ipcop-devel Mailing List for IPCop Firewall

Also you might want to modify the make file to clear any ccache mount =
points.  Put this where the other mount lines are:

umount $BASEDIR/ccache           2>/dev/null;

-----Original Message-----
From: Roy Walker=20
Sent: Friday, April 30, 2004 5:50 PM
To: ipc...@li...
Subject: RE: [IPCop-devel] CCACHE & IPCop 1.4

I tried building from the latest CVS and I am getting the following
error:

checking for C compiler default output... configure: error: C compiler
cannot create executables

This is when it is first starting to build ccache.  Ccache seems nice,
but I have no experience with it.  Anyone care to shed some light?  OS
is Mandrake 9.2.  I have had no problems building TONS of other apps on
this box.

Thanx,
Roy

-----Original Message-----
From: jampie [mailto:ja...@bo...]=20
Sent: Thursday, April 22, 2004 8:08 AM
To: ipc...@li...
Subject: RE: [IPCop-devel] CCACHE & IPCop 1.4

Works great, building time dropped from 9 hours to 3.5!
Thanks!



-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=3D1470&alloc_id=3D3638&op=3Dcli=
ck
_______________________________________________
IPCop-devel mailing list
IPC...@li...
https://lists.sourceforge.net/lists/listinfo/ipcop-devel


-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g. =

Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id149&alloc_id=8166&op=3Dick
_______________________________________________
IPCop-devel mailing list
IPC...@li...
https://lists.sourceforge.net/lists/listinfo/ipcop-devel

I tried building from the latest CVS and I am getting the following
error:

checking for C compiler default output... configure: error: C compiler
cannot create executables

This is when it is first starting to build ccache.  Ccache seems nice,
but I have no experience with it.  Anyone care to shed some light?  OS
is Mandrake 9.2.  I have had no problems building TONS of other apps on
this box.

Thanx,
Roy

-----Original Message-----
From: jampie [mailto:ja...@bo...]=20
Sent: Thursday, April 22, 2004 8:08 AM
To: ipc...@li...
Subject: RE: [IPCop-devel] CCACHE & IPCop 1.4

Works great, building time dropped from 9 hours to 3.5!
Thanks!



-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=3D1470&alloc_id=3D3638&op=3Dcli=
ck
_______________________________________________
IPCop-devel mailing list
IPC...@li...
https://lists.sourceforge.net/lists/listinfo/ipcop-devel

att...@gm...(Attila Konietzka)  30.04.04 17:39


>Hello,

>Since no one on the ipcop-user list could help me with my problem, i
>will try it in here were i expect all the developers arround, since my
>question is somewhat special.

>I want to know how to incooperate the brltty-program braille
>console-driver into ipcop during the installation process, because i
>need to utilize an braille-device when reading out screen-contents.

>I thought of using an statically linked brltty at least for the
>install process, as the other things after the machines reboot can
>also be done via the ssh-interface, in case the web interface
>shouldn't work unexpectetly.

>I thought of using the ready build executables that can be found at
>http://www.brlspeak.net/brlstatx.php

>I will go and pick the right binary for my device-modell and
>serial-port. 

>So How can i proced, to change the iso-image of ipcop to
>contain the brltty, and make it launch during boot-process?
>Anyone in here who did similar modifikations to his ipcop-iso, and can
>anyhow help me?

Some time ago i mailed, how to install "mgetty" into IPcop
(mainly using the linux serial conmsole howto).
I assume that it should not matter what kind of "tty" is used.

>I just want to know what exactly happens, when the iso boots up, and
>what scripts are exactly launched after one another, and where to put
>my brltty on the iso to come up when booting.

mgetty is placed into "/etc/initab" which launches it as
often as it dies.

To place it into the 1.3 iso would be an interessting task
(I gave up) maybe "iso buster" can help.
But i would not waste any time on making your own 1.3,
much better and easier an 1.4 ISO can be made.
It took (once) serveral hours because all files are fresh
complied (LFS), but it works on non-Redhat flawlessly!



>The other Issue i have is, that the brltty just doesn't need to be
>loaded in normal usage after the ipcop is setup successfully, 
>because i will operate him from another machine, 
>where Accessibility is already present, and ipcop only needs 
>to be operated through the network via ssh or the webinterface. 

>What have i done so far?

>I have tried to hack the bootfloppy for ipcop to fit brltty on it, and
>allthough the smallest available brltty round 106 kb only in size, it
>still won't fit on the ipcop bootdisk.

Why can't you place it into an "addon" package?
Of course it would be nice if all messages are sent via
serial, but 1.3 can't do it.
Try 1.4, IIRC that's already "serial console ready",
but don't know if the setup it self already uses serial.


>Unfortunately you cannot compress an upx-compressed e
>xecutable any further, so after the final
># cat installrootimage | gzip -9 > installrootimage.gz
>the whole gz-file blew up from arround 620 kb to 707 kb and
>consequently the space on my mounted bootdisk-image went out, and the
>attempt was in vain. 

>Unfortunately i cannot find where the boot-sequence is stored 
>on the isos, 

That an option to "mkisofs".
There are several ways: one is "Floppy emulation", which is
limiter to 2MB in size IIRC.
The other is used by syslinux.

