ipcop-devel Mailing List for IPCop Firewall

Tom Fanning wrote:
> Hiya
> 
> I've just moved from 1.4.0b9 to 1.4.0rc5.
> 
> Having strange problems where I can't seem to get any port forwarding to
> work in this version.
> 
> External access to 222/tcp and 445/tcp works once enabled in the "external
> service access" section but manual port forwards just don't seem to work.
> 
> I restored from a backup thru the web gui.
> 
> Is this a known problem with a known fix? If any further info is needed,
> please let me know.

Hi,

This is probably what you are looking for:
http://marc.theaimsgroup.com/?l=ipcop-cvs&m=109649629228784&w=2

Kind regards

Roger

-- 
Roger Murer
E-Mail: r....@ti...

----- Original Message ----- 
From: "Daniel Di Giacomo" <li...@da...>
To: <ipc...@li...>
Sent: Thursday, September 30, 2004 11:06 PM
Subject: [IPCop-devel] Fritz!-Card


> Maybe it bores non-german IPCoppers, but I'd like 2no
> if fcdsl.o is now loading without 'unresolved symbol' - messages
> and doesn't crash after some minutes.
> My last try was RC5, and I would really appreciate to get rid of my
external DSL-"toaster".
>
> TshaKhoSan
>
We can't fix unknow problem.
I look at a bit (I don't have the hardware)

what I have tried
I try /etc/rc.d/rc.fritzdsl start and had unresolved symbol
/var/ipcop/fritzdsl/fcdsl.o: /var/ipcop/fritzdsl/fcdsl.o: unresolved symbol
detach_capi_driver_R910f5063
/var/ipcop/fritzdsl/fcdsl.o: /var/ipcop/fritzdsl/fcdsl.o: unresolved symbol
attach_capi_driver_Rd0a0eb63
/var/ipcop/fritzdsl/fcdsl.o:

So something was missing.
Looking at the /lib/modules/2.4.27/modules.dep show that line
/lib/modules/2.4.27/misc/fcdsl.o.gz:
/lib/modules/2.4.27/kernel/drivers/isdn/avmb1/kernelcapi.o.gz

To solve the unresolved symbol, type modprobe kernelcapi
or add the instruction to load the kernelcapi module in
/etc/rc.d/rc.fritzdsl before loading the fdsl module like this

 if [ -f /var/ipcop/fritzdsl/fcdsl.o ]; then
  /sbin/modprobe kernelcapi                   <= added there
  /sbin/insmod /var/ipcop/fritzdsl/fcdsl.o
  /usr/sbin/capiinit start

It should start correctly now. I can't say about crash.

Hi Eric,

I'm just about to release a new Pulsar driver version (v4.0.15) which is 
still in test.

The plan is to complete testing on Tuesday, and I should be able to release 
it on Tuesday night.

The reason for the delay is that my most rigorous beta site is a school, 
and the kids are on holidays this week. They will be back on Monday, and I 
expect the traffic to peak on Tuesday. It's amazing the traffic load 
generated by a 100 school kids surfing at lunchtime!

If I release my driver on Tuesday night, will this be in time for the final 
iso?

Kind regards,

  - Guy.

At 10:21 PM 30/09/2004 +0100, you wrote:
>With the imminent release of v1.4.0 I'd like to thank everybody who has
>participated in the development, translation, testing, building, re-testing,
>documenting etc. for this new version.
>
>It's taken a while, but we wouldn't be here without all your help.
>
>Thanks, Merci...
>
>Eric
>
>
>
>-------------------------------------------------------
>This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
>Use IT products in your business? Tell us what you think of them. Give us
>Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
>http://productguide.itmanagersjournal.com/guidepromo.tmpl
>_______________________________________________
>IPCop-devel mailing list
>IPC...@li...
>https://lists.sourceforge.net/lists/listinfo/ipcop-devel

------------------------------------------------------------------
Guy Ellis
gu...@tr...
http://www.traverse.com.au
Tel 03 9486 7775
Fax 03 9482 7754
Mobile 0419 398 234
------------------------------------------------------------------

Hiya

I've just moved from 1.4.0b9 to 1.4.0rc5.

Having strange problems where I can't seem to get any port forwarding to
work in this version.

External access to 222/tcp and 445/tcp works once enabled in the "external
service access" section but manual port forwards just don't seem to work.

I restored from a backup thru the web gui.

Is this a known problem with a known fix? If any further info is needed,
please let me know.

Cheers
Tom

With the imminent release of v1.4.0 I'd like to thank everybody who has
participated in the development, translation, testing, building, re-testing,
documenting etc. for this new version.

