ipcop-devel Mailing List for IPCop Firewall

I'm thumping my head against IPSec traversal of a netgear NAT firewall.  it 
claims to do NAT-T tunneling through UDP and it looks like I need to either 
upgrade this customer to 1.3.0 (assuming it has the right code) or build a 
custom 1.2 with the NAT-Traversal patch.

the why is simple: they have employees with Linksys and in that gearboxes at 
home that need VPN access.  They don't want to give them complete network to 
network access so we want to give access to just one machine.  The plan is slap 
an IPSec client on home PC, create a VPN entry and let people have the time of 
their life.

so, ideas on approaches?

---eric

e-mail postage: don't accept mail without it

Marco van Beek wrote:
>>Far better to have it hidden away and then spring it on the
>>unsuspecting...
> 
> 
> You mean a choco-trojan. A little known virus that empties your wallet every
> time you pass a truffle store. Has it's own built in UPS account.
> 
> <SLAP>
> My wife wishes it to be known that she is not a virus but a symbiotic
> parasite.
> </SLAP>
> 
> Perhaps we need an outgoing email scanner (a sort of SMTP version of
> dansgardian) that looks for the words "new", "version", "ipcop", "when", "?"
> and automatically emails back a link to google with the search term
> "truffle" already added.

works for me.  In case I forgot, I received for some very nice truffles from New 
Zealand.  Probably cost as much to ship as they were worth.  And they were very 
very tasty.  The slicing bars were very nice as well.  Especially the ginger one.

As you can probably tell, I'm very far behind in my e-mail and am still not 
ready to leave my sabbatical caused by chaos around me.  I do want to announce 
one of the reasons why I've been in absentia.  I have been working on the 
antispam system which merges sender pays mechanisms, traffic analysis, and 
Bayesian filter to create a very strong antispam system with low false positives.

features:

Global or local administration models
Systemwide or per user filtering
Easier white listing thresholds (release from spamtrap, on sent mail)
Switchable no notification, simple notification, challenge
notification
New spamtrap Web user interface
Mailing list detection to cancel potentially misdirected notifies or challenges
Outbound SMTP proxy for stamp generation and white list expansion

It's probably one of the most powerful antispam systems in existence.  It's in 
beta code.  The current version on sourceforge is minus a few bug fixes and I 
will be releasing a new version by the weekend.

so, before anybody asks, no, we're not going to include this in IPCop.  It isn't 
appropriate.  However, it would be appropriate for a mail server.  ;-)

Could always use some guinea pigs, commercial or private.

---eric

Syslogd is started like this in rc.sysinit: /sbin/syslogd -m 0

Is this done by design or was it an oversite?
The reason I ask is that it is listening on UDP 514

netstat -nap | grep 514
udp        0      0 0.0.0.0:514             0.0.0.0:*
60/syslogd

While 514 is blocked from the outside world, it can be exploited internally
by flooding the syslogd with a bunch of bogus entries.
I know many on the list are using Ipcop for personal use, those of you using
it in business environments should examine this more closely as a malicious
employee can exploit this.

For more information read this:
http://www.hackinglinuxexposed.com/articles/20030220.html

Darren

Dear List,

I am currently running IPCOP 1.3.0 on an AMD K6 500 with a Red, Green =
and Orange configuration, the mainboard is a SOYO SY-5EHM with 128meg of =
ram and a 1gig hardisk.  All sevices are running except the Web Proxy, =
VPN and Secure Shell Server.

Red Interface is an Alcatel Speedtouch USB
Green Interface is a Realtek 8139=20
Orange Interface is a Realtek 8139

Here's the problem, if I am uploading a large file to the internet and =
then try to download a file off the box on the orange network my =
internet connection will drop almost immediately and the only way to get =
it back up again is to reboot ipcop.  This never happened with any of =
the previous versions of Ipcop.

When it happens the kernel logs the following:

21:19:57 kernel usb-uhci.c: interrupt, status 3, frame# 1953
21:19:57 kernel usbdevfs: USBDEVFS_BULK failed dev 2 ep 0x7 len 636 ret =
-110
21:19:57 kernel usbdevfs: USBDEVFS_BULK failed dev 2 ep 0x7 len 1696 ret =
-110
21:19:57 kernel usbdevfs: process 170 (modem_run) did not claim =
interface 0 before use
21:19:57 kernel hub.c: already running port 1 disabled by hub (EMI?), =
re-enabling...
21:19:58 kernel usb.c: USB disconnect on device 00:07.2-1 address 2
21:19:58 kernel hub.c: new USB device 00:07.2-1, assigned address 3
21:19:58 kernel usb.c: USB device 3 (vend/prod 0x6b9/0x4061) is not =
claimed by any active driver.