>and when i mount the iso on my knoppix with 
># mkdir inst0
># mount -o loop ipcop.iso inst0
>it does this without any comment afterwards, 
>and also when i type only
>#mount
>without any parameters this iso shows up as (rw,loop=/dev/loop0).
>But when i want to change something on the iso:
># cd inst0
># mkdir new_dir
>it says that it cannot make any changes, because the whole filesystem
>is read-only.
>How can you explain this?

Because the ISO driver has only the "reading" path implemented, because
CD-ROMs were initially invented to be only readable... "UFS" might be 
a workarround, but...

You need "mkisofs" to generate an iso-image.
See in 1.4 who to use it.

A possible way:
Mount the iso-image
copy(!) all data from the iso to your disc
usings "cp -pr" or "tar-me-in-tar-me-out" to get all sym- + hardlinks
Extract the boot track (hm, with which tool? dd?)
Edit the files as required
lanch "mkisofs" (with tha same parameters asin teh IPcop make) 
to generate the new ISO image.


The only way i think that allows to "hack" directly into an ISO
image, without mkisofs, is "iso buster"?


>If anyone could help me please, i am stuck somehow and don't know
>where is my fault.


>Just before i forget: all this hacking was done on an previously
>mounted maxtor usb-harddrive, so no bloating the ramdisk was
>necessary, and all subsequent work was done on /mnt/sda1, which is
>actually a fat32 partition. Thanks very much in advance, and best
>Greetings, Attila.

BTW: Add more "empty lines" into you text (see above my attempt?)
It makes it more readable and more likely to be read.

Rainer---<=====>                         Vertraulich
             //  
           //                              
         <=====>--------------ocholl, Kiel, Germany ------------

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,
Since no one on the ipcop-user list could help me with my problem, i will
try it in here were i expect all the developers arround, since my question
is somewhat special.
I want to know how to incooperate the brltty-program braille console-driver
into ipcop during the installation process, because i need to utilize an
braille-device when reading out screen-contents.
I thought of using an statically linked brltty at least for the install
process, as the other things after the machines reboot can also be done
via the ssh-interface, in case the web interface shouldn't work
unexpectetly.
I thought of using the ready build executables that can be found at
http://www.brlspeak.net/brlstatx.php
I will go and pick the right binary for my device-modell and serial-port.
So How can i proced, to change the iso-image of ipcop to contain the brltty,
and make it launch during boot-process?
Anyone in here who did similar modifikations to his ipcop-iso, and can
anyhow help me?
I just want to know what exactly happens, when the iso boots up, and what
scripts are exactly launched after one another, and where to put my brltty
on the iso to come up when booting.
The other Issue i have is, that the brltty just doesn't need to be loaded in
normal usage after the ipcop is setup successfully, because i will operate
him from another machine, where Accessibility is already present, and ipcop
only needs to be operated through the network via ssh or the webinterface.
What have i done so far?
I have tried to hack the bootfloppy for ipcop to fit brltty on it, and
allthough the smallest available brltty round 106 kb only in size, it still
won't fit on the ipcop bootdisk.
Unfortunately you cannot compress an upx-compressed executable any further,
so after the final
# cat installrootimage | gzip -9 > installrootimage.gz
the whole gz-file blew up from arround 620 kb to 707 kb and consequently the
space on my mounted bootdisk-image went out, and the attempt was in vain.
Unfortunately i cannot find where the boot-sequence is stored on the isos,
and when i mount the iso on my knoppix with
# mkdir inst0
# mount -o loop ipcop.iso inst0
it does this without any comment afterwards, and also when i type only
#mount
without any parameters this iso shows up as (rw,loop=/dev/loop0).
But when i want to change something on the iso:
# cd inst0
# mkdir new_dir
it says that it cannot make any changes, because the whole filesystem is
read-only.
How can you explain this?
If anyone could help me please, i am stuck somehow and don't know where is
my fault.
Just before i forget: all this hacking was done on an previously mounted
maxtor usb-harddrive, so no bloating the ramdisk was necessary, and all
subsequent work was done on /mnt/sda1, which is actually a fat32 partition.
Thanks very much in advance, and best Greetings, Attila.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (MingW32) - GPGrelay v0.94

iD8DBQFAknNHTgNfLOyb+zkRAt28AJ9gxIzUxs9CfalYoPKwGbct6vpU6gCgnFi6
5PmsYTrGIZsiE4rWo0ysiEM=
=lwYm
-----END PGP SIGNATURE-----

Eric Oberlander wrote:
<snip>
>>--- 253,264 ----
>>"DEF:read=$rrdlog/disk.rrd:readsect:AVERAGE",
>>"DEF:write=$rrdlog/disk.rrd:writesect:AVERAGE",
>>"AREA:readps#0000FF:$tr{'sectors read from disk per second'}\\j",
> 
>         ^^^^^^
> Does this need to be changed to 'read', instead of 'readps'
> 

Hello Eric

I changed this on my 1.4b4 installation. Disk graphs are generated now 
and disk access (read/write) is shown as one may expect (not a solid 
blue as in 1.4b3 anymore).

Thank you the help

Roger

----
Roger Murer
r....@ti...

> By adjustment I meant is there anyone who is or has worked on an addon for
ipcop that allows the other interfaces to be Source NAT'd from an alias
instead of the red interface?