It's taken a while, but we wouldn't be here without all your help.

Thanks, Merci...

Eric

Maybe it bores non-german IPCoppers, but I'd like 2no
if fcdsl.o is now loading without 'unresolved symbol' - messages
and doesn't crash after some minutes.
My last try was RC5, and I would really appreciate to get rid of my external DSL-"toaster".

TshaKhoSan

Alan Hourihane wrote:

>On Mon, Sep 27, 2004 at 10:00:21PM +0200, Morten Christensen wrote:
>  
>
>>I have tried to install both the real rc5-iso and a homebuild version 
>>from cvs just after rc5 was released.
>>
>>One of them was restored from a working 1.3-floppy-backup. One from my 
>>latest working cvs-build from september 18.
>>
>>With both those new installs I cannot recieve e-mail on port 25 and http 
>>on port 80 is not working. I have no idea, what was wrong, but is back 
>>on the well-performing version from september 18.
>>    
>>
>
>O.k. I've found and fixed the bug that caused this. I suspect you don't
>have a BLUE interface which caused the problem.
>
>Alan.
>  
>

Tried to install the same floppy-backup on todays 1.4.0-iso.

Now ipforward works as expected.

Great work  :-)

--
mvh
Morten Christensen

On Thu, Sep 30, 2004 at 05:55:50PM +0100, Alan Hourihane wrote:
> On Thu, Sep 30, 2004 at 09:13:29AM -0700, A. Scott-Fleming wrote:
> > On 30 Sep 2004 at 9:45, Mark Wormgoor wrote:  
> > 
> > > Hi, 
> > > 
> > > Actually, as far as I know, this doesn't work.  Dhcpd doesn't log
> > > static leases in the dhcpd.leases file and thus dynamic resolution
> > > doesn't work. You need to add a static entry on the hosts page for
> > > each static lease. 
> > 
> > So should the page where you add static leases do this for you automatically?  Or should it have a link to the  page 
> > where you edit the hosts file and just display a reminder message? 
> 
> Why should it. You necessarily have to use hostnames because of static
> leases. It's not mandatory.

                 ^^^^^^^^^^^^^^^
                 You don't necessarily

Alan.

On Thu, Sep 30, 2004 at 09:13:29AM -0700, A. Scott-Fleming wrote:
> On 30 Sep 2004 at 9:45, Mark Wormgoor wrote:  
> 
> > Hi, 
> > 
> > Actually, as far as I know, this doesn't work.  Dhcpd doesn't log
> > static leases in the dhcpd.leases file and thus dynamic resolution
> > doesn't work. You need to add a static entry on the hosts page for
> > each static lease. 
> 
> So should the page where you add static leases do this for you automatically?  Or should it have a link to the  page 
> where you edit the hosts file and just display a reminder message? 

Why should it. You necessarily have to use hostnames because of static
leases. It's not mandatory.

Alan.

On Thursday 30 September 2004 10:08, Mark Wormgoor wrote:
> Hi,
>
> >> I upgraded from 1.4.0a10. There is a textual/cosmetic issue on the
> >> connection
> >> page. I'm using DSL and the system home page still says "ipcop.alpha-1=
0"
> >> in
> >> the tab title of the dialup status box in the middle of the screen.
> >>
> >> No other problem have been found.
> >
> > Did you add header.pl in the /var/ipcop/backup/user.include?
> >
> > Did you install an add-on wich could have done the same (look inside the
> > file)?
>
> Nope.  The box header contains the hostname.  So, you've named your
> machine ipcop.alpha-10 (remember it asking you for the domainname after
> the restore?) and now you're surprised that it's showing up everywhere ;-)

Details, details, details. How'm I supposed to remember this stuff?

Anyway, is there a way to change this through the admin interface, or must =
I=20
do some manual editing?

=2D-=20

"Debugging is twice as hard as writing the code in the first place.
Therefore, if you write the code as cleverly as possible, you are,
by definition, not smart enough to debug it." - Brian W. Kernighan

This thread dovetails into a similar issue I posted
about servers in Orange, and what it took to access
them by hostname from green.

I found the hosts page needs to be reworked a bit (see
details below) to allow for easier entry of hostname
and domains.

I also found on 1.4.0b9 the -SIGHUP signal was not
reliably sent to the dnsmasq process.