If you need any more info from my logs I will happily oblige.

Regards

Nick

PS I can repeat this every single time without fail and it only happens =
if I am uploading a file, it doesn't happen whilst downloading.

Dear List,

I am currently running IPCOP 1.3.0 on an AMD K6 500 with a Red, Green =
and Orange configuration, the mainboard is a SOYO SY-5EHM with 128meg of =
ram and a 1gig hardisk.  All sevices are running except the Web Proxy, =
VPN and Secure Shell Server.

Red Interface is an Alcatel Speedtouch USB
Green Interface is a Realtek 8139=20
Orange Interface is a Realtek 8139

Here's the problem, if I am uploading a large file to the internet and =
then try to download a file off the box on the orange network my =
internet connection will drop almost immediately and the only way to get =
it back up again is to reboot ipcop.  This never happened with any of =
the previous versions of Ipcop.

When it happens the kernel logs the following:

21:19:57 kernel usb-uhci.c: interrupt, status 3, frame# 1953
21:19:57 kernel usbdevfs: USBDEVFS_BULK failed dev 2 ep 0x7 len 636 ret =
-110
21:19:57 kernel usbdevfs: USBDEVFS_BULK failed dev 2 ep 0x7 len 1696 ret =
-110
21:19:57 kernel usbdevfs: process 170 (modem_run) did not claim =
interface 0 before use
21:19:57 kernel hub.c: already running port 1 disabled by hub (EMI?), =
re-enabling...
21:19:58 kernel usb.c: USB disconnect on device 00:07.2-1 address 2
21:19:58 kernel hub.c: new USB device 00:07.2-1, assigned address 3
21:19:58 kernel usb.c: USB device 3 (vend/prod 0x6b9/0x4061) is not =
claimed by any active driver.

If you need any more info from my logs I will happily oblige.

Regards

Nick

PS I can repeat this every single time without fail and it only happens =
if I am uploading a file, it doesn't happen whilst downloading.

Harry Goldschmitt wrote:

> I've been trying to get one of the LEX ITX machines to boot from a 
> 128M flash for the last few days.  For that matter, I get the same 
> problem trying to boot from a hard drive with 1.3.0 installed.  My 
> flash winds up as secondary IDE master, hdc, and the hard drive winds 
> up as secondary IDE slave, hdd.  Both end up in the same kernel panic:
>
> kmod: failed to exec /sbin/modprobe -s -k block-major-3, errno = 2
> VFS: cannot open root device "304" or 03:04
> Please append a correct "root=" boot option
> Kernel panic: VFS: Unable to mount root fs on 03:04
>
> Any ideas, please.
>
> Harry
>
This is not too difficult.  You have to boot from other media ( floppy, 
cd, usb-key ), then update /etc/lilo.conf to reflect root=/dev/hdc1 and 
install=/dev/hdc.  You can put the CF card on either hdc or hdd (Jumper 
JCF2), but you cannot move it to the primary interface (without 
additional hardware, see below).  Also, keep in mind the BIOS boot 
settings HDD-0, HDD-1,etc. refer to HDD-0 = first hard disk, not Primary 
Master.  You also absolutely CAN NOT use 2.5" HD and CF at the same 
time, unless the 2.5" HD does not support any DMA Modes.  The manual 
indicates shutting off DMA support for the drive, but as of BIOS version 
A2, this does not yet work.

For testing sake, I actually use an IDE->CF adapter on the primary 
interface to make the CF become hda, then reinsert it later to test 
booting from hdc position.

Christopher Crawford


>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> IPCop-devel mailing list
> IPC...@li...
> https://lists.sourceforge.net/lists/listinfo/ipcop-devel

I've been trying to get one of the LEX ITX machines to boot from a 
128M flash for the last few days.  For that matter, I get the same 
problem trying to boot from a hard drive with 1.3.0 installed.  My 
flash winds up as secondary IDE master, hdc, and the hard drive winds 
up as secondary IDE slave, hdd.  Both end up in the same kernel panic:

kmod: failed to exec /sbin/modprobe -s -k block-major-3, errno = 2
VFS: cannot open root device "304" or 03:04
Please append a correct "root=" boot option
Kernel panic: VFS: Unable to mount root fs on 03:04

Any ideas, please.

