ipcop-devel Mailing List for IPCop Firewall

In message <000801c3272b$d37282c0$3c00a8c0@michael365u4as>
          "Michael Osten" <mo...@bl...> wrote:

> Is anyone working on adding layer 7 traffic shapping in the current IPCop
> CVS build?  I was planning on starting this, but I do not want to duplicate
> work.

This may turn out to be a little difficult as the kernel patch used by the
layer 7 filter us made against 2.5.68. In theory you could perhaps backport
it to a stable kernel, but their howto notes that they had problems getting
it to work with 2.5.69 so it looks like it's particularly sensitive to even
small kernel version changes.

-- 
 Robert Kerr

The DVB drivers are open source and are in the 2.5
kernel now.

To get them goto http://www.linuxdvb.tv/

http://www.linuxtv.org/

http://www.linuxdvb.tv/download/

http://www.linuxtv.org/mailinglists.xml

 --- John Edwards <sh...@co...>
wrote: > On Tue, May 27, 2003 at 04:20:57PM +1000,
Amen Ra
> wrote:
> > Will the next release of IPCOP support 1 way
> Satellite
> > Internet ?
> > 
> > This requires drivers for the various cards.
> > 
> > In Australia 1 way satellite internet is uplink
> via
> > usually a modem and downlink via satellite not
> proxy
> > or VPN just routing.
> 
> It's unlikely unless those drivers are freely
> available for Linux with 
> source code under a GPL compatible license (eg the
> GPL itself, a BSD 
> license, the Perl artistic license, etc).
> 
> I've seen some of these systems, but only the most
> expensive of them 
> used ethernet instead of USB or PCI.
> 
> 
> -- 
>
#--------------------------------------------------------#
> |       John Edwards    Email: Joh...@uk...  
>     |
> |                                                   
>     |
> |  "SEP is intended as a management routing
> protocol,    |
> |   and should not be used in a production
> enviroment."  |
>
#--------------------------------------------------------#
> 
> 
>
-------------------------------------------------------
> This SF.net email is sponsored by: ObjectStore.
> If flattening out C++ or Java code to make your
> application fit in a
> relational database is painful, don't do it! Check
> out ObjectStore.
> Now part of Progress Software.
> http://www.objectstore.net/sourceforge
> _______________________________________________
> IPCop-devel mailing list
> IPC...@li...
>
https://lists.sourceforge.net/lists/listinfo/ipcop-devel 

http://mobile.yahoo.com.au - Yahoo! Mobile
- Check & compose your email via SMS on your Telstra or Vodafone mobile.

Is anyone working on adding layer 7 traffic shapping in the current =
IPCop CVS build?  I was planning on starting this, but I do not want to =
duplicate work.

Mark (fat) wrote:
> A nice by-product of backup and restore would be multiple firewall
> profiles.
>
>
> i.e. I leave a client box on for days on end downloading. At night I
> change the rules to allow only the download service. Profiles would
> automate this.
>
> Mark(fat)

Are your various rules setup using the rc.local extension Mark has built or
are you modifying rc.firewall ?

Darren

A nice by-product of backup and restore would be multiple firewall
profiles.


i.e. I leave a client box on for days on end downloading. At night I
change the rules to allow only the download service. Profiles would
automate this.

Mark(fat)

-----Original Message-----
From: ipc...@li...
[mailto:ipc...@li...] On Behalf Of Dave Harry
Sent: 30 May 2003 07:40
To: ipc...@li...
Subject: [IPCop-devel] Re: iptables-save and iptables-restore


Hi Sven
I used to wish for that too.
But now I just slap my extra rules into /etc/rc.d/rc.local

This file is backed up onto floppy, so you can take it across versions a
lot easier than iptables-restore.

--
Dave Harry

"MDA" <md...@mo...> wrote in message
news:ALE...@mo......
> Hi there,
>
> how about adding the tool iptables-save and iptables-restore to the 
> distribution.
>
> Sometimes it's easier (at least for me :) to edit the output of 
> iptabes-save or to distribute the firewall settings.
>
> cheerio
>   Sven
>
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: ObjectStore.
> If flattening out C++ or Java code to make your application fit in a 
> relational database is painful, don't do it! Check out ObjectStore. 
> Now part of Progress Software. http://www.objectstore.net/sourceforge





-------------------------------------------------------
This SF.net email is sponsored by: eBay
Get office equipment for less on eBay!
http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5
_______________________________________________
IPCop-devel mailing list
IPC...@li...
https://lists.sourceforge.net/lists/listinfo/ipcop-devel

> From: David Kilpatrick [mailto:da...@da...]=20
> Subject: Re: [IPCop-devel] 1.3.1 Alpha traffic shaping
> I'll see if I can answer your questions.