This is what I have in rc.local for orange - but it should be the same
principle for blue

# get rid of MASQUARADE RULE
/sbin/iptables -t nat -F RED

# mail server SNAT
/sbin/iptables -t nat -A RED -s 192.168.22.2 -o eth1 -j SNAT --to 81.2.64.66

#  www server SNAT
/sbin/iptables -t nat -A RED -s 192.168.22.3 -o eth1 -j SNAT --to 81.2.64.67

# NAT all to 81.2.64.65
/sbin/iptables -t nat -A RED -o eth1 -j SNAT --to 81.2.64.65




Hope that helps

Nick.

Hi

on 19/4/04 2:12 pm, Mark Wormgoor at ri...@us... wrote:

> Modified Files:
> Tag: IPCOP_v1_4_0
> makegraphs 
> Log Message:
> Fix diskgraphs
> 
> Index: makegraphs
> ===================================================================
> RCS file: /cvsroot/ipcop/ipcop/src/scripts/makegraphs,v
> retrieving revision 1.19.2.3
> retrieving revision 1.19.2.4
> diff -C2 -d -r1.19.2.3 -r1.19.2.4
> *** makegraphs    19 Apr 2004 13:02:41 -0000    1.19.2.3
> --- makegraphs    19 Apr 2004 13:12:08 -0000    1.19.2.4
> ***************
> *** 253,266 ****
> "DEF:read=$rrdlog/disk.rrd:readsect:AVERAGE",
> "DEF:write=$rrdlog/disk.rrd:writesect:AVERAGE",
> -         "CDEF:readps=300,read,/",
> -         "CDEF:writeps=300,write,/",
> "AREA:readps#0000FF:$tr{'sectors read from disk per second'}\\j",

snip...

> --- 253,264 ----
> "DEF:read=$rrdlog/disk.rrd:readsect:AVERAGE",
> "DEF:write=$rrdlog/disk.rrd:writesect:AVERAGE",
> "AREA:readps#0000FF:$tr{'sectors read from disk per second'}\\j",
        ^^^^^^
Does this need to be changed to 'read', instead of 'readps'

> !         "STACK:write#00FF00:$tr{'sectors written to disk per second'}\\j",
> !         "GPRINT:read:MAX:$tr{'maximal'} $tr{'read sectors'}\\:%8.0lf",
> !         "GPRINT:read:AVERAGE:$tr{'average'} $tr{'read sectors'}\\:%8.0lf",
> !         "GPRINT:read:LAST:$tr{'current'} $tr{'read sectors'}\\:%8.0lf\\j",
> !         "GPRINT:write:MAX:$tr{'maximal'} $tr{'written sectors'}\\:%8.0lf",
> !         "GPRINT:write:AVERAGE:$tr{'average'} $tr{'written
sectors'}\\:%8.0lf",
> !         "GPRINT:write:LAST:$tr{'current'} $tr{'written
sectors'}\\:%8.0lf\\j");
> $ERROR = RRDs::error;
> print "Error in RRD::graph for disk: $ERROR\n" if $ERROR;

Regards.

Eric

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@       WARNING: POSSIBLE DNS SPOOFING DETECTED!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
The DSA host key for cvs.ipcop.sourceforge.net has changed,
and the key for the according IP address 66.35.250.209
is unknown. This could either mean that
DNS SPOOFING is happening or the IP address for the host
and its host key have changed at the same time.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the DSA host key has just been changed.
The fingerprint for the DSA key sent by the remote host is
4c:68:03:d4:5c:58:a6:1d:9d:17:13:24:14:48:ba:99.
Please contact your system administrator.
Add correct host key in /root/.ssh/known_hosts to get rid of this message.
Offending key in /root/.ssh/known_hosts:1
DSA host key for cvs.ipcop.sourceforge.net has changed and you have
requested strict checking.

Is this warning just a warning or something serious?

> -----Original Message-----
> From: ipc...@li... [mailto:ipcop-devel-
> ad...@li...] On Behalf Of Trevor Benson
> Sent: Wednesday, April 28, 2004 5:56 PM
> To: ipc...@li...
> Subject: [IPCop-devel] Blue Interface
>=20
> Is there currently anyone already making an adjustment to allow the =
blue
> interface to use a separate SNAT than the green interface?  I am =
looking
> to allow blue to use a ALIAS ip, instead of locking it to the RED
> Interface IP.

By adjustment I meant is there anyone who is or has worked on an addon =
for ipcop that allows the other interfaces to be Source NAT'd from an =
alias instead of the red interface?


> Also would this not also allow us to separate the traffic shaping for
> green and blue networks separately??
>=20
> Trevor Benson
>=20
>=20
>=20
> -------------------------------------------------------
> This SF.Net email is sponsored by: Oracle 10g
> Get certified on the hottest thing ever to hit the market... Oracle =
10g.
> Take an Oracle 10g class now, and we'll give you the exam FREE.
> http://ads.osdn.com/?ad_id149&alloc_id=8166&op=3Dick
> _______________________________________________
> IPCop-devel mailing list
> IPC...@li...
> https://lists.sourceforge.net/lists/listinfo/ipcop-devel

Is there currently anyone already making an adjustment to allow the blue
interface to use a separate SNAT than the green interface?  I am looking
to allow blue to use a ALIAS ip, instead of locking it to the RED
Interface IP.