Harry

John Saunders wrote:

>>9. Same hardware configuration as step 8 cards in
>>same slots, reinstall of IPcop, 3com on red, intel
>>on green. WHAT.. NO PROBLEM!
>>    
>>
>
>Is both RED and GREEN running 100BaseTX? I am guessing
>that RED is 10BaseT and GREEN is 100BaseTX, which is
>a typical config when RED is going to a cable or ADSL
>modem. Or it could be the other way around. Anyway the
>issue may be link speed or duplex related if there are
>differences in these parameters between RED & GREEN.
>
>I am not sure why the Intel NIC would have a problem
>with speed or duplex, possibly some interaction with
>the ALI chipset's operation of the PCI bus or bus
>mastering implementation. Have you tried tweaking the
>PCI bus latencies in the BIOS. There may be other PCI
>bus options that can be tweaked as well.
>
>From what I understand, Intel PCI NICs have large FIFOs
>so are fairly immune to large latencies on the PCI bus.
>So you can tweak PCI bus parameters without fear of
>causing corrupted or dropped packets.
>

Actually, its the opposite.  Intel NICs have notoriously small FIFOs 
(<=4k), which have caused mysterious systems hangs on OpenBSD/IPF 
systems.  I was involved with debugging such a problem last year.  Our 
i21143 (tulip) cards were far less prone to these issues than the i82557 
(eepro) cards.  However, the 8255x cards prior to the 82558, had some 
intermittent issues with NWAY negotiation with certain Cisco Catalyst 
Switches.  I would try forcing speed/duplex settings.

Christopher Crawford

>
>  
>
>>Possibly my hatred of the ALI chipset had reason
>>to be rekindled?
>>    
>>
>
>When I clicked on your link I initially thought
>"Cool! MicroATX, socket 7, perfect IPCop platform".
>Then I saw ALI chipset and rapidly changed opinion.
>
>I got myself an ASRock VIA KM266 based MicroATX and
>slim case for my firewall. Trying to source a low
>profile NIC to fit the case as it only has 1 onboard
>NIC. I will then replace my noisey P133 tower.
>
>__________________________________________________
>John Saunders  --  ResMed Limited (OSA Group)
>97 Waterloo Road, North Ryde NSW 2113, Australia.
>Phone: +61-2-9886-5433  Email: Jo...@Re...
>
>
>
>
>Warning:  Copyright ResMed.  Where the contents of this email and/or attachment includes materials prepared by ResMed, the use of those materials is subject exclusively to the conditions of engagement between ResMed and the intended recipient.
>
>This communication is confidential and may contain legally privileged information. By the use of email over the Internet or other communication systems, ResMed is not waiving either confidentiality of, or legal privilege in,the content of the email and of any attachments.
>If the recipient of this message is not the intended addressee, please call ResMed immediately on  +61 2 9886 5000 Sydney, Australia.
>
>
>
>-------------------------------------------------------
>This sf.net email is sponsored by:ThinkGeek
>Welcome to geek heaven.
>http://thinkgeek.com/sf
>_______________________________________________
>IPCop-devel mailing list
>IPC...@li...
>https://lists.sourceforge.net/lists/listinfo/ipcop-devel
>  
>

Hi,

I just compiled and installed ipcop 1.3 alpha 1 . I have the following two
problems

1- mrtg is not drawing any graphs when I run the command ipaccount 5m GREEN
     I get the following error fetchipac: accounting hosts is not supported
by plain-file storage method
2- VPN connections starts ok but the status stays closed despite that it is
open.

I did the compilation on redhat 7.3

Regards

Emad

> 9. Same hardware configuration as step 8 cards in
> same slots, reinstall of IPcop, 3com on red, intel
> on green. WHAT.. NO PROBLEM!

Is both RED and GREEN running 100BaseTX? I am guessing
that RED is 10BaseT and GREEN is 100BaseTX, which is
a typical config when RED is going to a cable or ADSL
modem. Or it could be the other way around. Anyway the
issue may be link speed or duplex related if there are
differences in these parameters between RED & GREEN.

I am not sure why the Intel NIC would have a problem
with speed or duplex, possibly some interaction with
the ALI chipset's operation of the PCI bus or bus
mastering implementation. Have you tried tweaking the
PCI bus latencies in the BIOS. There may be other PCI
bus options that can be tweaked as well.