Does the traffic shaper see VPN traffic at all, as a whole or as
individual protocols/ports?

Dave

Hi Sven
I used to wish for that too.
But now I just slap my extra rules into /etc/rc.d/rc.local

This file is backed up onto floppy, so you can take it across versions a lot
easier than iptables-restore.

--
Dave Harry

"MDA" <md...@mo...> wrote in message
news:ALE...@mo......
> Hi there,
>
> how about adding the tool iptables-save and iptables-restore
> to the distribution.
>
> Sometimes it's easier (at least for me :) to edit the output
> of iptabes-save or to distribute the firewall settings.
>
> cheerio
>   Sven
>
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: ObjectStore.
> If flattening out C++ or Java code to make your application fit in a
> relational database is painful, don't do it! Check out ObjectStore.
> Now part of Progress Software. http://www.objectstore.net/sourceforge

Hi

In tracking down Bug 744964 I found that a space had crept unnoticed into
the translated Spanish string for one of the buttons used in the port
forwarding interface.

'add xtaccess' =3D> 'A=C3=B1ade un Acceso Externo ',
                          rogue space here ^

That stopped the button working when Spanish was the language.

Could I suggest a modification to the script that generates the .pl files,
to remove any whitespace at the end of translated strings? I think that
would prevent any further problems.

A new es.pl could perhaps be included in 1.3.1-fixes3 :)

Thanks to Miguel Rodriguez for spotting the bug.

Regards.

Eric

Hi ..

I wrote most of the CGI interface for traffic shaping. If you've got any
further problems, post them to the list and I'll see if I can answer your
questions.
--
David Kilpatrick
da...@da...

----- Original Message ----- 
From: "Andre Newman" <ip...@di...>
To: "Eric Oberlander" <er...@ob...>
Cc: "IPCop-Devel" <ipc...@li...>
Sent: Monday, May 26, 2003 7:55 PM
Subject: Re: [IPCop-devel] 1.3.1 Alpha traffic shaping


>
> >
> > I think you have to create two files in /var/ipcop/shaping which may be
>
> Thanks for this, I'll give it a try when I'm back at work on wednesday.
>
> Regards
>
> Andre
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: ObjectStore.
> If flattening out C++ or Java code to make your application fit in a
> relational database is painful, don't do it! Check out ObjectStore.
> Now part of Progress Software. http://www.objectstore.net/sourceforge
> _______________________________________________
> IPCop-devel mailing list
> IPC...@li...
> https://lists.sourceforge.net/lists/listinfo/ipcop-devel

Hi there,

how about adding the tool iptables-save and iptables-restore
to the distribution.

Sometimes it's easier (at least for me :) to edit the output
of iptabes-save or to distribute the firewall settings.

cheerio
  Sven

Hi All,

Got a quite major problem with 1.3.0 at a customers site that I would
appreciate some expert eyes on TIA.  The customer has three sites as
follows:

Head office has an ADSL ethernet router with a /29 subnet, IPCop
1.3.0fixes2.
Branch1 has an ADSL ethernet router with a /29 subnet, IPCop 1.2fixes5.
Branch2 has an ADSL ethernet router with a /30 subnet, IPCop 1.2fixes5

There are VPNs from Head office to both Branch1 and Branch2

Head office has a Sybase database running.  Both branch offices have
multiple workstations connecting to this database.  Prior to installing
IPCop 1.3 the Head office firewall was a custom LFS box running
Shorewall - this firewall was in use for about 2 months without problem.
I didn't use IPCop 1.2 at head office because I needed Red Aliases and
the ability to forward all traffic on one of the Red aliases from a
specific network to one of the internal hosts.

Ever since installing IPCop 1.3.0 at the head office, the users of the
database have been complaining of disconnections.  I do not have much to
go on from the database supplier.