Also would this not also allow us to separate the traffic shaping for
green and blue networks separately??

Trevor Benson

Looking at the Serial HOWTO, it says that when serial ports are used 
(including USB type ones, such as we are using) that a lock file is 
written to /var/lock, including the PID of the process that locked the port.

I wonder if it is possible to add to the disconnect script (e.g. that 
runs when one clicks the 'Disconnect' button) a command that clears the 
lock.  Or it clears the lock when the connect script is run (but would 
not clear the lock if there is already a successful connection).

I will have a play tonight and see what happens.

...Richard

Thomas Ingram wrote:
> I'm currently running v1.4b2 and have the same problem, although if you
> unplug the usb cable and plug it back in the modem will allow you to redial
> without a reboot.
> as for page updates, i think it updates once only, i've had to manually
> refresh.
> sorry, i have no solution for these problems.
> 
> ----- Original Message ----- 
> From: "Richard McGrath" <ric...@bi...>
> To: "IPCOP devel" <ipc...@li...>
> Sent: Wednesday, April 28, 2004 8:22 AM
> Subject: [IPCop-devel] Bug Report and Problems with Telstra Modem
> 
> 
> 
>>Well I have tested Beta 3 of V1.4 and have the following problems:
>>
>>- I can connect to the NT1 Plus 2 ISDN modem, but after a disconnection,
>>it will not connect again until the IPCOP box is rebooted.
>>/var/log/messages says that /dev/ttyACM0 is still locked.  Is there a
>>(disconnect) script that is not releasing the lock correctly?
>>
>>- Just a little GUI bug, that may have already been fixed, is that when
>>you selected 'USB on ACM0' (or words to that affect) from the drop down
>>list on the dialup page, select save, and refresh the page the drop down
>>list shows 'USB on ACM3'.  Looking at the actual settings file, 'USB on
>>ACM0' is actually saved.  So the drop down is not syncing with what is
>>in the settings file.
>>
>>- With IPCOP v1.3 the 'home' page would refresh every n amount of
>>seconds.  Then when you clicked 'connect', it would change to
>>'Dialing...'.  It would refresh automatically so that if the connection
>>was successful you would see that status, or go back to 'Idle' if
>>something went wrong.  Also if the connection dropped out it would go
>>back to 'Idle'.  Does the home page still have auto-refresh, because it
>>did not feel like it.
>>
>>Thanks for any help,
>>Richard
>>
>>Gilles Espinasse wrote:
>>
>>
>>>----- Original Message -----
>>>From: "Richard McGrath" <ric...@bi...>
>>>To: <ipc...@li...>
>>>Sent: Tuesday, April 27, 2004 4:19 AM
>>>Subject: [IPCop-devel] Problems with Telstra Modem and IPCOP v1.4
>>>
>>>
>>>
>>>
>>>>Hi,
>>>>
>>>>I have tried IPCOP 1.4 b1, and while it helped me with getting the
>>>>Telstra NT1 Plus 2 ISDN modem going, there are still some issues:
>>>>
>>>>- IPCOP will successfully connect, but then after a disconnection
>>>>(timeout, manual or otherwise) it will not connect unless you reboot the
>>>>machine.  From what I can see in /var/log/messages there is some locking
>>>>problem with /dev/ttyACM0.
>>>>
>>>>- There are some problems with the interface, but as I am using b1,
>>>>these may have been fixed by now.
>>>>
>>>>Where can I get and ISO of the latest beta?  This would make life really
>>>>easy for testing purposes.
>>>>
>>>>Thanks for any help,
>>>>Richard
>>>>
>>>>
>>>
>>>Everything is there
>>>http://prdownloads.sourceforge.net/ipcop/
>>>
>>>There is a bug in beta3 wich can be removed by withdrawing the line with
>>>'use locale' in /var/ipcop/header.pl
>>>this line will correct the problem
>>>sed -i -e 's/use locale//' /var/ipcop/header.pl
>>>
>>>
>>>
>>>-------------------------------------------------------
>>>This SF.net email is sponsored by: The Robotic Monkeys at ThinkGeek
>>>For a limited time only, get FREE Ground shipping on all orders of $35
>>>or more. Hurry up and shop folks, this offer expires April 30th!
>>>http://www.thinkgeek.com/freeshipping/?cpg=12297
>>>_______________________________________________
>>>IPCop-devel mailing list
>>>IPC...@li...
>>>https://lists.sourceforge.net/lists/listinfo/ipcop-devel
>>>
>>
>>
>>-------------------------------------------------------
>>This SF.Net email is sponsored by: Oracle 10g
>>Get certified on the hottest thing ever to hit the market... Oracle 10g.
>>Take an Oracle 10g class now, and we'll give you the exam FREE.
>>http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
>>_______________________________________________
>>IPCop-devel mailing list
>>IPC...@li...
>>https://lists.sourceforge.net/lists/listinfo/ipcop-devel
>>
>>
> 
> 
> 
> 

> -----Original Message-----
> Sent: Thursday, 29 April 2004 03:24
> Subject: [IPCop-devel] Release 1.4.0 b4
> 
> Hello
> 
> Is there already a timewindow defined for b4? I was just wondering that
> there been always 1-2 weeks between two versions and now, the last
> betarelease is already 4 weeks old.
> 
> Another question: Is there a place where user without a seperate
> buildmachine can get a CVS-ISO-image for download. That would be very
> helpfull for testing new fixes. I know that a cvs-snapshot will never be
> good enough for real-usage but for testing fixes or new features it will
> be
> good enough and problems or sideeffects can be found before a new beta is
> released... ;)
> 

Sounds like Andreas is yet another IPCop user hanging out to try the green,
red, orange & blue networks... 

