Re: Review of new English templates for miniupnpd

Yangfl wrote:
> Justin B Rye wrote:
>>    Be aware that the default settings for this package are only suitable for
>>    a system where the ports required are accessible. If a firewall has
>>    been set up blocking them, you should reject this option now, edit
>>    /etc/miniupnpd/miniupnpd.conf and the scripts in /etc/miniupnpd/*.sh
>>    appropriately, and enable the daemon later with "service miniupnpd enable".
>>
>> (I've no idea what the relevant ports are, so I hope your users can
>> think of some better search engine queries than I could.)
> 
> I should clarify that, upnpd daemon does nothing than maintaining a list of
> allow/deny rules.

Well, *and* actively setting up port-mappings/redirections, right?
But it all works through netfilter rules of some sort...

> Whether to use these rules, where these rules are placed,
> and what to do if no rules are match against the traffic is up to external
> configures, ie /etc scripts. As always, these scripts expect a very
> specific layout of firewall chains, if users have custom firewall
> rules/chains, things will break down.

In that case it might as well keep it simple:

 Be aware that the default settings for this package are only suitable for
 a system with no pre-existing firewall. If a firewall has already been set
 up, you should reject this option now, edit /etc/miniupnpd/miniupnpd.conf
 and the scripts in /etc/miniupnpd/ appropriately, and enable the daemon
 later with "service miniupnpd enable".
 
>>   .
>>>  Be extremely careful if you don't have physical access to the machine, as you
>>>  may be blocked by the firewall immediately.
>>
>> Because I might be using UPnP port redirection for my SSH connection?
>> Except that I haven't started the miniUPnP daemon yet, so how does
>> that work?
> 
> For some reasons the default action for unmatched traffic is drop.

I suspect the thing that's confusing me here is that "the firewall" in
this paragraph isn't the pre-existing firewall that we were talking
about above - instead you're talking about a new set of rules that
would be activated if I accepted this option?  If so, say something
more like:

 If you don't have physical access to the machine, be careful not to
 activate the daemon with rules that will block your connection.


So that would be:

 Template: miniupnpd/start_daemon
 Type: boolean
 Default: false
 _Description: Start the MiniUPnP daemon automatically?
  Choose this option if the MiniUPnP daemon should start automatically,
  now and at boot time.
  .
  Be aware that the default settings for this package are only suitable for
  a system with no pre-existing firewall. If a firewall has already been set
  up, you should reject this option now, edit /etc/miniupnpd/miniupnpd.conf
  and the scripts in /etc/miniupnpd/ appropriately, and enable the daemon
  later with "service miniupnpd enable".
  .
  If you don't have physical access to the machine, be careful not to
  activate the daemon with rules that will block your connection.
  .
  If in doubt, reject this option.