Here is the conversation from the client to me:
<QUOTE>
Our database went extremely slow earlier.  <database supplier> restarted
the database so things seem ok now.  <database supplier guru> says he
thinks there are a lot of session timeouts causing the problem.  He says
it won't be head office but the remote offices.  He says it may happen
when people in the branches don't use their screen for a couple of
hours.  He said it needs looking at and it is something to do with the
firewalls.  Can you look in to it please?
</QUOTE>

My response was:

<QUOTE>
Not much to go on there.  As I understand things, the firewalls will
timeout udp connections after 30 seconds and established tcp connections
after 5 days.  I assume the database runs over tcp.  Can <database
supplier> identify which machines this is happening to?  What
ports/protocols are timing out?  Is it all remote machines or just some?
Has this just started happening?
</QUOTE>


The database suppliers response was:

<QUOTE>
> Can <database supplier> identify which machines this is happening to?
No, but it will be the ones that phone up with initial problems.
>  What ports/protocols are timing out?
TCP on high ports (14100)
> Is it all remote machines or just some?
Cannot tell as we only see from the SUN.
> Has this just started happening?
There have been minor problems since Mar 10th, maybe 1 a day. =20
Yesterday there were 20 network errors.  We have checked the SUN and=20
its has no hardware issues so its a connection which is being lost/cut=20
and firewalls/routers are a good starting point.
</QUOTE>

As you can see I do not have much information to go on.  I have had to
put their old firewall back in for now.  Has anyone experienced similar
problems?  Can anyone suggest lines of investigation?

TIA

Dave

On Tue, May 27, 2003 at 04:20:57PM +1000, Amen Ra wrote:
> Will the next release of IPCOP support 1 way Satellite
> Internet ?
> 
> This requires drivers for the various cards.
> 
> In Australia 1 way satellite internet is uplink via
> usually a modem and downlink via satellite not proxy
> or VPN just routing.

It's unlikely unless those drivers are freely available for Linux with 
source code under a GPL compatible license (eg the GPL itself, a BSD 
license, the Perl artistic license, etc).

I've seen some of these systems, but only the most expensive of them 
used ethernet instead of USB or PCI.


-- 
#--------------------------------------------------------#
|       John Edwards    Email: Joh...@uk...       |
|                                                        |
|  "SEP is intended as a management routing protocol,    |
|   and should not be used in a production enviroment."  |
#--------------------------------------------------------#

Will the next release of IPCOP support 1 way Satellite
Internet ?

This requires drivers for the various cards.

In Australia 1 way satellite internet is uplink via
usually a modem and downlink via satellite not proxy
or VPN just routing.

http://mobile.yahoo.com.au - Yahoo! Mobile
- Check & compose your email via SMS on your Telstra or Vodafone mobile.

This is not a new release :-)

This is unofficial modifications I do with a V1.3.0 (some changes coming
from V1.3.1alpha2 in index.cgi, status.cgi, pppsetup.cgi are inside).

It's work for me and permit some people to connect with IPCop.
I add support with two new drivers for Sagem800, USR Sureconnect 9000 and
Bewan PCI ST and USB models

With Sagem 800 settings, you may also connect with:
- Comtrend 315
-Acer ADSL Surf USB
-Allied Telesyn AT-AR 210 and AT-AR 215
Report to the list if yes or not

I have send to Mark the changes I have done

For modem modeled as an ATM device, PPPoA plugin work well but PPPoE plugin
not well

----- Original Message -----
From: "gui jnor" <gu...@on...>
To: <ipc...@li...>
Sent: Sunday, May 25, 2003 7:36 PM
Subject: [IPCop-devel] New release


> A new release which support Sagem f@st 800 USB and Bewan PCI ST by "Gesp"
>
> http://www.ixus.net/modules.php?name=Downloads&d_op=getit&lid=180
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: ObjectStore.
> If flattening out C++ or Java code to make your application fit in a
> relational database is painful, don't do it! Check out ObjectStore.
> Now part of Progress Software. http://www.objectstore.net/sourceforge
> _______________________________________________
> IPCop-devel mailing list
> IPC...@li...
> https://lists.sourceforge.net/lists/listinfo/ipcop-devel

Hi,

seems like pppd has a problem in my setup.
here's the log:
pppd[2473]: Serial connection established.
pppd[2473]: Using interface ppp0
pppd[2473]: Connect: ppp0 <--> /dev/ttyS0
pppd[2473]: Serial line is looped back.
pppd[2473]: Connection terminated.
pppd[2473]: Hangup (SIGHUP)
pppd[2473]: Exit.

my setup is ipcop v1.3
sportster 33.6 modem

has anyone encounter this problem?