You guys have double/tripled checked to make sure the segment error will not
happen in the next beta right.. :)

I was shattered when it occurred in 1.4b3 

Anyway.. back to the waiting... keep up the good work...

Hello

Is there already a timewindow defined for b4? I was just wondering that
there been always 1-2 weeks between two versions and now, the last
betarelease is already 4 weeks old.

Another question: Is there a place where user without a seperate
buildmachine can get a CVS-ISO-image for download. That would be very
helpfull for testing new fixes. I know that a cvs-snapshot will never be
good enough for real-usage but for testing fixes or new features it will be
good enough and problems or sideeffects can be found before a new beta is
released... ;)

Kind Regards
Andreas

Roy,

You found the answer to why we haven't applied a patch for this in the 
past ;-)
The only way to fix this is to add specific rules to the squid chain to 
ignore traffic for other networks.  Doing that makes it very complex and 
error-prone.

Kind regards,

Mark

> I would like to state for the record, that I am not CRAZY!!!  :-)
>  
> I think I found a solution, but I don't know see anyway to get it to
> work.  I guess that is somewhat of a paradox.
>  
> /sbin/iptables -t nat -A SQUID -i eth0 -p tcp -d
> 172.20.1.0/255.255.255.0 --dport 80 -j ACCEPT
> /sbin/iptables -t nat -A SQUID -i eth0 -p tcp -d !
> 64.123.34.32/255.255.255.248 --dport 80 -j REDIRECT --to-port 800
>  
> Would need one line for each of the IPSEC tunnels with an accept added
> to the SQUID chain like the first.  We are excluding the RED network
> space from the proxy to get the aliases to work.  Do I need to add in
> lines for the orange and blue networks if they are set like I am for any
> IPSEC networks that exist?  I do not see an easy way (it is beyond my
> abilities) to get the IPSEC networks out of the config files.  Anyone
> want to assist on this?
>  
> Roy
>  
> -----Original Message-----
> From: Roy Walker 
> Sent: Tuesday, April 27, 2004 5:37 PM
> To: IPCop_Devel
> Subject: RE: [IPCop-devel] Transparent Squid fix
>  
> I think the problem is that since the SQUID chain is being called in the
> CUSTOMPREROUTING chain it does not know the exit interface?  That sound
> right?  I could make a series of reject lines before it gets to the one
> accept lines to make sure it rejects all the traffic for the attached
> networks (this would be very complicated for the IPSEC tunnels).  What
> is the need to make this a PREROUTE chain?
>  
> Roy
>  
> -----Original Message-----
> From: Roy Walker 
> Sent: Tuesday, April 27, 2004 4:54 PM
> To: IPCop_Devel
> Subject: RE: [IPCop-devel] Transparent Squid fix
>  
> Sorry,
>  
> Ok.  Thought this was working, but turns out the transparent proxy was
> not working at all.  Here is what I put in there:
>  
> /sbin/iptables -t nat -A SQUID -i eth0 -p tcp -d !
> 64.123.34.32/255.255.255.248 --dport 80 -j REDIRECT --to-port 800 -o
> eth1
>  
> So eth0 is the green interface, the network is the red network, and eth1
> is the red interface.  So this should effectively do what I described
> below.  Unfortunately it is not picking up any traffic with this rule.
>  
> Anyone know why?
>  
> Roy
>  
> -----Original Message-----
> From: Roy Walker 
> Sent: Tuesday, April 27, 2004 3:15 PM
> To: IPCop_Devel
> Subject: [IPCop-devel] Transparent Squid fix
>  
> Okay this will make the transparent proxy for the green and blue
> interface only proxy traffic destined out the red interface and not
> destined for the red network.  If anyone can think of a reason why this
> would not be a good way to do this let me know.  This fixed traffic out
> the IPSEC tunnels and any aliases you may have setup.
>  
> Roy
> 

-- 
***************************************************************
* |\    /|      |  /|  /       Mark Wormgoor                  *
* | \  / |      | / | /        mailto:ma...@wo...       *
* |  \/  |ark   |/  |/ormgoor  http://www.wormgoor.com/mark/  *
***************************************************************