Please see the detailed message below:

> Hello,
> 
> After battling with dns servers, hosts files, apache
> configs, and reading seemingly endless posts about
> this subject, I have found a consistent way of
> getting
> Apache virtual hosts in the orange DMZ accessible
> from
> the Green network.
> 
> I hope some of this can be incorporated into IPCop
> to
> help others doing this similar task. From the number
> of posts and FAQ's found on this subject, I am
> guessing this is a very common requirement.
> 
> Setup:
> IPCop 1.4b9
> red, green, orange, blue
> 
> Internal DNS server in Green.
> Public DNS server in Orange.
> Apache on Linux using virtual hosts in Orange.
> 
> Requirement:
> Apache virtual hosts in Orange have to be accessible
> from green.
> 
> Short-term solution:
> Add the FQDN and orange ip address to the Green DNS
> server.
> 
> Add the FQDN and red ip address to the orange DNS
> server (We have a block of public IP's, so we are
> actually just forwarding DNS from one of the IP's to
> the DNS machine in Orange...)
> 
> Add the orange Apache server ip and FQDN to IPCop's
> /etc/hosts file.
> 
> On IPCop, run:
> # ps ax|grep dnsmasq
> 
> Remember the PID of dnsmasq (623 in my case, but
> yours
> will likely be different), then run:
> # kill -SIGHUP 623
> 
> Now virtual hosts in orange are accessible using
> their
> FQDN from green.
> 
> Long-term solution:
> Modify IPCop's "Services/Edit Hosts" page to run
> "kill
> -SIGHUP pid" on the dnsmasq process automatically
> when
> an entry is saved, and also modify the page to more
> easily enter FQDN's.
> 
> Currently, entering "www" in the host name field,
> and
> "blah.com" in the optional domain field results in
> the
> following in the /etc/hosts file:
> 123.123.123.123 www www.blah.com
> 
> We need to enter eg. just blah.com for hosted
domains , but the page
> does
> not allow this since host is mandatory and domain is
> optional.
> 
> Changing the page to have just 2 fields instead of 3
> should simplify its usage.
> 
> The page only really needs the "Host IP address:"
> field, and a "Host name:" field. A simple help text
> can show the user the proper format for the ip and
> name entries (so they don't mess up their hosts
> file).
> 
> 
> Is this something that can go into IPCop easily?
> 
> Brian

<snip>


Sincerely,

Brian

______________________________________________________________________ 
Post your free ad now! http://personals.yahoo.ca

On 30 Sep 2004 at 9:45, Mark Wormgoor wrote:  

> Hi, 
> 
> Actually, as far as I know, this doesn't work.  Dhcpd doesn't log
> static leases in the dhcpd.leases file and thus dynamic resolution
> doesn't work. You need to add a static entry on the hosts page for
> each static lease. 

So should the page where you add static leases do this for you automatically?  Or should it have a link to the  page 
where you edit the hosts file and just display a reminder message? 


--
Angus Scott-Fleming
GeoApps, Tucson, Arizona
1-520-290-5038 / fax 1-208-248-3124
+-----------------------------------+

On Thu, Sep 30, 2004 at 08:52:31AM -0700, Trevor Benson wrote:
> I was just reviewing the FAQ and went over the allowed access area and
> noticed some changes to blue.  Is this accurate?  I thought blue was a
> level between green and orange, and the access worked the same as the
> others, where blue has access to those above it, but not below it.  Here
> is what the FAQ currently says for everything but green:
> 
> Blue -> Firewall: Closed, Use Blue Access 
> Blue -> Red: Closed, Use Blue Access 
> Blue -> Orange: Closed, Use Blue Access
> 
> I thought Blue had access to the internet (Red) by default, and that it
> could reach to Orange as well.  But that Firewall access required the
> 'blue access' page to be used, and that Green (being more secure then
> blue) also needed a VPN or some other access configured.  Have I missed
> some changes in the last 2-3 months?

Blue has worked like this since March, but the FAQ wasn't updated to
reflect the current operation until recently.

Alan.

I was just reviewing the FAQ and went over the allowed access area and
noticed some changes to blue.  Is this accurate?  I thought blue was a
level between green and orange, and the access worked the same as the
others, where blue has access to those above it, but not below it.  Here
is what the FAQ currently says for everything but green:

Blue -> Firewall: Closed, Use Blue Access=20
Blue -> Red: Closed, Use Blue Access=20
Blue -> Orange: Closed, Use Blue Access

I thought Blue had access to the internet (Red) by default, and that it
could reach to Orange as well.  But that Firewall access required the
'blue access' page to be used, and that Green (being more secure then
blue) also needed a VPN or some other access configured.  Have I missed
some changes in the last 2-3 months?

