Development

development@lists.ipfire.org

3 participants
6355 discussions

Pakfire3 running on IPFire 2
by Michael Tremer 18 Oct '12

18 Oct '12

Hello, Erik and Stefan, you have been working on getting pakfire 3 working on IPFire 2, recently. I tried to build it today just for my little testing games and there are still (at least) two requirements missing: elfutils and beecrypt. So the question is: Did you disable parts of the package so you won't need those two or did I miss to merge a patch you sent me? I would like to have pakfire3 as a regular package in IPFire 2, because a lot of people would like to use IPFire 2 as a build platform for IPFire 3. Setting up an other box with some mainstream distro is just extra work. Michael

2 2

Questions for adding code
by Alexander Marx 17 Oct '12

17 Oct '12

Hi list! As i only know ipcop, i hope you can help me here. I am thinking of developing some extracode for being able to configure vpn-Firewall rules via WUI. I don't know how to start. I just want to create a cgi, that is similar to the outgoing firewall with the exception that this configures the CUSTOMFORWARD Chain. The gui should create a txt file with the rules.... I need to know: 1) Where should i beginn to make ipfire read the rules on boot?! 2) How do i implement the code in the checked-out git repository local? 3) did i forget something? Greetings alex

2 1

Re: Firewall Question
by Michael Tremer 17 Oct '12

17 Oct '12

On Sat, 2012-10-13 at 19:54 +0200, Alexander Marx wrote: > Am 13.10.2012 19:18, schrieb Michael Tremer: > >> I already tried to play with the OVPNFORWARD Chain but had no luck. > > You should use CUSTOMFORWARD/CUSTOMINPUT for those rules. > ok. But why are there the chains OVPNINPUT and OVPNFORWARD?! > As far as i understand right now, these chains should be DROP ore > flushed, when Firewall is in mode 1, right? > And to think a bit further, when someone begins to develop an addon or > core function to create rules > for CUSTOMFORWARD with a webgui, is this sufficient for creating a > INCOMING Firewall?! (I know its FORWARD-Chain) > But i hope you understand what i mean. Those chains have been introduced with the OpenVPN addon. It was intended to build in-tunnel filtering, but that has never been implemented. If you would like to implement filtering for VPN tunnels, please use those chains. Don't put anything into CUSTOM* because these are for rules that are manually created by the user. OVPNINPUT and OVPNFORWARD work in exactly the same way. Same for IPSECINPUT and IPSECFORWARD. > >> It would be great if one can say: > >> Hey, VPN1 is only allowed to connect to my internal servers 192.168.0.2 > >> and 192.168.0.3 via RDP (3389) > >> ans that via gui > > You can use the outgoing firewall to limit some sorts of traffic, but > > you cannot block incoming packets with it. > > > >> I already developed addons for ipcop, but ipfire seems complete different... > > No, the web UI is pretty much the same (crap). The firewall scripts do > > not differ too much, either. > Well the way ipfire is compiled and the way addons are created is much > more complicated at a first sight. Indeed, there is a detailed guide how to start on our wiki. http://wiki.ipfire.org/en/development/build > If i would understand how to add changes to the ipfire, maybe i would > begin to develop some sort of > gui for creating some firewall-rules. > I think it is not so difficult, because it just takes a textfile for the > rules, and a table in webinterface where the rule positions can be > changed and created. And a funvtion, that reads the rules on every reboot. > > Do you agree so far?!! Yes, that's the way. Maybe it is a good idea to integrate that as native as possible into the WUI, because there already too many possibilities how to add firewall rules (portfw, xtaccess, outgoing firewall,...). Michael

1 0

Firewall Question
by Alexander Marx 13 Oct '12

13 Oct '12

Dear developers. Are there any plans to implement the possibillity to create firewall rules for openvpn subnets? Actually all vpn connections are able to do anything in the remotenetwork The only solution is to put own iptables rule in the /etc/sysconfig/firewall.local I already tried to play with the OVPNFORWARD Chain but had no luck. It would be great if one can say: Hey, VPN1 is only allowed to connect to my internal servers 192.168.0.2 and 192.168.0.3 via RDP (3389) ans that via gui I already developed addons for ipcop, but ipfire seems complete different... Greetings Al