I would like to state for the record, that I am not CRAZY!!!  :-)
=20
I think I found a solution, but I don't know see anyway to get it to
work.  I guess that is somewhat of a paradox.
=20
/sbin/iptables -t nat -A SQUID -i eth0 -p tcp -d
172.20.1.0/255.255.255.0 --dport 80 -j ACCEPT
/sbin/iptables -t nat -A SQUID -i eth0 -p tcp -d !
64.123.34.32/255.255.255.248 --dport 80 -j REDIRECT --to-port 800
=20
Would need one line for each of the IPSEC tunnels with an accept added
to the SQUID chain like the first.  We are excluding the RED network
space from the proxy to get the aliases to work.  Do I need to add in
lines for the orange and blue networks if they are set like I am for any
IPSEC networks that exist?  I do not see an easy way (it is beyond my
abilities) to get the IPSEC networks out of the config files.  Anyone
want to assist on this?
=20
Roy
=20
-----Original Message-----
From: Roy Walker=20
Sent: Tuesday, April 27, 2004 5:37 PM
To: IPCop_Devel
Subject: RE: [IPCop-devel] Transparent Squid fix
=20
I think the problem is that since the SQUID chain is being called in the
CUSTOMPREROUTING chain it does not know the exit interface?  That sound
right?  I could make a series of reject lines before it gets to the one
accept lines to make sure it rejects all the traffic for the attached
networks (this would be very complicated for the IPSEC tunnels).  What
is the need to make this a PREROUTE chain?
=20
Roy
=20
-----Original Message-----
From: Roy Walker=20
Sent: Tuesday, April 27, 2004 4:54 PM
To: IPCop_Devel
Subject: RE: [IPCop-devel] Transparent Squid fix
=20
Sorry,
=20
Ok.  Thought this was working, but turns out the transparent proxy was
not working at all.  Here is what I put in there:
=20
/sbin/iptables -t nat -A SQUID -i eth0 -p tcp -d !
64.123.34.32/255.255.255.248 --dport 80 -j REDIRECT --to-port 800 -o
eth1
=20
So eth0 is the green interface, the network is the red network, and eth1
is the red interface.  So this should effectively do what I described
below.  Unfortunately it is not picking up any traffic with this rule.
=20
Anyone know why?
=20
Roy
=20
-----Original Message-----
From: Roy Walker=20
Sent: Tuesday, April 27, 2004 3:15 PM
To: IPCop_Devel
Subject: [IPCop-devel] Transparent Squid fix
=20
Okay this will make the transparent proxy for the green and blue
interface only proxy traffic destined out the red interface and not
destined for the red network.  If anyone can think of a reason why this
would not be a good way to do this let me know.  This fixed traffic out
the IPSEC tunnels and any aliases you may have setup.
=20
Roy

Well I have tested Beta 3 of V1.4 and have the following problems:

- I can connect to the NT1 Plus 2 ISDN modem, but after a disconnection, 
it will not connect again until the IPCOP box is rebooted. 
/var/log/messages says that /dev/ttyACM0 is still locked.  Is there a 
(disconnect) script that is not releasing the lock correctly?

- Just a little GUI bug, that may have already been fixed, is that when 
you selected 'USB on ACM0' (or words to that affect) from the drop down 
list on the dialup page, select save, and refresh the page the drop down 
list shows 'USB on ACM3'.  Looking at the actual settings file, 'USB on 
ACM0' is actually saved.  So the drop down is not syncing with what is 
in the settings file.

- With IPCOP v1.3 the 'home' page would refresh every n amount of 
seconds.  Then when you clicked 'connect', it would change to 
'Dialing...'.  It would refresh automatically so that if the connection 
was successful you would see that status, or go back to 'Idle' if 
something went wrong.  Also if the connection dropped out it would go 
back to 'Idle'.  Does the home page still have auto-refresh, because it 
did not feel like it.

Thanks for any help,
Richard

Gilles Espinasse wrote:

> ----- Original Message -----
> From: "Richard McGrath" <ric...@bi...>
> To: <ipc...@li...>
> Sent: Tuesday, April 27, 2004 4:19 AM
> Subject: [IPCop-devel] Problems with Telstra Modem and IPCOP v1.4
> 
> 
> 
>>Hi,
>>
>>I have tried IPCOP 1.4 b1, and while it helped me with getting the
>>Telstra NT1 Plus 2 ISDN modem going, there are still some issues:
>>
>>- IPCOP will successfully connect, but then after a disconnection
>>(timeout, manual or otherwise) it will not connect unless you reboot the
>>machine.  From what I can see in /var/log/messages there is some locking
>>problem with /dev/ttyACM0.
>>
>>- There are some problems with the interface, but as I am using b1,
>>these may have been fixed by now.
>>
>>Where can I get and ISO of the latest beta?  This would make life really
>>easy for testing purposes.
>>
>>Thanks for any help,
>>Richard
>>
>>
> 
> Everything is there
> http://prdownloads.sourceforge.net/ipcop/
> 
> There is a bug in beta3 wich can be removed by withdrawing the line with
> 'use locale' in /var/ipcop/header.pl
> this line will correct the problem
> sed -i -e 's/use locale//' /var/ipcop/header.pl
> 
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: The Robotic Monkeys at ThinkGeek
> For a limited time only, get FREE Ground shipping on all orders of $35
> or more. Hurry up and shop folks, this offer expires April 30th!
> http://www.thinkgeek.com/freeshipping/?cpg=12297
> _______________________________________________
> IPCop-devel mailing list
> IPC...@li...
> https://lists.sourceforge.net/lists/listinfo/ipcop-devel
> 

