Re: shorewall-nft packages repo
Winston Sorfleet <[email protected]> Wed, 22 Jul 2026 22:04:42 -0400
| Newsgroups | gmane.comp.security.shorewall |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============7228259314037814224== Content-Type: multipart/alternative; boundary="------------VJhLE3olGmQXWnoSAKqU0kiF" Content-Language: en-US This is a multi-part message in MIME format. --------------VJhLE3olGmQXWnoSAKqU0kiF Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Also, is this supposed to work in shorewall6? /usr/local/src/shorewall-nft# PYTHONPATH=src python3 -m shorewall_nft check /etc/shorewall6 ERROR: /etc/shorewall6/rtrules:20: invalid rtrules interface name '[2607' Offending line: #SOURCE DEST PROVIDER PRIORITY# Anything sourcing from the teksavvy-supplied /64 internal address spaces goes out via teksavvy # Preferably, this should only be return traffic. [2607:f2c0:f00e:b700::/64] [2607:f2c0:f00e:b700::/64] main 900 [2607:f2c0:f00e:b700::/64] - teksavvy 901 # Anything sourcing from the rogers-supplied /64 internal address spaces goes out via rogers [2607:fea8:be20:7fc::/64] [2607:fea8:be20:7fc::/64] main 900 [2607:fea8:be20:7fc::/64] - rogers 901 (This is because I have multi-ISP and otherwise, traffic on one internal /64 goes out via the wrong external interface On 2026-07-22 6:49 p.m., Winston Sorfleet wrote: > > Doing a > > |PYTHONPATH=src python3 -m shorewall_nft check /etc/shorewall > shorewall-nft: warning: interfaces:12: interface option 'rpfilter' is > accepted but not yet enforced; anti-spoofing is NOT applied to this > interface. shorewall-nft: warning: interfaces:15: interface option > 'rpfilter' is accepted but not yet enforced; anti-spoofing is NOT > applied to this interface. shorewall-nft: warning: interfaces:16: > interface option 'rpfilter' is accepted but not yet enforced; > anti-spoofing is NOT applied to this interface. ERROR: > /etc/shorewall/rules:17: unknown zone all Suggests that it does not > recognize the old shorewall macro "all"? | > On 2026-07-22 2:51 a.m., Dave Kempe wrote: >> The process below will take care of that for you - they conflict, so >> it will uninstall the shorewall package and leave the config intact >> for you. >> The two packages can't be installed at once - they both provide the >> 'shorewall' binary (script) >> >> Dave >> >> On Wed, 22 Jul 2026 at 15:45, Witold Tosta <[email protected]> >> wrote: >> >> Hi Dave, >> >> Do I need to uninstall the old shorewall and shorewall6 packages >> first, leaving only the directories with the configuration files? >> Can the old shorewall packages be installed? I'm using Debian Trixie. >> >> Best regards, >> >> Witold Tosta >> >> wt., 21 lip 2026, 08:45 użytkownik Dave Kempe >> <[email protected]> napisał: >> >> Hey everyone, >> As a way to get started quickly, I have added shorewall-nft >> to the Sol1 packages repo. >> You can set it up here: https://packages.sol1.net/ >> and then simply: >> apt install shorewall-nft >> shorewall check >> shorewall migrate >> And you are done. >> >> If encounter any problems with check or migrate, you can back >> out and go back to shorewall, (apt install shorewall etc) >> Note that shorewall-nft conflicts with shorewall and will >> uninstall it, with the migrate command actually flushing >> iptables rules. >> >> I haven't got any packages repo for rpm based distros, as we >> are debian/ubuntu from way back, but I'm sure a quick rpm >> command will work the same sorta way. >> >> Dave >> >> _______________________________________________ >> Shorewall-users mailing list >> [email protected] >> https://lists.sourceforge.net/lists/listinfo/shorewall-users >> >> _______________________________________________ >> Shorewall-users mailing list >> [email protected] >> https://lists.sourceforge.net/lists/listinfo/shorewall-users >> >> >> >> _______________________________________________ >> Shorewall-users mailing list >> [email protected] >> https://lists.sourceforge.net/lists/listinfo/shorewall-users > > > _______________________________________________ > Shorewall-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/shorewall-users --------------VJhLE3olGmQXWnoSAKqU0kiF Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> </head> <body> <p>Also, is this supposed to work in shorewall6?</p> <p><br> </p> <p>/usr/local/src/shorewall-nft# PYTHONPATH=src python3 -m shorewall_nft check /etc/shorewall6<br> <br> ERROR: /etc/shorewall6/rtrules:20: invalid rtrules interface name '[2607'</p> <p>Offending line:</p> <p>#SOURCE DEST PROVIDER PRIORITY# Anything sourcing from the teksavvy-supplied /64 internal address spaces goes out via teksavvy<br> # Preferably, this should only be return traffic.