From what I understand, Intel PCI NICs have large FIFOs
so are fairly immune to large latencies on the PCI bus.
So you can tweak PCI bus parameters without fear of
causing corrupted or dropped packets.

> Possibly my hatred of the ALI chipset had reason
> to be rekindled?

When I clicked on your link I initially thought
"Cool! MicroATX, socket 7, perfect IPCop platform".
Then I saw ALI chipset and rapidly changed opinion.

I got myself an ASRock VIA KM266 based MicroATX and
slim case for my firewall. Trying to source a low
profile NIC to fit the case as it only has 1 onboard
NIC. I will then replace my noisey P133 tower.

__________________________________________________
John Saunders  --  ResMed Limited (OSA Group)
97 Waterloo Road, North Ryde NSW 2113, Australia.
Phone: +61-2-9886-5433=A0 Email: Jo...@Re...




Warning:  Copyright ResMed.  Where the contents of this email and/or =
attachment includes materials prepared by ResMed, the use of those =
materials is subject exclusively to the conditions of engagement between =
ResMed and the intended recipient.

This communication is confidential and may contain legally privileged =
information. By the use of email over the Internet or other =
communication systems, ResMed is not waiving either confidentiality of, =
or legal privilege in,the content of the email and of any attachments.
If the recipient of this message is not the intended addressee, please =
call ResMed immediately on  +61 2 9886 5000 Sydney, Australia.

Anyone played with Snort-inline from
http://project.honeynet.org/papers/honeynet/tools/

Basically it makes Snort and active IDS.

I realise the biblical argument around the benefit/traps of active IDS
but it would be a nice mod for those looking for the functionality.

I don't think it would be suitable for the main distro.

Mark(fat)

Hi,

Arnt Karlsen wrote:
> ..FYI, 
> zlib bug fix: http://rhn.redhat.com/errata/RHSA-2003-079.html
> 
> ..is this an issue here?

I don't think so.  Only a very small portion of our software depends on 
zlib and I don't think any of them use gzprintf().  Most will simply use 
gzopen().  We will include it in our first fix release for 1.3.0, but 
won't release an emergency fix now.

Kind regards,

Mark
-- 
***************************************************************
* |\    /|      |  /|  /       Mark Wormgoor                  *
* | \  / |      | / | /        mailto:ma...@wo...       *
* |  \/  |ark   |/  |/ormgoor  http://www.wormgoor.com/mark/  *
***************************************************************

----- Original Message -----
From: "Arnt Karlsen" <ar...@c2...>
To: <ipc...@li...>
Sent: Tuesday, April 29, 2003 10:45 AM
Subject: [IPCop-devel] ..zlib bug fix:
http://rhn.redhat.com/errata/RHSA-2003-079.html


> ..FYI,
> zlib bug fix: http://rhn.redhat.com/errata/RHSA-2003-079.html
>
> ..is this an issue here?
Not for most users as it is not installed on IPCop - however I made it
available through Gavin's addonz system.

For those of you that installed the zlib from Gavin's Add onz, and you are
using it for the Jimmy Merrick Dans Guardian Analyzer, you are OK - I did
not use the gzprintf function in the zlib library. If you are using zlib for
other purposes, then you may want to check if you are calling the gzprintf
function.

When time permits, I will issue another binary - but I have double checked
that the gzprintf is not being used for the DG log analyzer

Darren

..FYI, 
zlib bug fix: http://rhn.redhat.com/errata/RHSA-2003-079.html

..is this an issue here?

-- 
..med vennlig hilsen = with Kind Regards from Arnt... ;-)
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.

On Tue, 29 Apr 2003 11:35:59 -0500, 
Tim Butterfield <tim...@mi...> wrote in message 
<3EA...@mi...>:

> John Edwards wrote:
>  > The latest version of Snort (v2) uses a lot more memory (about
>  > 40MB)
> 
> My v1.2 IPCop runs on a P90, 32Mb RAM, 1Gb HD and Snort is turned on.

..mine has 96MB, stuff it, like I did.
 
>    My current memory usage is:
> 
>             total       used    free  shared   buffers   cached
>    Mem:     30620      27128    3492   22756      5452     8940
>    -/+ buffers/cache:  12736   17884
>    Swap:    18140          0   18140
> 
> If Snort is such a hog now, upgrading on this box sounds like an 
> excercise in futility.  Is that true?
> 
> Is there a location on the web site with current minimum hardware 
> requirements/recommendations?

.. ;-) http://ipsysctl-tutorial.frozentux.net/chunkyhtml/
full of advice on tweaking it for the job.  There is also 
http://iptables-tutorial.frozentux.net/chunkyhtml/book1.html

-- 
..med vennlig hilsen = with Kind Regards from Arnt... ;-)
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.

Hi,

John Edwards wrote:
> Is Snort (the Intrusion Detection System) turned on ?
> 
> The latest version of Snort (v2) uses a lot more memory (about 40MB)
> and I suspect that this is causing the DNS server and other programs 
> to be moved into swap, hence the delay.
> 
> I've got v1.3.0 on a P166 with 64MB of RAM running an ADSL line and 
> that has no noticable speed slow downs. Memory use with Snort, IPSec
> and a single SSH login is:
> 
> --------------------------------------------------------------------------
> # free -t
>              total       used       free     shared    buffers     cached
> Mem:         62948      48392      14556          0       1440       8512
> -/+ buffers/cache:      38440      24508
> Swap:       273096      12996     260100
> Total:      336044      61388     274656
> --------------------------------------------------------------------------
> 
> So my recomendation is to either switch off Snort or add at least 
> 16MB more RAM.

There is a config line for Snort 2.0 that should be used for low memory 
machines.  We'll soon provide a first fix for 1.3.0 to enable this.  Add 
this line to /etc/snort/snort.conf, just before the frag2 preprocessor:

config detection: search-method lowmem

and restart snort using /usr/local/bin/restartsnort.
On my machine, this limits Snort to 10MB of RAM.  I've done some testing 
with the other options, but couldn't get it down further.  It seems you 
need at least 32MB of RAM to run Snort.

Kind regards,

Mark
-- 
***************************************************************
* |\    /|      |  /|  /       Mark Wormgoor                  *
* | \  / |      | / | /        mailto:ma...@wo...       *
* |  \/  |ark   |/  |/ormgoor  http://www.wormgoor.com/mark/  *
***************************************************************

John Edwards wrote:
 > The latest version of Snort (v2) uses a lot more memory (about
 > 40MB)

My v1.2 IPCop runs on a P90, 32Mb RAM, 1Gb HD and Snort is turned on. 
   My current memory usage is:

            total       used    free  shared   buffers   cached
   Mem:     30620      27128    3492   22756      5452     8940
   -/+ buffers/cache:  12736   17884
   Swap:    18140          0   18140

If Snort is such a hog now, upgrading on this box sounds like an 
excercise in futility.  Is that true?

Is there a location on the web site with current minimum hardware 
requirements/recommendations?

-- 
Tim Butterfield
http://www.timbutterfield.com/

On Tue, 29 Apr 2003 01:03:29 -0600, 
"M.Lumir" <le...@te...> wrote in message 
<20030429070253.DLNJ9999.priv-edtnes27.telusplanet.net@rukus>:
> 
> 1. Transferred the two Intel Pro 100 nics from the working firewall to
> the new box.. here is a link  to the motherboard...
> http://www.eurocomla.com/m754lmr.htm  (don't laugh.. it was free).

..I wonder why.  ;-)

..they also have an interesting location: 
http://www.eurocomla.com/_vti_bin/shtml.exe/COMPANY.HTM/map2?41,114
                                 /\/\/\/\/\      

> 2. This mobo has only 3 PCI slots on it, and unfortunately has the ALI

..do you use the onboard nic?

> 7. Back to my trusty old 3com 3c905tx, threw it in with 1 pro100,
> reinstalled.
> 8. IPcop reboots, Intel nic is red, 3com green.. Bang! Same problem.
> hangs again.
> 
> Now here is where it really blows my mind...
> 
> 9. Same hardware configuration as step 8 cards in same slots,
> reinstall of IPcop, 3com on red, intel on green. WHAT.. NO PROBLEM!
> 
> Now after 4 days of every possible slot/nic combination I have come to
> the observation that if I put any of the 3 Intel  Pro/100 nics on the
> RED interface, the machine hangs as soon as traffic goes through it,
> tried 3 different intel nics, and gives the same thing every time; no
> matter the IRQ or slot.

..you tried 3 different nicsdrivers with 3 different nic drivers?
Tried 4 different?
 
..from 'http://www.eurocomla.com/m754lmr.htm':
"Modem
Supports HSP 56Kbps Fax/Modem module supports V.90, V.34, V.32bis, V.32,
V.22bis, V.22, MNP5, and Auto Fallback Supports V.42bis data compression
with 115200 compatible Virtual UART ",...and...