I think the problem is that since the SQUID chain is being called in the
CUSTOMPREROUTING chain it does not know the exit interface?  That sound
right?  I could make a series of reject lines before it gets to the one
accept lines to make sure it rejects all the traffic for the attached
networks (this would be very complicated for the IPSEC tunnels).  What
is the need to make this a PREROUTE chain?
=20
Roy
=20
-----Original Message-----
From: Roy Walker=20
Sent: Tuesday, April 27, 2004 4:54 PM
To: IPCop_Devel
Subject: RE: [IPCop-devel] Transparent Squid fix
=20
Sorry,
=20
Ok.  Thought this was working, but turns out the transparent proxy was
not working at all.  Here is what I put in there:
=20
/sbin/iptables -t nat -A SQUID -i eth0 -p tcp -d !
64.123.34.32/255.255.255.248 --dport 80 -j REDIRECT --to-port 800 -o
eth1
=20
So eth0 is the green interface, the network is the red network, and eth1
is the red interface.  So this should effectively do what I described
below.  Unfortunately it is not picking up any traffic with this rule.
=20
Anyone know why?
=20
Roy
=20
-----Original Message-----
From: Roy Walker=20
Sent: Tuesday, April 27, 2004 3:15 PM
To: IPCop_Devel
Subject: [IPCop-devel] Transparent Squid fix
=20
Okay this will make the transparent proxy for the green and blue
interface only proxy traffic destined out the red interface and not
destined for the red network.  If anyone can think of a reason why this
would not be a good way to do this let me know.  This fixed traffic out
the IPSEC tunnels and any aliases you may have setup.
=20
Roy

Sorry,
=20
Ok.  Thought this was working, but turns out the transparent proxy was
not working at all.  Here is what I put in there:
=20
/sbin/iptables -t nat -A SQUID -i eth0 -p tcp -d !
64.123.34.32/255.255.255.248 --dport 80 -j REDIRECT --to-port 800 -o
eth1
=20
So eth0 is the green interface, the network is the red network, and eth1
is the red interface.  So this should effectively do what I described
below.  Unfortunately it is not picking up any traffic with this rule.
=20
Anyone know why?
=20
Roy
=20
-----Original Message-----
From: Roy Walker=20
Sent: Tuesday, April 27, 2004 3:15 PM
To: IPCop_Devel
Subject: [IPCop-devel] Transparent Squid fix
=20
Okay this will make the transparent proxy for the green and blue
interface only proxy traffic destined out the red interface and not
destined for the red network.  If anyone can think of a reason why this
would not be a good way to do this let me know.  This fixed traffic out
the IPSEC tunnels and any aliases you may have setup.
=20
Roy

On Monday 26 April 2004 10:25 pm, Gene Cooper wrote:
> Hi folks,
>
> I'm not a programmer, but I've used and helped support Smoothwalls and
> IPcops for years.
>
> I need to build two firewalls that will incorporate Sangoma PCI T1/E1
> cards. These firewalls will create a VPN between two offices connected by a
> T1.  I want to use IPCops.
>
> Apparently the driver modules are not included in any IPCop version, so I
> set about to build them.  I have done this sort of thing a time or two, but
> as I said, I'm no programmer.
>
> I tried to follow the instructions on the web site to create a build
> environment using RH 7.3.  It doesn't work.  I don't think some of the rpms
> the make.sh script tries to download are available any more as some of them
> can't be downloaded.  I built this box and downloaded RH 7.3 just for this
> purpose.
>
> I then tried to build on my Mandrake 9.2 workstation.  I didn't get far,
> and I gave up easily after the RH 7.3 episode.  ;-)
>
> Is there an updated make.sh to use with RH 7.3?

> Should I continue to work on the RH 7.3 box or on the Mandrake 9.2 box?

7.3 should be fine. You are building 1.4?

> Has someone already built modules for the Sangoma cards?
>
> Am I barking up the wrong tree?  ;-)
>
> Thanks for any tips you might give,

What are the errors you get when you run

./make.sh check

-- 

"The choices we make dictate the life we lead. To thine ownself be true." -- 
William Shakespeare
KI4DPT

Sunday night I installed 1.4b3 from floppy + cd.
(PPro200 will not boot from cd)

first time instalation crashed.
I was in setup utility already, selected network configuratio:
GREE + RED + BLUE + ORANGE
after which system spit out some error and rebooted.
After reboot I can not log in since I have not yet set root password
during install.

Reinstalled. Selected GREEN + RED network. setup finished without errors.
changed configuration to R+G+B+O without problems.

While trying to get my networks going again I found 2 issues with 1.4b3
one is reported bug 925497 with workaround explained here
http://marc.theaimsgroup.com/?l=ipcop-devel&m=108068031212228&w=

other one had me hosed for couple hours. Related to BLUE
Wireless acces point was also a broadband router, so ipcop blue was
192.168.169.2 and this router/access point had 192.168.169.1, but I used
it as a hub.
Everything worked, except I can not use DHCP on IPCop, since it gave .1 as
default gateway. Needed to set up network manualy on wireless PCs.
So I bought real access point and reconfigured network the normal way....
IPCop became 192.168.169.1 and access point .254. Now DHCP was working.
I could get on the network, cak even traceroute to www.google.com, but
browser on wireless machine would get "connection refused"/"action
canceled"(IE)
Rebooting IPCop showed no improvement.
Finaly the problem was solved by disabling WWW proxy on BLUE and enabling
it again. I had it as transparent.
my guess is that when enabled www proxy grabs BLUE ip and stores it
somewhere ..... once I changed BLUE from .2 to .1 www proxy on blue
started refusing connections.

for any questions or sugestions email me directly, I unsubscribed from the
list.

