On Sat, 16 Jan 2016 11:06, Marguerite Su wrote:
Hi,
I packaged ocserv in network:vpn and I wanted to submit it to Factory.
Dominique suggests me to raise this topic.
I wrote the instruction in README.SUSE before:
#### Shutdown SUSEFirewall2 through YaST
Because I don't know how to convert iptables rules to SUSEFirewall2 ones. If you can help me, please fork this package and submit back.
#### Set iptables rules
sudo /sbin/iptables -A INPUT -p tcp --dport 9000 -j ACCEPT sudo /sbin/iptables -A INPUT -p udp --dport 9001 -j ACCEPT sudo /sbin/iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE sudo /sbin/iptables -A FORWARD -s 192.168.1.0/24 -j ACCEPT
The 9000/9001 ports, IP range 192.168.1.0/24 are default ones, you can change them in /etc/ocserv/ocserv.conf
Warning: Your eth0 may not exist, you can ifconfig -a to find yours.
#### Enable IP forward
sudo echo 1 > /proc/sys/net/ipv4/ip_forward
It doesn't live after reboot.
=====================================================
How can I achieve the same result without shutting SuSEFirewall2 down?
Any documentation I can learn from?
Marguerite
First: you can add iptables rules without shutting down SuSEFirewall2. ( for the ports drop a file into /etc/sysconfig/SuSEfirewall2.d/services/ ) Second: enabling ip forwarding, use sysctl for that. ( drop a file into /etc/sysctl.d/ ) Third: other vpn software has to do something similar. Have you taken a look there? See: /etc/sysconfig/SuSEfirewall2.d/services/TEMPLATE /etc/sysconfig/scripts/SuSEfirewall2-custom /usr/share/doc/packages/SuSEfirewall2/EXAMPLES OR: Build a script to run in the ExecPre= section of the systemd ocserv.service file. That's IMHO, not a final word of the security review team, which ocserv will have to pass to be accepted into factory. Have a nice weekend. - Yamaban. -- To unsubscribe, e-mail: opensuse-packaging+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-packaging+owner@opensuse.org