<br> [2607:f2c0:f00e:b700::/64] [2607:f2c0:f00e:b700::/64] main 900<br> [2607:f2c0:f00e:b700::/64] - teksavvy 901<br> <br> # Anything sourcing from the rogers-supplied /64 internal address spaces goes out via rogers<br> [2607:fea8:be20:7fc::/64] [2607:fea8:be20:7fc::/64] main 900<br> [2607:fea8:be20:7fc::/64] - rogers 901<br> <br> </p> <p>(This is because I have multi-ISP and otherwise, traffic on one internal /64 goes out via the wrong external interface</p> <div class="moz-cite-prefix">On 2026-07-22 6:49 p.m., Winston Sorfleet wrote:<br> </div> <blockquote type="cite" cite="mid:[email protected]"> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <p>Doing a </p> <pre class="notranslate"><code>PYTHONPATH=src python3 -m shorewall_nft check /etc/shorewall shorewall-nft: warning: interfaces:12: interface option 'rpfilter' is accepted but not yet enforced; anti-spoofing is NOT applied to this interface. shorewall-nft: warning: interfaces:15: interface option 'rpfilter' is accepted but not yet enforced; anti-spoofing is NOT applied to this interface. shorewall-nft: warning: interfaces:16: interface option 'rpfilter' is accepted but not yet enforced; anti-spoofing is NOT applied to this interface. ERROR: /etc/shorewall/rules:17: unknown zone all Suggests that it does not recognize the old shorewall macro "all"? </code></pre> <div class="moz-cite-prefix">On 2026-07-22 2:51 a.m., Dave Kempe wrote:<br> </div> <blockquote type="cite" cite="mid:CAEc_UVSaEXCRwBCugzsa+p5oWtuJ_cGKwSKW-3Dc0WzVTJRLkQ@mail.gmail.com"> <meta http-equiv="content-type" content="text/html; charset=UTF-8"> <div dir="ltr"> <div>The process below will take care of that for you - they conflict, so it will uninstall the shorewall package and leave the config intact for you.</div> <div>The two packages can't be installed at once - they both provide the 'shorewall' binary (script)</div> <div><br> </div> <div>Dave</div> <br> <div class="gmail_quote gmail_quote_container"> <div dir="ltr" class="gmail_attr">On Wed, 22 Jul 2026 at 15:45, Witold Tosta <<a href="mailto:[email protected]" moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a>> wrote:<br> </div> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <div dir="auto"> <div>Hi Dave,</div> <div dir="auto"><br> </div> <div dir="auto">Do I need to uninstall the old shorewall and shorewall6 packages first, leaving only the directories with the configuration files? Can the old shorewall packages be installed? I'm using Debian Trixie.</div> <div dir="auto"><br> </div> <div dir="auto">Best regards,</div> <div><br> </div> <div> <div dir="ltr"> <div>Witold Tosta</div> </div> </div> </div> <br> <div class="gmail_quote"> <div dir="ltr" class="gmail_attr">wt., 21 lip 2026, 08:45 użytkownik Dave Kempe <<a href="mailto:[email protected]" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a>> napisał:<br> </div> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <div dir="ltr"> <div>Hey everyone,</div> <div>As a way to get started quickly, I have added shorewall-nft to the Sol1 packages repo.</div> <div>You can set it up here: <a href="https://packages.sol1.net/" rel="noreferrer" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">https://packages.sol1.net/</a></div> <div>and then simply:</div> <div>apt install shorewall-nft</div> <div>shorewall check</div> <div>shorewall migrate</div> <div>And you are done.</div> <div><br> </div> <div>If encounter any problems with check or migrate, you can back out and go back to shorewall, (apt install shorewall etc)</div> <div>Note that shorewall-nft conflicts with shorewall and will uninstall it, with the migrate command actually flushing iptables rules.</div> <div><br> </div> <div>I haven't got any packages repo for rpm based distros, as we are debian/ubuntu from way back, but I'm sure a quick rpm command will work the same sorta way.</div> <div><br> </div> <div>Dave</div> <div><br> </div> </div> _______________________________________________<br> Shorewall-users mailing list<br> <a href="mailto:[email protected]" rel="noreferrer" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a><br> <a href="https://lists.sourceforge.net/lists/listinfo/shorewall-users" rel="noreferrer noreferrer" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">https://lists.sourceforge.net/lists/listinfo/shorewall-users</a><br> </blockquote> </div> _______________________________________________<br> Shorewall-users mailing list<br> <a href="mailto:[email protected]" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a><br> <a href="https://lists.sourceforge.net/lists/listinfo/shorewall-users" rel="noreferrer" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">https://lists.sourceforge.net/lists/listinfo/shorewall-users</a><br> </blockquote> </div> </div> <br> <fieldset class="moz-mime-attachment-header"></fieldset> <br> <fieldset class="moz-mime-attachment-header"></fieldset> <pre wrap="" class="moz-quote-pre">_______________________________________________ Shorewall-users mailing list <a class="moz-txt-link-abbreviated moz-txt-link-freetext" href="mailto:[email protected]" moz-do-not-send="true">[email protected]</a> <a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/shorewall-users" moz-do-not-send="true">https://lists.sourceforge.net/lists/listinfo/shorewall-users</a> </pre> </blockquote> <br> <fieldset class="moz-mime-attachment-header"></fieldset> <br> <fieldset class="moz-mime-attachment-header"></fieldset> <pre wrap="" class="moz-quote-pre">_______________________________________________ Shorewall-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> <a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/shorewall-users">https://lists.sourceforge.net/lists/listinfo/shorewall-users</a> </pre> </blockquote> </body> </html> --------------VJhLE3olGmQXWnoSAKqU0kiF-- --===============7228259314037814224== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============7228259314037814224== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline