April 2004 - openSUSE Security - openSUSE Mailing Lists

AW: [suse-security] List down?
by dag Danczul Georg 14 Apr '04

14 Apr '04

yep.... :-) georg >-----Ursprüngliche Nachricht----- >Von: sematin(a)mtn.co.ug [mailto:sematin@mtn.co.ug] >Gesendet: Mittwoch, 14. April 2004 15:58 >An: Andreas.Bock(a)nupis.de; suse-security(a)suse.com >Betreff: RE: [suse-security] List down? > > > >Must be the latter...:-D > >Noah. > >> -----Original Message----- >> From: Andreas Bock [mailto:Andreas.Bock@nupis.de] >> Sent: 14 April 2004 16:56 >> To: suse-security(a)suse.com >> Subject: [suse-security] List down? >> >> >> Is the list down, or is everyone still in Easter vacation? >> >> Andreas >> >> -- >> Check the headers for your unsubscription address >> For additional commands, e-mail: suse-security-help(a)suse.com >> Security-related bug reports go to security(a)suse.de, not here >> >> > >-- >Check the headers for your unsubscription address >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here > >

1 0

List down?
by Andreas Bock 14 Apr '04

14 Apr '04

Is the list down, or is everyone still in Easter vacation? Andreas

1 0

Newbie TCP Wrappers
by Paul Dean 12 Apr '04

12 Apr '04

Hi all, I'm still learning about Linux and trying to make my home network reasonably secure. I have a network with a Red Hat 8 server which I am trying to replace with SuSE 9. On the Red Hat server I had iptables, portsentry, tripwire and TCP wrappers running. Where can I find information on setting up tcp wrappers with SuSE ? I've set up my hosts.allow and hosts.deny. Is there anything else I need to do ? Any views on Portsentry? It doesn't seem to be on the Psionic site. Is it still supported ? Thanks a lot Paul

2 1

RE: [suse-security] Linux as a commercial alternative to a Cisco router
by sematin＠mtn.co.ug 12 Apr '04

12 Apr '04

Which can be found at http://open.com.au/radiator Noah. > -----Original Message----- > From: Mark Tinka [mailto:aknit444@yahoo.com] > Sent: 09 April 2004 16:34 > To: Lars Ellenberg; suse-security(a)suse.com > Subject: Re: [suse-security] Linux as a commercial > alternative to a Cisco router > > > --- Lars Ellenberg <l.g.e(a)web.de> wrote: > > / 2004-04-07 18:21:25 +0100 > > > I think I have seen this setup somewhere. Probably > > needs to use some > > pam module authenticating against radius. Don't > > know exactly how to > > configure this, though. > > u might want to look at Radiator RADIUS.. it supports > a ton of applications and is easily configurable for > authentication against your MySQL database.. no PAM modules > required.. > > > > > Lars Ellenberg > > Regards, > > Mark. > > __________________________________ > Do you Yahoo!? > Yahoo! Small Business $15K Web Design Giveaway > http://promotions.yahoo.com/design_giveaway/ > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

1 0

IP6
by Ivan Yosifov 09 Apr '04

09 Apr '04

Hello All, Does SuSEfirewall work with ip6, if not will it anytime soon? When entering IP6 addrs in vars like FW_TRUSTED_NETS in /etc/sysconfig/SuSEfirewall2 i get error messages on firewall startup saying iptables does not recognize them.Also when I ping the ip6 localhost with firewall running I get bivus@localhost:~> ping6 ::1 PING ::1(::1) 56 data bytes ping: sendmsg: Operation not permitted ping: sendmsg: Operation not permitted ping: sendmsg: Operation not permitted ... When the firewall is not running ping6 works ok.What can I do about this ? Ivan Yosifov.

3 3

Linux as a commercial alternative to a Cisco router
by Carl Peto 09 Apr '04

09 Apr '04

I am planning to set up ADSL access in to our group of servers at a secure location. The ISPs we have been in touch with will give us a 100Mbit ethernet VLAN to their network so that the L2TP connections from our clients' DSL routers can terminate in our equipment. We are aware that Cisco 3600 series routers can do this but they cost something like £10,000 !! We are interested in getting an alternative running. I suggested that we get a reasonably solid (e.g. Dell) 1U server with SuSE Linux server or SLES and two fast ethernet cards. The questions are these... 1) Can one of the SuSE Linux products (doesn't matter which, we can afford it) act as a fully fledged router? 2) Can it do VLANs over ethernet? 3) Can it act as a LNS for an L2TP circuit, such as those from DSL routers, authenticating against a RADIUS server? 4) Has anyone done anything like this before? It's been surprisingly hard to answer these questions, Googling, etc.! Thanks and Regards, Carl Peto

6 6

RE: [suse-security] Multiple Internal Networks not Routing
by sematin＠mtn.co.ug 07 Apr '04

07 Apr '04

> -----Original Message----- > From: Philipp Rusch [mailto:philipp.rusch@rusch-edv.de] > Sent: 07 April 2004 10:50 > To: suse-security(a)suse.com > Subject: Re: [suse-security] Multiple Internal Networks not Routing > >> In your case, if you are still free to choose your network > adresses > >> and don't have more than 254 hosts, I would strongly > recommend that > >> you go for something like 192.168.1.x/24 on eth1 and > 192.168.2.y/24 > >> on eth2 or if you have more hosts, go for 172.16.1.x/16 on eth1 if > >> there is the majority of your hosts and take > 192.168.2.x/24 for eth2. You do not necessarily have to stick to the old "class" boundaries. You can choose to use only the 172.16.x.x/16 range and then sub divide it into smaller or bigger parts for each network using variable length subnet masks like the /20 /19 /22 etc which give you more hosts without restricting you to the old class boundaries which is exactly what CIDR was meant to solve. ( CIDR= Classless InterDomain Routing) Noah.

3 2

RE: [suse-security] Multiple Internal Networks not Routing
by sematin＠mtn.co.ug 07 Apr '04

07 Apr '04

> -----Original Message----- > From: Philipp Rusch [mailto:philipp.rusch@rusch-edv.de] > Sent: 07 April 2004 11:17 > To: suse-security(a)suse.com > Subject: Re: [suse-security] Multiple Internal Networks not Routing > > > Yes, of course, these classes were never meant to be fix. > But I doubt that M$ clients always stick to the rules when it > comes to routing .... Have you ever tried to "convince" a w2k > DHCP server to hand out "non-standard" ip adresses/masks? Had > a server doing it correctly in the morning and after several > hours it did something else but not what was defined. Have > several experiences like this, never had a problem with > unusual ip/mask combinations with cisco routers for instance. > > Just my 2 cents, Philipp For the record, I do have a win2k DHCP server doing exactly that and it is perfoming quite ok. Maybe you need to apply some "service packs" and any other relevant patches. Of course a linux DHCP server would be preferable if you do not have "political reasons" for running M$ products. ( where political= management) Noah.

1 0

Re: [suse-security] Multiple Internal Networks not Routing
by Philipp Rusch 07 Apr '04

07 Apr '04

Jason, Ok, we are one step further ! To clarify: (this has been defined like that, there is no obvious technical reason for that, ok there are some reasons, but that would lead us too far) there are classes of IP-networks: A-class : mask /8 B-class : mask /16 C-class : mask /24 which some special adresses reserved for "private use", which means, these are "unrouteable" adresses in terms of internet routes, that's the reason for NAT, for instance. OK, 10.a.b.c "normally" has to have a /8 mask (type A class) you can divide this huge network of 16*16*16 hosts in smaller nets using a /16 or a /24 mask for instance. 172.16.m.n "normally" has to have a /16 mask (type B class) but the same concept of breaking it down into parts applies as above, you are free to do so. 192.168.x.y "normally" has to have a /24 mask (type C class) which implies that you choose the "x" and then this part of the network address is fix for your setup. The advantage of having a 10.a.b.c/8 network instead of a 192.168.x.y/24 is that you can have more hosts belonging to the *same" network without the need to route. In your case, if you are still free to choose your network adresses and don't have more than 254 hosts, I would strongly recommend that you go for something like 192.168.1.x/24 on eth1 and 192.168.2.y/24 on eth2 or if you have more hosts, go for 172.16.1.x/16 on eth1 if there is the majority of your hosts and take 192.168.2.x/24 for eth2. Next question: what are the routing entries of your Windows PCs? They have to know about the other net as well ! Post a route print example output of both networks back here. Regards, Philipp Jason Dobbs schrieb: > Ok here is the tracert data: > > From a windows PC (192.168.65.228) to a windows PC (10.62.56.8) > ----------------------------------------------------------------- > 1 <1 ms <1 ms <1 ms 192.168.66.252 > 2 * * * Request timed out. > 3 * * * Request timed out. > 4 * * * Request timed out. > 5 * * * Request timed out. > > > > /var/log/messages > ----------------------------------------------------------------- > Apr 6 04:22:47 terminator kernel: SuSE-FW-TRACEROUTE-ATTEMPT IN= > OUT=eth1 SRC=192.168.66.252 DST=192.168.65.228 LEN=120 TOS=0x00 > PREC=0xC0 TTL=64 ID=1245 PROTO=ICMP TYPE=11 CODE=0 [SRC=192.168.65.228 > DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 TTL=1 ID=1530 PROTO=ICMP > TYPE=8 CODE=0 ID=512 SEQ=24065 ] > Apr 6 04:22:47 terminator kernel: SuSE-FW-TRACEROUTE-ATTEMPT IN= > OUT=eth1 SRC=192.168.66.252 DST=192.168.65.228 LEN=120 TOS=0x00 > PREC=0xC0 TTL=64 ID=1246 PROTO=ICMP TYPE=11 CODE=0 [SRC=192.168.65.228 > DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 TTL=1 ID=1531 PROTO=ICMP > TYPE=8 CODE=0 ID=512 SEQ=24321 ] > Apr 6 04:22:47 terminator kernel: SuSE-FW-TRACEROUTE-ATTEMPT IN= > OUT=eth1 SRC=192.168.66.252 DST=192.168.65.228 LEN=120 TOS=0x00 > PREC=0xC0 TTL=64 ID=1247 PROTO=ICMP TYPE=11 CODE=0 [SRC=192.168.65.228 > DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 TTL=1 ID=1532 PROTO=ICMP > TYPE=8 CODE=0 ID=512 SEQ=24577 ] > Apr 6 04:22:48 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=1 ID=1534 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=24833 > Apr 6 04:22:52 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=1 ID=1577 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=25089 > Apr 6 04:22:56 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=1 ID=1579 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=25345 > Apr 6 04:23:01 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=2 ID=1581 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=25601 > Apr 6 04:23:05 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=2 ID=1589 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=25857 > Apr 6 04:23:10 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=2 ID=1591 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=26113 > Apr 6 04:23:14 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=3 ID=1593 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=26369 > Apr 6 04:23:19 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=3 ID=1597 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=26625 > Apr 6 04:23:23 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=3 ID=1599 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=26881 > Apr 6 04:23:28 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=4 ID=1601 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=27137 > Apr 6 04:23:32 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=4 ID=1605 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=27393 > Apr 6 04:23:37 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=4 ID=1607 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=27649 > Apr 6 04:23:41 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=5 ID=1609 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=27905 > > > 192.168.66.252 is the gateway for the 192.168.0.0/16 network. > 10.62.56.252 is the gateway for the 10.62.56.0/24 network. > > as far as your note on /16 and /24 ... maybe I have them backwards! I > though 192.168.0.0 was /16 and 10.62.56.0 was /24!!!!!! <-- Please > clearify this! > > Thank You, > Jason Dobbs . IT Manager > Westin Casuarina Casino Las Vegas > > > > Philipp Rusch wrote: > >> Hello Jason, >> OK, I see ... >> what about my note about /16 and /24 masks ? >> do you *have* to do it like that ? >> >> When you leave both FW_MASQ_NETS="" (empty) >> and FW_FORWARD="" (empty) >> and do a traceroute from a host on eth1 to a host on eth2 >> or vice versa, what do you see in the firewall logs in >> /var/logs/messages ? >> >> Lets get this to work, Philipp >> >> Jason Dobbs schrieb: >> >>> Kernel IP routing table >>> Destination Gateway Genmask Flags Metric Ref >>> Use Iface >>> <public ip> 0.0.0.0 255.255.255.128 U 0 >>> 0 0 eth0 >>> 10.62.56.0 0.0.0.0 255.255.255.0 U 0 >>> 0 0 eth2 >>> 192.168.0.0 0.0.0.0 255.255.0.0 U 0 >>> 0 0 eth1 >>> 0.0.0.0 <public gw> 0.0.0.0 UG 0 0 >>> 0 eth0 >>> >>> ip forwarding is turned on in yast! >>> >>> Thank You, >>> Jason Dobbs . IT Manager >>> Westin Casuarina Casino Las Vegas >>> p. 702.836.5939 f. 270.913.7462 >>> mailto: jdobbs(a)casuarinacasino.com >>> >>> >>> >>> Philipp Rusch wrote: >>> >>>> Hi Jason what is your routing table looking like ? >>>> post route -nv back here >>>> are you routing at all ? (set ip_forward=yes in YAST) >>>> >>>> other comments inline ... >>>> >>>> Jason Dobbs schrieb: >>>> >>>>> --SNIP --- >>>> >>>> >>>> >>>> >>>> >>>>> FW_MASQ_NETS="192.168.65.224/27 10.62.56.0/24 192.168.0.0/16,<mail >>>>> server ip>/32 10.62.56.0/24,<mail server ip>/32" >>>> >>>> >>>> >>>> >>>> >>>> ----------------------------------^ this >>>> ----------------------------------and this ^ is redundant, >>>> 192.168.65.224/27 is completely contained >>>> in 192.168.0.0./16 network, which means all 192.168."something" >>>> nets ... >>>> you know that normally 192.168.x.y net is a /24-type network and a >>>> 10.x.y.z has a /16 type mask ?? >>>> >>>> --SNIP-- >>>> >>>>> FW_FORWARD="192.168.0.0/16,10.62.56.0/24,tcp,1:65535 >>>>> 10.62.56.0/24,192.168.0.0/16,tcp,1:65535 \ >>>>> 192.168.0.0/16,10.62.56.0/24,udp,1:65535 >>>>> 10.62.56.0/24,192.168.0.0/16,udp,1:65535 \ >>>>> 192.168.0.0/16,10.62.56.0/24,icmp >>>>> 10.62.56.0/24,192.168.0.0/16,icmp" >>>>> FW_FORWARD_MASQ="0/0,192.168.65.227,tcp,5800 >>>>> 0/0,192.168.65.227,tcp,5900 \ >>>>> 0/0,192.168.65.227,tcp,5632 0/0,192.168.65.227,udp,5632" >>>> >>>> >>>> >>>> >>>> >>>> what are you trying to do here ? >>>> If routing just doesn't work then forwarding doesn't help that much >>>> ... >>>> >>>> I think something different is causing your troubles than missing >>>> entries here, >>>> seems you did to much of a work, it is normally quite simple, what >>>> you try to do :-) >>>> >>>> Regards from Germany, Philipp >>>> >>>> >>> >>> >> >> > >

3 4

Re: AW: AW: [suse-security] Multiple Internal Networks not Routing
by Jason Dobbs 07 Apr '04

07 Apr '04

Robert, Yeah the GW is correct for both networks and I can ping both GWs. I can even ping the far side of the box (i.e. - On 192.168.65.228 I can ping it's Gw of 192.168.66.252 and the 10.62.56.x GW of 10.62.56.252. I however can't ping any other 10.62.56.x address. The same goes for any traffic from the 10.62.56.x network to the 192.168.x.x network. 192.168.65.228 Route Print Dump ------------------------------------------------------ Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.66.252 192.168.65.228 20 10.62.56.0 255.255.255.0 192.168.66.252 192.168.65.228 1 127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1 192.168.0.0 255.255.0.0 192.168.65.228 192.168.65.228 20 192.168.65.228 255.255.255.255 127.0.0.1 127.0.0.1 20 192.168.65.255 255.255.255.255 192.168.65.228 192.168.65.228 20 224.0.0.0 240.0.0.0 192.168.65.228 192.168.65.228 20 255.255.255.255 255.255.255.255 192.168.65.228 192.168.65.228 1 Default Gateway: 192.168.66.252 =========================================================================== Persistent Routes: None ***NOTE*** ---- I added the 10.62.56.0 route hoping to produce results. This however did not work either and has been removed. Thank You, Jason Dobbs . IT Manager Westin Casuarina Casino Las Vegas Rasp, Robert wrote: >Jason, > >Routing on the Router is looking good, i think... >Is the Default-Gateway set correct on the workstations ? >Can you Ping this IP ??? > >Can i have the routingtable from your router and the IP's of the Networkcards. >Can i have a Routing-Table from one client on each Network (Windows --> route print) > >CU >Robert > > >-----Ursprüngliche Nachricht----- >Von: Jason Dobbs [mailto:jdobbs@casuarinacasino.com] >Gesendet: Dienstag, 6. April 2004 22:37 >An: suse-security(a)suse.com >Betreff: Re: AW: [suse-security] Multiple Internal Networks not Routing > > >Robert, > >ETH1 Dump >------------------------------------------ >tcpdump: listening on eth1 >05:33:19.653787 192.168.65.228 > 10.62.56.8: icmp: echo request >05:33:24.707194 192.168.65.228 > 10.62.56.8: icmp: echo request >05:33:30.207866 192.168.65.228 > 10.62.56.8: icmp: echo request >05:33:35.708547 192.168.65.228 > 10.62.56.8: icmp: echo request > >4 packets received by filter >0 packets dropped by kernel > > >ETH2 Dump >------------------------------------------- >tcpdump -pni eth2 icmp >tcpdump: listening on eth2 >05:33:19.654447 192.168.65.228 > 10.62.56.8: icmp: echo request >05:33:24.707232 192.168.65.228 > 10.62.56.8: icmp: echo request >05:33:30.207911 192.168.65.228 > 10.62.56.8: icmp: echo request >05:33:35.708586 192.168.65.228 > 10.62.56.8: icmp: echo request > >4 packets received by filter >0 packets dropped by kernel > > >192.168.65.228 trying to ping 10.62.56.8 >--------------------------------------------------- >Pinging 10.62.56.8 with 32 bytes of data: > >Request timed out. >Request timed out. >Request timed out. >Request timed out. > >Ping statistics for 10.62.56.8: > Packets: Sent = 4, Received = 0, Lost = 4 (100% loss), > > > > >IP-Forwarding >---------------------------------------- >cat /proc/sys/net/ipv4/ip_forward <enter> >1 > > > >Thank You, >Jason Dobbs . IT Manager >Westin Casuarina Casino Las Vegas > > > >Rasp, Robert wrote: > > > >>Hello, >> >>i had this problem by my self... i hate routing sometimes ;-) >>Is IP-Forwaring enabled (cat /proc/sys/net/ipv4/ip_forward) >>Try this: >>Open two Shell's and start "tcpdump -pni eth1 icmp" on one Shell and >>"tcpdump -pni eth2 icmp" on the other. >>Try the Ping again and watch the results... >> >>CU >>Robert >> >> >>-----Ursprüngliche Nachricht----- >>Von: Jason Dobbs [mailto:jdobbs@casuarinacasino.com] >>Gesendet: Dienstag, 6. April 2004 21:49 >>An: Rasp, Robert >>Betreff: Re: *****list-suse***** AW: [suse-security] Multiple Internal >>Networks not Routing >> >> >>Robert, >> >>I took the firewall script down and tried a ping from 192.168.65.228 to >>10.62.56.8 and got the same results, request timed out. >> >>Thank You, >>Jason Dobbs . IT Manager >>Westin Casuarina Casino Las Vegas >> >> >> >>Rasp, Robert wrote: >> >> >> >> >> >>>Hello, >>> >>>if i had this problem, i try it without firewall first.... >>>Then you can be sure your routing is ok. >>>It may be better to stay offline while the firewallscript isn't runnung :-) >>> >>>CU >>>Robert >>> >>>-----Ursprüngliche Nachricht----- >>>Von: Jason Dobbs [mailto:jdobbs@casuarinacasino.com] >>>Gesendet: Dienstag, 6. April 2004 17:18 >>>An: suse-security(a)suse.com >>>Betreff: [suse-security] Multiple Internal Networks not Routing >>> >>> >>>Hi, >>> >>>Hoping someone can point out my mistake here! I have SuSE 9.0 running >>>with 3 NICS (eth0=internet, eth1=192.168.0.0/16, and >>>eth2=10.62.56.0/24). Everything with the internet is working great. The >>>problem is routing traffic between eth1 and eth2. I've set both networks >>>as trusted, set FW_FORWARD, and enabled FW_ALLOW_CLASS_ROUTING. Nothing >>>has seemed to work. Posted is also a copy of my >>>/etc/sysconfig/SuSEfirewall2. I'd like to allow all traffic between >>>these 2 networks. >>> >>>Any ideas? >>> >>>------------------------------------------------------------------- >>>FW_QUICKMODE="no" >>>FW_DEV_EXT="eth0" >>>FW_DEV_INT="eth1 eth2" >>>FW_DEV_DMZ="" >>>FW_ROUTE="yes" >>>FW_MASQUERADE="yes" >>>FW_MASQ_DEV="$FW_DEV_EXT" >>>FW_MASQ_NETS="192.168.65.224/27 10.62.56.0/24 192.168.0.0/16,<mail >>>server ip>/32 10.62.56.0/24,<mail server ip>/32" >>>FW_PROTECT_FROM_INTERNAL="no" >>>FW_AUTOPROTECT_SERVICES="yes" >>>FW_SERVICES_EXT_TCP="http https ssh" >>>FW_SERVICES_EXT_IP="" >>>FW_SERVICES_DMZ_TCP="" >>>FW_SERVICES_DMZ_IP="" >>>FW_SERVICES_INT_TCP="" >>>FW_SERVICES_INT_UDP="" >>>FW_SERVICES_INT_IP="" >>>FW_SERVICES_QUICK_TCP="" >>>FW_SERVICES_QUICK_UDP="" >>>FW_SERVICES_QUICK_IP="" >>>FW_TRUSTED_NETS="192.168.0.0/16 10.62.56.0/24" >>>FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" >>>FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" >>>FW_SERVICE_AUTODETECT="yes" >>>FW_SERVICE_DNS="yes" >>>FW_SERVICE_DHCLIENT="no" >>>FW_SERVICE_DHCPD="yes" >>>FW_SERVICE_SQUID="yes" >>>FW_SERVICE_SAMBA="no" >>>FW_FORWARD="192.168.0.0/16,10.62.56.0/24,tcp,1:65535 >>>10.62.56.0/24,192.168.0.0/16,tcp,1:65535 \ >>> 192.168.0.0/16,10.62.56.0/24,udp,1:65535 >>>10.62.56.0/24,192.168.0.0/16,udp,1:65535 \ >>> 192.168.0.0/16,10.62.56.0/24,icmp 10.62.56.0/24,192.168.0.0/16,icmp" >>>FW_FORWARD_MASQ="0/0,192.168.65.227,tcp,5800 0/0,192.168.65.227,tcp,5900 \ >>> 0/0,192.168.65.227,tcp,5632 0/0,192.168.65.227,udp,5632" >>>FW_REDIRECT="" >>>FW_LOG_DROP_CRIT="yes" >>>FW_LOG_DROP_ALL="yes" # Jason Dobbs >>>FW_LOG_ACCEPT_CRIT="yes" >>>FW_LOG_ACCEPT_ALL="yes" # Jason Dobbs >>>FW_LOG="--log-level warning --log-tcp-options --log-ip-option >>>--log-prefix SuSE-FW" >>>FW_KERNEL_SECURITY="yes" >>>FW_STOP_KEEP_ROUTING_STATE="no" >>>FW_ALLOW_PING_FW="yes" >>>FW_ALLOW_PING_DMZ="no" >>>FW_ALLOW_PING_EXT="no" >>>FW_ALLOW_FW_TRACEROUTE="yes" >>>FW_ALLOW_FW_SOURCEQUENCH="yes" >>>FW_ALLOW_FW_BROADCAST="no" >>>FW_IGNORE_FW_BROADCAST="yes" >>>FW_ALLOW_CLASS_ROUTING="yes" >>>FW_CUSTOMRULES="" >>>FW_REJECT="no" >>>FW_HTB_TUNE_DEV="" >>>----------------------------------------------------------------------------------- >>> >>> >>> >>> >>> >>> >>> >> >> >> >> >> > > > >

3 4