..."On-Board I/O
On-board super Multi-I/O chip that supports serial ports with 16550 Fast
UART compatibility Two USB connectors
One 10/100 Base-T Lan RJ45 connector"

..these plugs in how?  ;-)

> Funny thing is, and correct me if I am wrong, if these cards worked as
> the red interface before, then why not now with the same software.  I
> mean if the install detects the 2 intels together (diff irqs), and the
> red interface obtains an IP via DCHP, then this tells me that they DO
> work.. why does it crash right away when I use the net? Why crash only
> when the intel is on the red interface, not when used as green or
> orange?
> 
> Possibly my hatred of the ALI chipset had reason to be rekindled? 
> 
> While I hope that no one has shared my frustration, please do post a
> response if you have a similar issue, or have a contribution to share.

..to me, it sounds like you have a buggy main board.

..another challenge:  your funny free EuroCom board and:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=89171  ;-)

..with RH9, I have 2 out of 3 boxes with cooked rpm databases,
which I can live with even on production boxes, it's just a wee 
backup script.  Now, both 2 production boxes upgraded this far, 
turns its rear end onto any willing scriptkiddie, unless I have 
the first dead nic kill the box promptly.  So I hold back on RH9.
 
..it beginning to look like Red Hat Inc is "looking 
at the issues involved.", Microsoft-style.
_No_ good for isp service nor security, so I look 
for _solutions_.



-- 
..med vennlig hilsen = with Kind Regards from Arnt... ;-)
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.

On Mon, 28 Apr 2003 22:56:10 -0700, 
Darren Critchley <da...@kd...> wrote in message 
<019201c30e14$093c7e00$0a0a10ac@darrenc>:

> ----- Original Message -----
> From: "John Saunders" <Jo...@re...>
> To: <ipc...@li...>
> Sent: Sunday, April 27, 2003 5:39 PM
> Subject: Re: [IPCop-devel] Swap Space in 1.3
> 
> 
> > On Wed, Apr 23, 2003 at 10:47:15PM +0100, David Smith wrote:
> > Linus has written that RAM*2 is the minimum swap for early
> > 2.4 kernels due to the kernel being more aggressive about
> > putting programs into swap space to free up more space for
> > buffers and cached files.
> >
> > I believe that this recommendation still stands for the current
> > 2.4 kernels, though the virtual memory management has changed
> > considerably (esp. since 2.4.10). At the very least it should
> > be as large as RAM.
> 
> I have a box with 128megs of ram, I initially had the swap at 32mb,
> then 64,128,256 and 512 and had the exact same results, as soon as

..one, or more swap slices?  On same or different disk?

..with "more", you want one slice on each disk, and you want 
all swap space to have "priority=1", even with Raid1, to speed 
up swapping, "the first free disk swaps".

> something started using the swap space, the box ground to a halt -
> especially when snort snarf was running.
> 
> Other times I have seen various processes get put into the swap space
> and grind the box to a halt.

..try again after 'swapoff'.  ;-)

> So please tell me how anyone figures that setting 2*RAM is optimal?
> Especially when every test I have done has ended up with the hard
> drive pegged swapping data in and out?

..this is advice from the gurus writing the kernel, and who saw
early 2.4 kernel swap problems coming from easing off on swap space,
as a lot of people did on the late 2.2 kernels with no problem.

..swap space is made to help save expensive _processed_ data from
the expensiver number crunching sessions spiralling in to a softer
"landing".

..my own policy is use 2*the main board's ram capasity, which just
minimizes downtime on adding ram.  Any more than that is pointless,
because each main board has some certain maximum ram capasity.

..'swapoff' and 'swapon' are _much_ quicker than reinstalls to 
make disk space for the sudden urges of swap space, but then my 
production boxes don't crunch numbers, they just pass on traffic.

-- 
..med vennlig hilsen = with Kind Regards from Arnt... ;-)
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.

On Tue, Apr 29, 2003 at 10:25:10AM +0200, Franck HERESON wrote:
> Hi,
> I've successfully upgraded form 1.2 to V1.3 on a P166 MMX with 48 Mo RAM and
> 3Go HD.
> Green is 3Com 3c905x
> RED is USR Sporster isdn Ta.
> 
> The system works very slowly. The isdn connection is on demand and the users
> get errors when the link has to go up. 
> 
> It seems that a lot of CPU is used by mgrt just after the connection and the
> browsers don't get the DNS answers soon enough.
> 
> I'm going back to 1.2.
> 
> 
> Anyway it's a very  nice system, I hope you'll keep it working on small
> machines.
> 
> Rgs,
> 
> F.HÉRÉSON
> <mailto:fra...@fn...>

Hi
Is Snort (the Intrusion Detection System) turned on ?