Tomas Mazukna

Peter Walker wrote:
> I don't think you are doing anything wrong, "fcrontab -e" is the command 
> to use. I have used it successfully on different 1.4b CVS builds (but 
> not b3). I just tried on my latest CVS build (Apr 23) which is post b3 
> and it works on that.
> 
>> 21:58:28 user "cron" is not in passwd file. Aborting.
> 
> 
> cron should be in /etc/passwd, if it is not there try adding it with 
> home  / and shell /bin/false.

> The fcron config files are in /etc/fcron.*, the config file should be 
> owned by root:cron. Do you have a cron group?

Hello Pete

Thank you for your answer. I think there is something screwed up on my 
box. /etc/fcron.* is completely missing. All the graphs hoewer are 
working. I think it is time to build and install a more recent build.

Kind regards
Roger

Roger Murer wrote:

Roger

> Hello devel list,
>
> I would like to insert a new cron job in a v1.4b3. Since there is no 
> cron anymore, I guess it uses fcron. Issuing a fcrontab -e as root, 
> returns:
> root@guard:~ # fcrontab -e

I don't think you are doing anything wrong, "fcrontab -e" is the command 
to use. I have used it successfully on different 1.4b CVS builds (but 
not b3). I just tried on my latest CVS build (Apr 23) which is post b3 
and it works on that.

> 21:58:28 user "cron" is not in passwd file. Aborting.

cron should be in /etc/passwd, if it is not there try adding it with 
home  / and shell /bin/false.

>
> I also tried to find the correct files where a (f)cron job could be 
> inserted, no luck. Maybe I am just too stupit :-), but I would be glad 
> to get some help.


The fcron config files are in /etc/fcron.*, the config file should be 
owned by root:cron. Do you have a cron group?

Hope this helps.

Pete

>
> Kind regards
> Roger Murer
>

Hello,

I have till now 2 Ipcop 1.4b4 (cvs build) in Production, well i know it is
beta and it is my own risk.

So want i want to know is, how do you (developers) put the changes(after the
final release) together, to provide updates ?

Here are some thoughts how to handle updates for a cvs build:

Well in my case i have ipcop's installed, based on my local cvs tree, so
when now changes to the main cvs are commited, i have to make a "make.sh
build", no problem till i don't need to make a "make.sh clean", catch the
changed files and put them all together in GPG singed archive ?

Questions left:
- what to do if a "make.sh clean" is rquired
- easy way to put the updated files in GPG signed archive ?

Best regards
Ufuk Altinkaynak

----- Original Message -----
From: "Richard McGrath" <ric...@bi...>
To: <ipc...@li...>
Sent: Tuesday, April 27, 2004 4:19 AM
Subject: [IPCop-devel] Problems with Telstra Modem and IPCOP v1.4


> Hi,
>
> I have tried IPCOP 1.4 b1, and while it helped me with getting the
> Telstra NT1 Plus 2 ISDN modem going, there are still some issues:
>
> - IPCOP will successfully connect, but then after a disconnection
> (timeout, manual or otherwise) it will not connect unless you reboot the
> machine.  From what I can see in /var/log/messages there is some locking
> problem with /dev/ttyACM0.
>
> - There are some problems with the interface, but as I am using b1,
> these may have been fixed by now.
>
> Where can I get and ISO of the latest beta?  This would make life really
> easy for testing purposes.
>
> Thanks for any help,
> Richard
>
>
Everything is there
http://prdownloads.sourceforge.net/ipcop/

There is a bug in beta3 wich can be removed by withdrawing the line with
'use locale' in /var/ipcop/header.pl
this line will correct the problem
sed -i -e 's/use locale//' /var/ipcop/header.pl

Hi folks,

I'm not a programmer, but I've used and helped support Smoothwalls and
IPcops for years.

I need to build two firewalls that will incorporate Sangoma PCI T1/E1 cards.
These firewalls will create a VPN between two offices connected by a T1.  I
want to use IPCops.

Apparently the driver modules are not included in any IPCop version, so I
set about to build them.  I have done this sort of thing a time or two, but
as I said, I'm no programmer.

I tried to follow the instructions on the web site to create a build
environment using RH 7.3.  It doesn't work.  I don't think some of the rpms
the make.sh script tries to download are available any more as some of them
can't be downloaded.  I built this box and downloaded RH 7.3 just for this
purpose.

I then tried to build on my Mandrake 9.2 workstation.  I didn't get far, and
I gave up easily after the RH 7.3 episode.  ;-)

Is there an updated make.sh to use with RH 7.3?

Should I continue to work on the RH 7.3 box or on the Mandrake 9.2 box?

Has someone already built modules for the Sangoma cards?

Am I barking up the wrong tree?  ;-)

Thanks for any tips you might give,

G

===========================
Gene Cooper
Sonora Communications, Inc.
5531 N. Oracle Road
Tucson, AZ  85704
(520) 293-8461
gc...@so...