solution with 
Shorewall's flexibility, please consider MNF (http://www.mandrakestore.com).

I will be installing MNF on my own firewall in the near future and will 
keep you posted regarding my experience.

-Tom
--
Tom Eastep   \ Shorewall - iptables made easy
Shoreline,    \ http://shorewall.sf.net
Washington USA \ te...@sh...

[Shorewall-announce] Thank You!

[Tom E. <te...@sh...>]

I would like very much to thank those of you who have made a contribution 
to the Starlight Foundation on my behalf. Your generosity in support of 
this very worthwhile cause is much appreciated.

Happy Holidays to All!
-Tom
--
Tom Eastep    \ Shorewall - iptables made easy
AIM: tmeastep  \ http://shorewall.sf.net
ICQ: #60745924  \ te...@sh...