The latest version of Snort (v2) uses a lot more memory (about 40MB)
and I suspect that this is causing the DNS server and other programs 
to be moved into swap, hence the delay.

I've got v1.3.0 on a P166 with 64MB of RAM running an ADSL line and 
that has no noticable speed slow downs. Memory use with Snort, IPSec
and a single SSH login is:

--------------------------------------------------------------------------
# free -t
             total       used       free     shared    buffers     cached
Mem:         62948      48392      14556          0       1440       8512
-/+ buffers/cache:      38440      24508
Swap:       273096      12996     260100
Total:      336044      61388     274656
--------------------------------------------------------------------------

So my recomendation is to either switch off Snort or add at least 
16MB more RAM.


-- 
#--------------------------------------------------------#
|       John Edwards    Email: Joh...@uk...       |
|                                                        |
|  "SEP is intended as a management routing protocol,    |
|   and should not be used in a production enviroment."  |
#--------------------------------------------------------#

Hi,
I've successfully upgraded form 1.2 to V1.3 on a P166 MMX with 48 Mo =
RAM and
3Go HD.
Green is 3Com 3c905x
RED is USR Sporster isdn Ta.

The system works very slowly. The isdn connection is on demand and the =
users
get errors when the link has to go up.=20

It seems that a lot of CPU is used by mgrt just after the connection =
and the
browsers don't get the DNS answers soon enough.

I'm going back to 1.2.


Anyway it's a very  nice system, I hope you'll keep it working on small
machines.

Rgs,

F.H=C9R=C9SON
<mailto:fra...@fn...>

I have found answers to many difficult IPCop questions on this forum, =
IMO it
is one of the advantages IPcop has over it's competitors.

I was first introduced to the Linux firewalls with Coyote Linux, then =
moved
to Astro, SmoothWall, and eventually was satisfied with IPCop.

Earlier on, my setup consisted of a Compaq Deskpro 233MMX with 128 ram, =
3com
3c905tx nic, an Intel Pro100, and Telus ADSL.=20
I was so impressed with this little box that I decided to go out and get =
me
another Intel Pro100, since my 3com was giving me heavy frame errors, =
and
what do you know... it worked (1.3b3 and up).

I should have counted my blessings when I had the chance..

A few weeks later a customers old Celeron 800 with 512 ram fell into my =
lap,
and after many nights of lost sleep tossing and turning over the =
decision of
whether this box was to be a new game server or a fireall the decision =
was
made... FIREWALL!

The next 4 days would prove to be Hell... will try and make this brief.

1. Transferred the two Intel Pro 100 nics from the working firewall to =
the
new box.. here is a link  to the motherboard...
http://www.eurocomla.com/m754lmr.htm  (don't laugh.. it was free).
2. This mobo has only 3 PCI slots on it, and unfortunately has the ALI
chipset, fearing IRQ conflicts off the bat, I flashed it with the latest
BIOS revision.
3. Installed IPCop, no problem whatsoever with the install.. detects =
both
NICS, configures without any issues.
4.Machine reboots, 1'st PC on switch obtains IP via DHCP .. red nic =
obtains
IP via DHCP; again no issues.
5. User attempts internet access, IPcop console locks up, forcing hard
reboot. (sometimes 1 or 2 pages load before it locks up.. but always =
locks
within 5 secs of first using the net.
6. Tried multiple jockeying of the NICs in different slot combos on the
motherboard, but as before, even if detected on separate irqs and the
install works properly, same results.
7. Back to my trusty old 3com 3c905tx, threw it in with 1 pro100,
reinstalled.
8. IPcop reboots, Intel nic is red, 3com green.. Bang! Same problem. =
hangs
again.

Now here is where it really blows my mind...

9. Same hardware configuration as step 8 cards in same slots, reinstall =
of
IPcop, 3com on red, intel on green. WHAT.. NO PROBLEM!

Now after 4 days of every possible slot/nic combination I have come to =
the
observation that if I put any of the 3 Intel  Pro/100 nics on the RED
interface, the machine hangs as soon as traffic goes through it, tried 3
different intel nics, and gives the same thing every time; no matter the =
IRQ
or slot.