Trevor

On Thu, 30 Sep 2004 09:32:09 +0800, fli...@ii... wrote in
message <109...@ma...>:

>  > consolidated into a single /22 (255.255.252.0) network instead?

..booo,  /22 != (255.255.252.0) network, you want either:
arnt@a45:~/p90/so $ ipcalc 192.168.0.0/30

Address:   192.168.0.0           11000000.10101000.00000000.000000 00
Netmask:   255.255.255.252 = 30  11111111.11111111.11111111.111111 00
Wildcard:  0.0.0.3               00000000.00000000.00000000.000000 11
=>
Network:   192.168.0.0/30        11000000.10101000.00000000.000000 00
(Class C) Broadcast: 192.168.0.3          
11000000.10101000.00000000.000000 11 HostMin:   192.168.0.1          
11000000.10101000.00000000.000000 01 HostMax:   192.168.0.2          
11000000.10101000.00000000.000000 10 Hosts/Net: 2                    
(Private Internet RFC 1918)

..or:
arnt@a45:~/p90/so $ ipcalc 192.168.0.0/22

Address:   192.168.0.0           11000000.10101000.000000 00.00000000
Netmask:   255.255.252.0 = 22    11111111.11111111.111111 00.00000000
Wildcard:  0.0.3.255             00000000.00000000.000000 11.11111111
=>
Network:   192.168.0.0/22        11000000.10101000.000000 00.00000000
(Class C) Broadcast: 192.168.3.255         11000000.10101000.000000
11.11111111 HostMin:   192.168.0.1           11000000.10101000.000000
00.00000001 HostMax:   192.168.3.254         11000000.10101000.000000
11.11111110 Hosts/Net: 1022                  (Private Internet RFC 1918)


..or something else instead.

-- 
..med vennlig hilsen = with Kind Regards from Arnt... ;-)
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.

Hi,

>> I upgraded from 1.4.0a10. There is a textual/cosmetic issue on the
>> connection
>> page. I'm using DSL and the system home page still says "ipcop.alpha-10"
>> in
>> the tab title of the dialup status box in the middle of the screen.
>>
>> No other problem have been found.
>>
> Did you add header.pl in the /var/ipcop/backup/user.include?
>
> Did you install an add-on wich could have done the same (look inside the
> file)?

Nope.  The box header contains the hostname.  So, you've named your
machine ipcop.alpha-10 (remember it asking you for the domainname after
the restore?) and now you're surprised that it's showing up everywhere ;-)

Kind regards,

Mark
-- 
***************************************************************
* |\    /|      |  /|  /       Mark Wormgoor                  *
* | \  / |      | / | /        mailto:ma...@wo...       *
* |  \/  |ark   |/  |/ormgoor  http://www.wormgoor.com/mark/  *
***************************************************************

Selon Phil Barnett <ph...@ph...>:

>
> I upgraded from 1.4.0a10. There is a textual/cosmetic issue on the conn=
ection
> page. I'm using DSL and the system home page still says "ipcop.alpha-10=
" in
> the tab title of the dialup status box in the middle of the screen.
>
> No other problem have been found.
>
Did you add header.pl in the /var/ipcop/backup/user.include?

Did you install an add-on wich could have done the same (look inside the =
file)?

Gilles

Thanks for your message. I already wrote a small untidy perl script for the
import Arnt wanted to do by hand.
It is on my wiki page and linked on the HowToTranslate Wiki.
http://www.ipcop.org/cgi-bin/twiki/view/Main/MichaelSpann

Of course a php sript accessing the mysql-server directly would be better
than posting the form data with my perl script. ... But have a nice
holiday... ;)

Perhaps we could work on a separate script together? I agree that my perl
script is not the best solution for ongoing development, but I found no
other script on the wiki pages on ipcop.org....

Regards,

Michael

----- Original Message ----- 
From: "Marco van Beek" <mva...@su...>
To: "dr-ms" <dr...@ly...>
Cc: <IPC...@li...>; <ipc...@li...>
Sent: Thursday, September 30, 2004 11:03 AM
Subject: Re: [IPCop-devel] ..GNU/Linux Somali translation for ipcop-1.4.0
firewall


> dr-ms wrote:
>
> > pushed the numbers up to  628/1061
> >
> > by the way... wouldn't it be possible to write a script to insert the
data ?
> > The digital file could be read by the php-script/SQL-Server etc... ??
> > Thanks your you work and hopefully we can announce 1.4.0 soon!!
> >
> > Michael Spann
>
> Yep. There are a couple of scripts already on the site for pervious
> imports, but I am about to go away on holiday for a week.
>
> BTW the backend is MySQL, not SQL-Server. Otherwise you would probably
> find M$ owned the translation copyright !! (page 109876543578564 of the
>   license small print)
>
> Regards,
>
> Marco.
>
>

dr-ms wrote:

> pushed the numbers up to  628/1061
> 
> by the way... wouldn't it be possible to write a script to insert the data ?
> The digital file could be read by the php-script/SQL-Server etc... ??
> Thanks your you work and hopefully we can announce 1.4.0 soon!!
> 
> Michael Spann

Yep. There are a couple of scripts already on the site for pervious 
imports, but I am about to go away on holiday for a week.

