From mboxrd@z Thu Jan 1 00:00:00 1970 From: Thomas Berthel To: documentation@lists.ipfire.org Subject: Re: VLAN Konfig Date: Sun, 09 Jun 2013 18:40:56 +0200 Message-ID: <51B4B018.5030908@gmx.net> In-Reply-To: <580058B1-FD74-408F-9D62-CC7D00ABE55B@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============8864884793109533352==" List-Id: --===============8864884793109533352== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hi, > This was more a question then a statement ;-) me too ;-) > This is really strange, have no clue why this happens. There is not the Problem - i must restart my FW and then all Modus1 and Custom-changes Rules back. > Which rules did you try to edit ? Only in my firewall.local file, and then i stop and start the /etc/init.d/firewall. I check the WhatsApp-Ports in WUI for Blue. He did nothing - then i change it in my firewall.local the functionality was there. As I see it, everything is well controlled in the IPTables and nothing in the WUI. :( BG, Thomas Am 09.06.2013 15:31, schrieb Erik K.: >=20 > Am 09.06.2013 um 13:58 schrieb Thomas Berthel: >=20 >> >>> I meant in this section --> http://wiki.ipfire.org/de/optimization/vlan/s= tart#iptables_uebersicht are only spts: to be seen, but no dpts: in the rules= you define "--dports 993,995,110,587,465" but they are listed as "spts:" (so= urce ports) for example i have in the iptables -L listing for Mail something = like this >>> RETURN tcp -- 192.168.7.0/24 anywhere multiport dp= orts imaps,urd,submission,pop3s,smtp TIME from 00:00:00 to 00:00:00 UTC >>> so the dports are specified. I can=C2=B4t find something like that in you= r iptables -L listing. >> >> Ah. I'm using dport for single port (dpts:52 for DNS) an multiport >> dports for more destination ports, is this not okay? >=20 > O.K. my bad have overseen it. >=20 >> >>> So you have allowed only unprivileged ports as a source port, but isn=C2= =B4t it that the case per default anyway ? Or do you regard a security method= with this ?=20 >>> So i=C2=B4am also not sure with this, but if you define only --dports isn= =C2=B4t it the same behavior anyway with the source port then you defined it ? >> >> is this a default? Sorry, i don't now. Is that so wrong? >=20 > This was more a question then a statement ;-) >=20 >> >>> What rules do you use in Mode 1 ? >> >> A lot of rules ;) I can't post it here... one snipp: DNS, Mail, >> Game-Ports, Whois, FTP, NTP and ssh for green, red and all interfaces. >> >> But these rules are all double in my tables after the restart. >=20 > May it is because you define them in firewall.local also ? Did you try a co= mplete reboot ? >=20 >> Another >> problem is when I usually re-upload my FW mode 0 although the WUI shows >> me mode 1. >=20 > This is really strange, have no clue why this happens.=20 >=20 >> >> I have all my ports manually specified are no longer seen in the tables, >> only when I reboot the FW. >=20 > Have had the same issue since i was working a little bit with firewall.loca= l. After modifications of firewall.local and stop|start|restart|reload tests = the iptables -L listing shows me sometimes nothing in the CUSTOM chains. It s= eems that the best way is to reboot IPFire . Important to test this behavior = with the new Firewall. I think in Core 69 (test image) the new FW is already = implemented. >=20 >> >>> Ahh O.K. but is it possible to arrange rules for the VLAN interfaces over= the WUI (e.g. DMZ pinnholes, etc...) ? >>> So maybe it is less complicated (especially for the explanations in the w= iki) if all the rules which can be arranged over the WUI will be set in that = way ? MIght be nice if you can go for a try . So also if the outgoing FW will= be configured, i think the CUSTOMFORWARD rules are defined then in the FORWA= RD and OUTPUT chains. >> >> I just tested it on wui and FW mode 1 do not apply the rules. It seems >> as if for wireless (blue) and the rule come from a different direction >> no matter what is stored in the WUI. >=20 > Which rules did you try to edit ? >=20 >> >> _______________________________________________ >> Documentation mailing list >> Documentation(a)lists.ipfire.org >> http://lists.ipfire.org/mailman/listinfo/documentation >=20 > _______________________________________________ > Documentation mailing list > Documentation(a)lists.ipfire.org > http://lists.ipfire.org/mailman/listinfo/documentation >=20 --===============8864884793109533352==--