Funny thing is, and correct me if I am wrong, if these cards worked as =
the
red interface before, then why not now with the same software.  I mean =
if
the install detects the 2 intels together (diff irqs), and the red =
interface
obtains an IP via DCHP, then this tells me that they DO work.. why does =
it
crash right away when I use the net? Why crash only when the intel is on =
the
red interface, not when used as green or orange?

Possibly my hatred of the ALI chipset had reason to be rekindled?=20

While I hope that no one has shared my frustration, please do post a
response if you have a similar issue, or have a contribution to share.

----- Original Message -----
From: "John Saunders" <Jo...@re...>
To: <ipc...@li...>
Sent: Sunday, April 27, 2003 5:39 PM
Subject: Re: [IPCop-devel] Swap Space in 1.3


> On Wed, Apr 23, 2003 at 10:47:15PM +0100, David Smith wrote:
> Linus has written that RAM*2 is the minimum swap for early
> 2.4 kernels due to the kernel being more aggressive about
> putting programs into swap space to free up more space for
> buffers and cached files.
>
> I believe that this recommendation still stands for the current
> 2.4 kernels, though the virtual memory management has changed
> considerably (esp. since 2.4.10). At the very least it should
> be as large as RAM.

I have a box with 128megs of ram, I initially had the swap at 32mb, then
64,128,256 and 512 and had the exact same results, as soon as something
started using the swap space, the box ground to a halt - especially when
snort snarf was running.

Other times I have seen various processes get put into the swap space and
grind the box to a halt.

So please tell me how anyone figures that setting 2*RAM is optimal?
Especially when every test I have done has ended up with the hard drive
pegged swapping data in and out?

Darren

Hi All,

As you probably know I have been trying to find out what is going on with my
Pulsar ADSL card and new (clean) 1.3 install. I have realised that
sometimes, when my box loses connectivity (I have a VPN running), and ppp is
showing as having reconnected, I cannot ping the Internet from anywhere on
the inside, but the outside interface responds to pings from the internet. I
look at my routing table and ...

=======================================================
Kernel IP routing table
Destination        Gateway            Genmask           Flags Metric Ref
Use Iface
217.41.213.202  0.0.0.0              255.255.255.255  UH    0      0
0 ipsec0
217.41.213.202  0.0.0.0              255.255.255.255  UH    0      0
0 ppp0
192.168.250.0   217.41.213.202  255.255.255.0      UG    0      0        0
ipsec0
192.168.251.0   0.0.0.0              255.255.255.0      U       0      0
0 eth0
0.0.0.0             217.41.213.202  0.0.0.0                 UG    0      0
0 ipsec0
=======================================================

my ipsec interface is my default route ???

I disabled the vpn service, and everything reconnects fine. Boy am I
confused. I think there are three seperate problems going on here.

1) For some reason the Pulsar drops the line far more often under 1.3 than
1.2. We have seen it do it on different hardware and the same hardware.

2) There seems to be no way that the pulsar module can tell pppd to wait
before connecting if it doesn't have line sync yet (ie an ADSL equivilent of
no dial tone)

3) ipsec not being shut down when the red intreafce comes down means that it
doesn't come back up again afterwards, and is also probably the cause of the
strange routing table above.

I have disabled my VPN for the time being, and changed my connection
attempts to 100, to see if pppd will now come back up properly.

Regards,

Marco van Beek
Supporting Role Ltd.

On Mon, Apr 28, 2003 at 11:32:22AM +0100, Chris Clancey wrote:
> Hello,
> 
> Would it be possiable to add BT Digital Access USB support to IPCop 1.3.1? Someone did tell me that you can compile support for it in the kernel. Can you add this to the next release? Just out of interest, where can I get the kernel sources and config file  to 'roll it in' myself :)
> 
> Thanks in advance
> __________________________________________________________________
> Chris Clancey
> ICQ#: 145330704
>       Current ICQ status:     
> +  More ways to contact me 
> i  See more about me: 
> __________________________________________________________________



The IPCop v1.3.0 source code is here:
  http://prdownloads.sourceforge.net/ipcop/ipcop-1.3.0.tar.gz

The kernel configuration files is config/kernel/kernel.config in 
this tarball. The make.sh script will automatically download and 
build the kernel.


-- 
#--------------------------------------------------------#
|       John Edwards    Email: Joh...@uk...       |
|                                                        |
|  "SEP is intended as a management routing protocol,    |
|   and should not be used in a production enviroment."  |
#--------------------------------------------------------#