BTW the backend is MySQL, not SQL-Server. Otherwise you would probably 
find M$ owned the translation copyright !! (page 109876543578564 of the 
  license small print)

Regards,

Marco.

That's what I was trying to say, but maybe it didn't come across properly.

Alan.

On Thu, Sep 30, 2004 at 09:45:30AM +0200, Mark Wormgoor wrote:
> Hi,
> 
> Actually, as far as I know, this doesn't work.  Dhcpd doesn't log static
> leases in the dhcpd.leases file and thus dynamic resolution doesn't work. 
> You need to add a static entry on the hosts page for each static lease.
> 
> Kind regards,
> 
> Mark
> 
> Alan Hourihane said:
> > Oh,
> >
> > and for dynamically assigned names by the client you need to check the
> > file....
> >
> > /var/state/dhcp/dhcpd.leases
> >
> > and look for hostname or client-hostname and dnsmasq will parse that
> > information and add it to it's cache.
> >
> > You should also do 'ps ax | grep dnsmasq' and ensure it's started with
> > the -l flag and the dhcpd.leases file passed to it.
> >
> > Alan.
> >
> > On Wed, Sep 29, 2004 at 11:26:29PM +0100, Alan Hourihane wrote:
> >> I use dynamic and static hosts for DHCP and don't see any such problems.
> >>
> >> For a start, you HAVE to add hosts via the hosts web gui or the dnsmasq
> >> process isn't restarted, and so never re-reads /etc/hosts until you
> >> send it SIGHUP. The WEB GUI page does this for you automatically.
> >>
> >> Alan.
> >>
> >> On Wed, Sep 29, 2004 at 04:27:48PM -0500, Haudy Kazemi wrote:
> >> > I don't know how closely the ipcop-dev list folks watch the ipcop-user
> >> list
> >> > but there appears to be an issue with DNS resolution for statically
> >> > assigned DHCP addresses.  The subjects on the user list are
> >> > 'local DNS lookups for fixed vs auto-assigned DHCP addresses' and
> >> 'Issues
> >> > with hosts file and ping'.  The problem apparently has been seen on
> >> IPCop
> >> > 1.4.0b6, 1.4.0b9, and 1.4.0rc5.
> >> >
> >> > Here is the most recent posting by myself copied from the user list
> >> about
> >> > this issue:
> >> >
> >> >
> >> > ----------------
> >> > This sounds like the same issue that Lorrin and myself have
> >> encountered on
> >> > 1.4.0.b9 and 1.4.0b6 respectively.  That message thread has the
> >> subject
> >> > 'local DNS lookups for fixed vs auto-assigned DHCP
> >> >  addresses'.  We don't yet have an answer other than to manually
> >> create
> >> > entries in the Hosts file (whether thru the web interface to HOSTS or
> >> via
> >> > command line editing of HOSTS.)  Regular dynamic DHCP assigned
> >> addresses
> >> > work fine when pinging by name.  Statically assigned DHCP addresses do
> >> not
> >> > work when pinging by name because IPCop isn't resolving them correctly
> >> (by
> >> > default).
> >> >
> >> > At 01:13 PM 9/29/2004 -0700, strowger wrote:
> >> > >I just upgraded to rc5 last night, so I figured I'd sort a few
> >> > >things out while I was in there. I have 3 printers, 192.168.0.50
> >> > >, .51, and .52. I added static leases for them in ipcop and set
> >> > >them to use dhcp. I added an entry for each of them in the hosts
> >> > >file; spock(50), kirk(51), and bones(52). I cannot ping any of