Regards,
--joecat--

>
> I think you have to create two files in /var/ipcop/shaping which may be

Thanks for this, I'll give it a try when I'm back at work on wednesday.

Regards

Andre

A new release which support Sagem f@st 800 USB and Bewan PCI ST by "Gesp"

http://www.ixus.net/modules.php?name=Downloads&d_op=getit&lid=180

----- Original Message -----
From: "William Munson" <bi...@fi...>
To: <ipc...@li...>
Sent: Sunday, May 25, 2003 3:53 AM
Subject: [IPCop-devel] How to use/build a snapshot?


> Hi Everyone,
>
> I would like to take a stab at building one of your development snapshots
> just for my own illumination :)
>
> I have a fair amount of linux experience but have never attempted this
task.
> Is there a howto or other online guide to how to go about this task?
Yes http://www.ipcop.org/cgi-bin/twiki/view/IPCop/IPCopBuildingv01
It's a bit inacurate for RH7.2
libpcap-devel  don't exist in RH7.2
zlib-devel is needed

V1.3.0 is OK

V1.3.1alpha2 build but don't install correctly message when depmode -a =>
modules.dep is not writable

V1.4 do not have an installer yet
...

Hi Everyone,

I would like to take a stab at building one of your development snapshots
just for my own illumination :)

I have a fair amount of linux experience but have never attempted this task.
Is there a howto or other online guide to how to go about this task?

Thanks for your help,

Bill

wicked bit of software, thanks :) I had a minor hiccup with installing
1.3...

pci "probe" for network cards during install.

v 1.2 picks "dm9102". This works.

v 1.3 picks "21x4x tulip". This screws up [1]

nic's are all (brand new)
  http://www.cnetusa.com/product/specs/nics_pro200.htm

manually setting it (in 1.3) to the dm9102 fixes the problem nicely.

it's a new (2nd hand compaq) box, and currently not "live", so I'm quite
happy to do any testing, including re-installing, for the next couple of
days. If that would help anyone debug/fix this.

[1] pinging my adsl modem box gives "destination host unreachable".

----

also, and hardly worth mentioning...

1.2 defaults to country of uk. 1.3 defaults to us.  which is fine...

1.2 defaults to "europe/london", after I select (default) UK. Seems
sensible.
1.3 defaults to CET, after I select UK (and not default US). Seems a little
odd ;)

on 21/5/03 4:54 pm, Andre Newman at ip...@di... wrote:

> Hi,
> 
> I've been lurking here for a while, not really had a reason to chime in,
> until now.
> 
> I have a copy of ipcop 1.3.1 alpha 1 running on a test machine and I am
> very interested in the new traffic shaping. I've spent some time with htb
> on a redhat machine with mixed results but we run IPcop here already so
> this is better for me.
> 
> The webpage for this works fine for overall link speed but the service
> section fails with an unable to open file error in the http log. The
> missing file seems to be /var/ipcop/shaping/settings I have created the
> file but am struggling to decipher what parameters to put in it.
> 
> I'm happy to do some testing with this and try to contribute as I have
> some specific things I need to do and I'd like to do them with IPcop if
> possible.
> 
> Regards
> 
> Andre

Hi Andre

I think you have to create two files in /var/ipcop/shaping which may be
missing from the 131alpha1 iso. I've hacked my test box so heavily, it's
difficult to tell what's original any more :)

The files don't have to contain any information, as the shaping.cgi edits
them for you. But if you can't find these two files in /var/ipcop/shaping,
create them and change their ownership by executing the following commands
from a console:

touch /var/ipcop/shaping/settings
touch /var/ipcop/shaping/config
chown 99:99 /var/ipcop/shaping/*

HTH

Eric

In article <001901c31f83$a8a469f0$020...@ra...>, Dave Smith 
<Dav...@ds...> wrote
>I use everydns.net to host my DNS name, and I've modified my IPCOP1.3 to
>support it.  It involved tweaking a couple of files and adding a new Perl
>script and MIME/Base64.pm.  Who should I send these changes to?

As one who is treading a similar path, currently modifying setddns.pl to 
make it compatible with the dynDNS service provided by gradwell.com, I'd 
certainly appreciate seeing what you have done :)

Regards,
-- 
Bob Evans

> Actually, there is a solution.  Edit /etc/rc.d/rc.red and add his text to
 > line 392:  'holdoff','30',
 > so the pppd command looks like this:
 >         push(@pppcommand, ('noipdefault',
 >         'default-asyncmap','holdoff','30',

This has also fixed the problem for me......