2 1

Translation updates
by Michael Tremer 09 Oct '12

09 Oct '12

Hello, as of today, there are two new language teams working on translating the software of the IPFire project. The new languages are: Khmer (Cambodia) https://www.transifex.com/projects/p/ipfire/language/km_KH/ Catalan https://www.transifex.com/projects/p/ipfire/language/ca/ I am very happy that so many people are joining the translation project and help IPFire to make its way into the world. Despite the language teams, that have just started their work, there is plenty of work to do on other languages as well. If you speak one of those languages, please join. https://www.transifex.com/projects/p/ipfire/ Michael

1 0

New tool - pyPDNS
by Stefan Schantl 02 Oct '12

02 Oct '12

Hello, today I want to introduce you to pyPDNS. I is designed as an administration tool for the authoritative DNS server from PowerDNS, and is completely written in Python. When development has been finished, it's goal will be to get, add / remove or to edit zones and their records directly on the PDNS sqlite3 database backend. It will be possible to use it as a command line interface or by import it into other python applications like the web interface of IPFire 3. I've just created the git repository and pushed it on our git server, so the development process is an an very early state and a lot of important functions are still missing. At the moment it is only possible to use the API and the CLI to get the configured zones and records. If you are interested on these tool, you can get the source code here: http://git.ipfire.org/?p=people/stevee/pypdns.git;a=summary

2 2

Re: Issues w/ .13 so far
by Michael Tremer 19 Sep '12

19 Sep '12

Sorry for the delay. On Wed, 2012-09-12 at 20:21 +0200, Stefan G. Weichinger wrote: > ps: regarding this mailing list: > > Why do the headers of the mailing-list-mails not contain a "List-Id" ? I > use that for server-based filtering with other lists. Very handy ... I don't know. Does mailman support "List-Id"? RFC-2369 headers are enabled, so I guess that will include List-Id.

2 7

Issues w/ .13 so far
by Stefan G. Weichinger 17 Sep '12

17 Sep '12

greets, I am new to this list, afai see my issues weren't mentioned before, so I think they aren't FAQ ;-) Both seem to be WebGUI-issues. I installed from scratch onto CF-card, running on an older ALIX board. Restored my backup pulled from the former 2.11 core 62 installation. My DHCP-setup seemed to be there, but didn't work ... fixed leases were visible but didn't get pulled by the devices (laptop, tablet, phone). Maybe I should have rebooted once more (I think I did anyway ...), will retest after writing this mail. Additional: tried to re-add a fixed lease via GUI. I usually want to say "add fixed lease for this MAC currently using a dynamic lease" ... then MAC and IP are "copied" into the field "Neue Zuordnung", I normally edit the IP (and description), then ADD. Now the dynamic lease gets added to the fixed lease before, so the MAC is already there and ADDing fails. (minor issue aside: typo in german dhcp.gi: "Globaler Bereich oder begenze Bereich" ... should be "begrenze") - With IPSEC I had the case of mismatching display: connected tunnels seemed disactivated and vice versa, see attachment. Right now it looks ok. Will retest w/ other tunnels soon. Greets, Stefan (rebooting now)

2 4

openvpn broken in 13
by R. W. Rodolico 17 Sep '12

17 Sep '12

there was a bug for core61, I found a problem with OpenVPN. The discussion is at http://forum.ipfire.org/index.php/topic,6773.0.html. This problem still exists in the beta. ummeegge created a patch that repairs the issue, and it should be put into ovpnmain.cgi. It appears, in the tests I ran, to solve the issue. Rod

3 8

Possible bug in 13
by R. W. Rodolico 12 Sep '12

12 Sep '12

This may not be a bug. I am messing with something I do not understand very well. However, I was able to get an error message when trying to add a rule to QOS. Steps taken: 1. Add parent class 2. Class: 190, Interface Red0, Priority 1, Guaranteed Bandwidth 325, Maximum Bandwidth 6514, Burst null, Ceil Burst null, TOS 0, Remark "Daily Data ssh" 3. Add new port rule, tcp source 54555 4. Add new port rule, tcp destination 54555 Red graph now shows error message The image "https://10.111.163.1:444/cgi-bin/qos.cgi?red0?hour" can not be displayed, because it contains errors" Anything I should to to investigate? Or, possibly I need to simply wait until the rrd's are updated, in which case I'd think the error message should read "updating" or something. Rod -- R. W. "Rod" Rodolico Daily Data, Inc. POB 140465 Dallas TX 75214-0465 http://www.dailydata.net 214.827.2170

2 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development