> >> > >the devices, but nslookup works corectly. Did I miss something
> >> > >in the setup here?
> >> > >
> >> > >
> >> > >
> >> > >__________________________________
> >> > >Do you Yahoo!?
> >> > >Yahoo! Mail - 50x more storage than other providers!
> >> > >http://promotions.yahoo.com/new_mail
> >> > >
> >> > >
> >> > >-------------------------------------------------------
> >> > >This SF.net email is sponsored by: IT Product Guide on
> >> ITManagersJournal
> >> > >Use IT products in your business? Tell us what you think of them.
> >> Give us
> >> > >Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find
> >> out more
> >> > >http://productguide.itmanagersjournal.com/guidepromo.tmpl
> >> > >_______________________________________________
> >> > >IPCop-user mailing list
> >> > >IPC...@li...
> >> > >https://lists.sourceforge.net/lists/listinfo/ipcop-user
> >> > >
> >> > >
> >> >
> >> >
> >> > -------------------------------------------------------
> >> > This SF.net email is sponsored by: IT Product Guide on
> >> ITManagersJournal
> >> > Use IT products in your business? Tell us what you think of them. Give
> >> us
> >> > Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out
> >> more
> >> > http://productguide.itmanagersjournal.com/guidepromo.tmpl
> >> > _______________________________________________
> >> > IPCop-devel mailing list
> >> > IPC...@li...
> >> > https://lists.sourceforge.net/lists/listinfo/ipcop-devel
> >>
> >>
> >> -------------------------------------------------------
> >> This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
> >> Use IT products in your business? Tell us what you think of them. Give
> >> us
> >> Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out
> >> more
> >> http://productguide.itmanagersjournal.com/guidepromo.tmpl
> >> _______________________________________________
> >> IPCop-devel mailing list
> >> IPC...@li...
> >> https://lists.sourceforge.net/lists/listinfo/ipcop-devel
> >
> >
> > -------------------------------------------------------
> > This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
> > Use IT products in your business? Tell us what you think of them. Give us
> > Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out
> > more
> > http://productguide.itmanagersjournal.com/guidepromo.tmpl
> > _______________________________________________
> > IPCop-devel mailing list
> > IPC...@li...
> > https://lists.sourceforge.net/lists/listinfo/ipcop-devel
> >
> 
> 
> -- 
> ***************************************************************
> * |\    /|      |  /|  /       Mark Wormgoor                  *
> * | \  / |      | / | /        mailto:ma...@wo...       *
> * |  \/  |ark   |/  |/ormgoor  http://www.wormgoor.com/mark/  *
> ***************************************************************
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
> Use IT products in your business? Tell us what you think of them. Give us
> Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
> http://productguide.itmanagersjournal.com/guidepromo.tmpl
> _______________________________________________
> IPCop-devel mailing list
> IPC...@li...
> https://lists.sourceforge.net/lists/listinfo/ipcop-devel