Dear Edward,

The file that would need editing is /home/httpd/cgi-bin/pppsetup.cgi, but
there are quite a few places the code would need to be changed. What I would
suggest as a quick fix is to set up your PPP settings as normal, but use
ttyS0. Once the profile is changed & selected as active, log in to the box
via ssh, and go to /var/ipcop/ppp/settings, and edit the line that says
COMPORT=ttyS0 to COMPORT=ttyS4. As long as you don't try to edit the ppp
settings, this should work.

Note to the developers list: We may need to have an easy way to pick up
additional serial ports for internal hardware modems.

Regards,

Marco.

----- Original Message -----
From: "Edward Yantis" <edw...@ne...>
To: <ipc...@li...>
Sent: Thursday, May 22, 2003 12:59 PM
Subject: [IPCop-user] Re:changing from ISA to PCI modem


> Yep, I noticed that when I installed it into a windows box - set itself up
as COM5.
> You suggested hacking the settings..... I'm going to need considerable
help with that.
> Perhaps since this is hardware from a very common vendor, this could be
included in a fix (or at the
> least, an optional add on.)
> Anyway, can you (or anyone) give me an outline of what needs to be
changed? I'm guessing that either
> I have to add the option to choose COM5 in the web interface, or change
one of the COM choices to
> actually point to COM5.
>
> Should this thread be directed to the developer list?
>
>
>
> ----- Original Message -----
> From: "Marco van Beek" <mva...@su...>
> To: "Edward Yantis" <edw...@ne...>
> Sent: Thursday, May 22, 2003 5:12 AM
> Subject: Re: [IPCop-user] Re:changing from ISA to PCI modem
>
>
> > It looks like your PCI modem is on ttyS4 (aka COM5) You may have to hack
the
> > settings a bit as I think the GUI only shows COM1 to 4.
> >
> > Regards,
> >
> > Marco.
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: ObjectStore.
> If flattening out C++ or Java code to make your application fit in a
> relational database is painful, don't do it! Check out ObjectStore.
> Now part of Progress Software. http://www.objectstore.net/sourceforge
> _______________________________________________
> IPCop-user mailing list
> IPC...@li...
> https://lists.sourceforge.net/lists/listinfo/ipcop-user
>

On Wed, 2003-05-21 at 08:22, James Read wrote: 
> Ovbiously when enabled IPCop is less secure then it being
> disabled, as like a warning to users. Some commercial routers have this
> feature, and it could be a another usefull thing to have in the IPCop
> system?

On Thu, 2003-05-22 at 00:49, ja...@gu... wrote:
> IPCop is a firewall, based on Linux Kernel v2.4....  We are NOT here 
> to be a network printer or file server or any other type of stange 
> box.  We do add functions like DNS and DHCP support small networks to 
> work easier, but these are still trimed to handle only a limit 
> functionality... So you can not make big mistakes.

IPCop is designed to tame the rather endlessly flexible Linux platform
into an easily managed solution for those less familiar with Linux, let
alone general networking and security concepts.  To add more and more
functionality would be to break that approach.

Furthermore, you normally want to _limit_ functionality on a firewall,
to _limit_ the possibility that it will be compromised (the worst thing
to happen to a network is for its firewall to be compromised).  Just
because commercial firewalls, especially those that are add-on software
to general purpose OSes, allow this doesn't mean it's the right thing to
do.  I.e., "less secure" is a _mega-understatement_.

Now that doesn't mean you have to use "raw" Linux to get more flexible
capabilities.  There are many solutions that will let you do more.  To
start, any distro with Webmin loaded atop offers some of these
capabilities.  I've heard E-smith is a good distribution for building
"all-in-one" boxes.

But I would tend to recommend you _avoid_ using your firewall box as a
"all-in-one" solution.  It's really worth the _small_ additional cost
and effort to put two boxes in -- a firewall and a LAN server.  If
you're worried about power or environmental concerns, then investigate
some of relatively low-cost ViA's Eden and C3 processor platforms.


-- 
Bryan J. Smith, E.I.   b.j...@ie...   http://thebs.org
CCA CCDA CCNA CIWSA CNA LPIC2 MCSA RHCE SCNA SCSecA + et al.
------------------------------------------------------------
Linux features clean-room, legacy UNIX(R)-free source code.
Ironically, Windows incorporates plenty of UNIX(R) source.