Hi,

Actually, as far as I know, this doesn't work.  Dhcpd doesn't log static
leases in the dhcpd.leases file and thus dynamic resolution doesn't work. 
You need to add a static entry on the hosts page for each static lease.

Kind regards,

Mark

Alan Hourihane said:
> Oh,
>
> and for dynamically assigned names by the client you need to check the
> file....
>
> /var/state/dhcp/dhcpd.leases
>
> and look for hostname or client-hostname and dnsmasq will parse that
> information and add it to it's cache.
>
> You should also do 'ps ax | grep dnsmasq' and ensure it's started with
> the -l flag and the dhcpd.leases file passed to it.
>
> Alan.
>
> On Wed, Sep 29, 2004 at 11:26:29PM +0100, Alan Hourihane wrote:
>> I use dynamic and static hosts for DHCP and don't see any such problems.
>>
>> For a start, you HAVE to add hosts via the hosts web gui or the dnsmasq
>> process isn't restarted, and so never re-reads /etc/hosts until you
>> send it SIGHUP. The WEB GUI page does this for you automatically.
>>
>> Alan.
>>
>> On Wed, Sep 29, 2004 at 04:27:48PM -0500, Haudy Kazemi wrote:
>> > I don't know how closely the ipcop-dev list folks watch the ipcop-user
>> list
>> > but there appears to be an issue with DNS resolution for statically
>> > assigned DHCP addresses.  The subjects on the user list are
>> > 'local DNS lookups for fixed vs auto-assigned DHCP addresses' and
>> 'Issues
>> > with hosts file and ping'.  The problem apparently has been seen on
>> IPCop
>> > 1.4.0b6, 1.4.0b9, and 1.4.0rc5.
>> >
>> > Here is the most recent posting by myself copied from the user list
>> about
>> > this issue:
>> >
>> >
>> > ----------------
>> > This sounds like the same issue that Lorrin and myself have
>> encountered on
>> > 1.4.0.b9 and 1.4.0b6 respectively.  That message thread has the
>> subject
>> > 'local DNS lookups for fixed vs auto-assigned DHCP
>> >  addresses'.  We don't yet have an answer other than to manually
>> create
>> > entries in the Hosts file (whether thru the web interface to HOSTS or
>> via
>> > command line editing of HOSTS.)  Regular dynamic DHCP assigned
>> addresses
>> > work fine when pinging by name.  Statically assigned DHCP addresses do
>> not
>> > work when pinging by name because IPCop isn't resolving them correctly
>> (by
>> > default).
>> >
>> > At 01:13 PM 9/29/2004 -0700, strowger wrote:
>> > >I just upgraded to rc5 last night, so I figured I'd sort a few
>> > >things out while I was in there. I have 3 printers, 192.168.0.50
>> > >, .51, and .52. I added static leases for them in ipcop and set
>> > >them to use dhcp. I added an entry for each of them in the hosts
>> > >file; spock(50), kirk(51), and bones(52). I cannot ping any of
>> > >the devices, but nslookup works corectly. Did I miss something
>> > >in the setup here?
>> > >
>> > >
>> > >
>> > >__________________________________
>> > >Do you Yahoo!?
>> > >Yahoo! Mail - 50x more storage than other providers!
>> > >http://promotions.yahoo.com/new_mail
>> > >
>> > >
>> > >-------------------------------------------------------
>> > >This SF.net email is sponsored by: IT Product Guide on
>> ITManagersJournal
>> > >Use IT products in your business? Tell us what you think of them.
>> Give us
>> > >Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find
>> out more
>> > >http://productguide.itmanagersjournal.com/guidepromo.tmpl
>> > >_______________________________________________
>> > >IPCop-user mailing list
>> > >IPC...@li...
>> > >https://lists.sourceforge.net/lists/listinfo/ipcop-user
>> > >
>> > >
>> >
>> >
>> > -------------------------------------------------------
>> > This SF.net email is sponsored by: IT Product Guide on
>> ITManagersJournal
>> > Use IT products in your business? Tell us what you think of them. Give
>> us
>> > Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out
>> more
>> > http://productguide.itmanagersjournal.com/guidepromo.tmpl
>> > _______________________________________________
>> > IPCop-devel mailing list
>> > IPC...@li...
>> > https://lists.sourceforge.net/lists/listinfo/ipcop-devel
>>
>>
>> -------------------------------------------------------
>> This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
>> Use IT products in your business? Tell us what you think of them. Give
>> us
>> Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out
>> more
>> http://productguide.itmanagersjournal.com/guidepromo.tmpl
>> _______________________________________________
>> IPCop-devel mailing list
>> IPC...@li...
>> https://lists.sourceforge.net/lists/listinfo/ipcop-devel
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
> Use IT products in your business? Tell us what you think of them. Give us
> Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out
> more
> http://productguide.itmanagersjournal.com/guidepromo.tmpl
> _______________________________________________
> IPCop-devel mailing list
> IPC...@li...
> https://lists.sourceforge.net/lists/listinfo/ipcop-devel
>


-- 
***************************************************************
* |\    /|      |  /|  /       Mark Wormgoor                  *
* | \  / |      | / | /        mailto:ma...@wo...       *
* |  \/  |ark   |/  |/ormgoor  http://www.wormgoor.com/mark/  *
***************************************************************

Le Jeudi 30 Septembre 2004 01:30, fli...@ii... a =E9crit :
> I post this to IPCOP user mailing list a couple of days ago, with no
> responce. I hope someone can help.
>
> Hi,
>
> I upgrade my IPCOP box from 1.3f9 to 1.4rc5 today. I use IPCOP as a router
> for our private network as well as access to the internet. I have static
> routes set up for each of the different subnet in rc.netaddress.up
>
> For example
> route add -net 192.168.1.1 netmask 255.255.255.0 gw 192.168.0.1
> route add -net 192.168.2.1 netmask 255.255.255.0 gw 192.168.0.1
> route add -net 192.168.3.1 netmask 255.255.255.0 gw 192.168.0.1
>
> With 1.4rc5, iptables started blocking the local traffic. Is there a way =
to
> turn this off? Or is there something wrong with my configuration?
> This is what is shown in the log.
>
Use "surnetting".

With a mask of 255.255.0.0 every addresse beginning with=20
192.168.x.x will be directed to correct ethX

route add -net 192.168.0.0 netmask 255.255.0.0 gw 192.168.0.1
Use also the correct mask (255.255.0.0) everywhere in Ipcop config)


Of course 192.168.0.1 is another router connected to GREEN isn'it ?


bye
=46ranck

Alan Hourihane wrote:
> On Mon, Sep 27, 2004 at 10:00:21PM +0200, Morten Christensen wrote:
> 
>>I have tried to install both the real rc5-iso and a homebuild version 
>>from cvs just after rc5 was released.
>>
>>One of them was restored from a working 1.3-floppy-backup. One from my 
>>latest working cvs-build from september 18.
>>
>>With both those new installs I cannot recieve e-mail on port 25 and http 
>>on port 80 is not working. I have no idea, what was wrong, but is back 
>>on the well-performing version from september 18.
> 
> 
> O.k. I've found and fixed the bug that caused this. I suspect you don't
> have a BLUE interface which caused the problem.
> 
> Alan.


Yes. No blue interface.

Thanks for your work.


--
mvh
Morten Christensen

I upgraded from 1.4.0a10. There is a textual/cosmetic issue on the connecti=
on=20
page. I'm using DSL and the system home page still says "ipcop.alpha-10" in=
=20
the tab title of the dialup status box in the middle of the screen.

No other problem have been found.

=2D-=20

"Debugging is twice as hard as writing the code in the first place.
Therefore, if you write the code as cleverly as possible, you are,
by definition, not smart enough to debug it." - Brian W. Kernighan

ipc...@li... wrote on 30/09/2004 08:07:47 AM:

> On Sep 27, 2004, at 01:23, Ren...@fl... wrote:
> >
> > I use IPCOP as a router for our private network as well as access to 
> > the internet.
> 
> how is your internal network laid out? red/green? one green card, or 
> multiple green interfaces? do you have all of the internal IP subnet 
> blocks sharing a common switch/hub, or is there some other routing 
> device (a "layer 3 switch", for example) involved?

The IPCOP box has one green and one red nic. The red is connected to the
internet via ADSL. The green is connected to the lan. There are cisco routers
connected to the lan for the private frame relay network. There are 4 site, each
subnet is for those sites. When Ipcop receives a request for the private address
space it forward it to the cisco routers.

> 
> is there a real need for these IP ranges to be separated like this- 
> some security issue, or traffic management, or what? or could they be 
> consolidated into a single /22 (255.255.252.0) network instead?
> 
I didn't design the original setup. That could be a fix. However I don't manage
those routers.

> and what determines which machines become members of each subnet? are 
> all of the .0.x machines servers, the .1.x machines are printers, the 
> .2.x machines are workstations with static IP addresses, and the .3.x 
> machines are DHCP clients?

Each subet is a different geographical site with many different devices

> 
> > I have static routes set up for each of the different subnet in 
> > rc.netaddress.up
> >
> >  For example
> > route add -net 192.168.1.1 netmask 255.255.255.0 gw 192.168.0.1
> > route add -net 192.168.2.1 netmask 255.255.255.0 gw 192.168.0.1
> > route add -net 192.168.3.1 netmask 255.255.255.0 gw 192.168.0.1
> 
> where are these routing commands being executed? on the ipcop machine? 
> i don't see how they ever worked to begin with, but i'll take your word 
> for it that they did...
> 

I made a mistake with the routing commands they should be

route add -net 192.168.1.0 netmask 255.255.255.0 gw 192.168.0.1
route add -net 192.168.2.0 netmask 255.255.255.0 gw 192.168.0.1
route add -net 192.168.3.0 netmask 255.255.255.0 gw 192.168.0.1

The ip address of the cisco router is 192.168.0.1 and the ipcop address is
192.168.0.254 and is setup as the default gateway of the network.

> 
> > With 1.4rc5, iptables started blocking the local traffic. Is there a 
> > way to turn this off? Or is there something wrong with my 
> > configuration?
> 
> if eth0 (your green card) is 192.168.0.1/24, any incoming packet which 
> claims to be from an IP address outside that subnet should probably be 
> dropped. this is the "rp_filter" mechanism at work- it's an 
> anti-spoofing mechanism. i suspect this is what's happening.
> 
> the solution really depends on how your network is laid out, and this 
> message doesn't have nearly enough detail for somebody to even make a 
> guess.
> 
> > I was able to ping the hosts, but I could not do anything else.
> 
> able to ping which hosts, and from where?

I'm able to ping host on the remote sites. This what is being droped in the log

Time    Chain        Iface Proto Source     Port  MAC Address Destinationst Port
12:42:43 NEW not SYN? eth0 TCP 192.168.0.101 23(TELNET) ::::: 192.168.1.45 2147

I hope this gives a better picture